Layering in Money Laundering: Definition, Methods, and Detection
Layering is the second of the three classical stages of money laundering (placement, layering, integration). Its purpose is to obscure the audit trail between the illicit source of funds and their eventual reintroduction into the legitimate economy. Layering uses multiple, often international transfers, conversions between asset types, and the introduction of legal and corporate structures to break the link between origin and destination.
Test for layering indicators in 90 seconds →If placement is the act of getting illicit cash into the financial system, layering is the act of moving it around enough to make tracing it difficult. The classical three-stage model of money laundering, articulated in early FATF reports and now standard across global compliance training, identifies layering as the central technical challenge for both criminals and investigators. Most large-scale laundering schemes spend the majority of their effort, and create the majority of their detectable footprint, at the layering stage.
For AML programs, layering detection is essentially the work of transaction monitoring: identifying movement patterns that have no obvious commercial purpose and that exhibit the hallmarks of deliberate trail obfuscation.
How Layering Works
Once funds have been placed into the financial system, the launderer initiates a series of transfers designed to distance the funds from their illicit source. The methods are varied: domestic and international wire transfers between accounts, conversions between currencies, conversions between fiat and cryptocurrency, purchase and resale of financial instruments (bonds, life insurance, securities), use of trust and shell company structures, and the deliberate routing of funds through multiple jurisdictions, often including some with weaker transparency regimes.
The defining characteristic of layering is the absence of a clear commercial rationale. A genuine business transaction has a discoverable economic purpose: payment for goods, settlement of an invoice, distribution of profit. Layering transactions exhibit movement for movement's sake. The pattern, viewed end-to-end, is what reveals the typology.
Detection Signals
The following indicators, considered individually, are not conclusive. Considered as a pattern, they form the diagnostic basis for layering alerts in mature transaction monitoring programs.
- 01Rapid sequence of transfers across multiple accounts. Funds enter an account and are immediately transferred to a second, then a third, then onward, often within a single day or small number of days, with little or no operational use of the funds in between.
- 02Cross-border transfers without commercial rationale. International wires to and from jurisdictions where the customer has no declared business or family connection, particularly when routed through low-transparency jurisdictions.
- 03Use of multiple intermediary accounts. Funds passing through three or more accounts at different institutions before reaching their apparent destination, with each intermediary holding the funds only briefly.
- 04Currency conversion without economic purpose. Conversion between currencies that the customer has no apparent need for, particularly when the conversion happens at the layering stage rather than in connection with a specific commercial activity.
- 05Conversion to and from cryptocurrency mid-flow. Funds entering the bank as fiat, leaving to a cryptocurrency exchange, returning as fiat from a different exchange days or weeks later. This pattern bridges the transparency boundary that crypto introduces.
- 06Routing through high-risk or low-transparency jurisdictions. Transit accounts in jurisdictions known for weaker AML enforcement, bank secrecy provisions, or limited beneficial ownership transparency.
- 07Use of shell companies as intermediaries. Funds passing through entities with no genuine economic activity, often newly formed or with nominee directors and shareholders.
- 08Round-tripping patterns. Funds leaving the originating jurisdiction and returning, often within months, presented as foreign investment or loan proceeds. See round-tripping for the dedicated typology.
- 09Splitting and recombining transfers. A single inflow split across multiple onward transfers which then recombine at a downstream destination. This is layering through fragmentation.
- 10Use of life insurance, bonds, or annuities as transient holdings. Purchase of financial instruments quickly followed by surrender or redemption, with the laundering value being the trail of legitimate-looking transactions rather than any genuine investment objective.
- 11Trade-finance documentation inconsistent with goods. Bills of lading, invoices, and customs documentation that do not match the apparent goods being shipped, indicating that trade flows are functioning as a layering channel.
Real-World Patterns
A corporate customer wires 4 million USD from its operating account to a subsidiary in a regional treasury hub. Within 48 hours the subsidiary wires the same amount, less small differences attributed to fees, to a second subsidiary in a different jurisdiction. That subsidiary purchases sovereign bonds, holds them for three weeks, sells them, and wires the proceeds to a third entity that returns the funds to the original group as a "loan." This is classical layering using inter-affiliate transfers and bond-instrument cycling.
An individual customer receives 250,000 EUR via inheritance into a brokerage account, immediately purchases units in a fund of funds, redeems them ten days later, transfers the proceeds to a cryptocurrency exchange, converts to a privacy coin, transfers to a wallet at a different exchange in a different jurisdiction, converts back to fiat, and remits to a third-party recipient. The seven-step chain has no commercial purpose other than the obscuring of the relationship between the inheritance and the eventual recipient.
Test these indicators against an actual transaction or relationship. The Red Flag Check assessment tool includes scenario-specific red flag sets covering layering alongside the broader AML indicator set. Run the assessment →
Regulatory Basis
The placement-layering-integration model is not encoded in statute but underpins the FATF Recommendations and most national AML frameworks. FATF Recommendations 10 (CDD), 11 (record-keeping), 16 (wire transfers), and 20 (reporting of suspicious transactions) all create obligations whose practical operation centers on detecting layering activity. National financial intelligence units (FinCEN, NCA, FINTRAC, AUSTRAC, and FIU equivalents) publish typology reports almost annually that focus heavily on layering methodologies, with crypto-bridge layering and trade-based layering receiving the most attention since 2022.
Common Investigation Mistakes
Investigating individual transfers rather than the end-to-end pattern, treating high transaction volume as inherently suspicious without considering the customer's declared business, missing layering that uses legal and regulated counterparties as intermediaries, and failing to integrate cryptocurrency transaction monitoring with traditional banking transaction monitoring. Layering hides in volume and apparent legitimacy; it does not announce itself in any single transaction.