Follow the money: how investigators trace laundered funds

As of 10 November 2026, FinCEN had processed 9,641 requests under section 314(a) of the USA PATRIOT Act, and 8,670 of them concerned money laundering cases, according to its 314(a) fact sheet. Every two weeks FinCEN tells designated contacts at US financial institutions that new requests are waiting, each naming the subjects of an investigation. From the posting date, an institution has two weeks to search its records for accounts a named subject held over the last 12 months and transactions outside an account over the last 6 months. Matches go back through a secure portal. Each request is one investigator's trace reaching a firm. The firm can answer it only from records it already keeps.

What does "follow the money" mean?

Following the money means investigating financial transactions to get information or evidence about a crime, a suspect or a criminal network. That is how the Basel Institute on Governance defines the phrase in its quick guide to following the money.

In practice a trace runs the stages of money laundering backward: from the account or asset where the money sits today, through the layering that moved it between accounts, companies and countries, to the payment that first brought it in.

A money trail is the chain of transactions an investigator can document between a crime and its proceeds. Because money trails cross borders, the Basel guide notes, they can be followed from either end. Picture a bribe paid into a consultant's account abroad. One team starts from the bribe and follows it forward to the house it paid for, while another starts from the house, asks who paid for it and works back. The same guide explains why the method lasts: financial records can be reached years after a crime, they are hard to destroy, and because firms produce them in the course of business, a court is likely to accept them as evidence.

The law builds it into investigators' powers. Under section 341 of the Proceeds of Crime Act 2002 (POCA), a confiscation investigation looks into whether a person has benefited from criminal conduct, or the extent or whereabouts of that benefit. In the EU, Directive (EU) 2024/1260 requires asset tracing to start immediately once an investigation concerns an offense liable to give rise to substantial economic benefit, though member states may limit this to offenses committed within a criminal organization.

Under Recommendation 30 of the FATF standards, law enforcement should run a proactive parallel financial investigation alongside the investigation of laundering or the underlying crime, at least in cases involving major proceeds generating offenses.

Where does the phrase come from?

In the 1976 film All the President's Men, the Watergate source Deep Throat says it, in William Goldman's screenplay. The line is not in the earlier book by Carl Bernstein and Bob Woodward, and the idea that the real source said it to the reporters is folklore. In 2011 the quotations editor Fred Shapiro pointed to an earlier use, quoted in the then forthcoming Dictionary of Modern Proverbs: testimony at 1974 Senate Judiciary Committee hearings on the nomination of Earl J. Silbert as US Attorney. There a witness recalled advising Silbert to follow the money, and added that following the money had not worked because the records did not exist or had been destroyed.

How do investigators follow the money?

Picture a payment firm whose monitoring flags a customer who receives dozens of small transfers from different senders each week and sends the total on within a day. The firm reviews the alert and files a suspicious activity report. Investigators who pick up the report obtain the records of the bank that received the onward payments and find the money paid into a company account. The company's statements show a payment to a property seller, and the land register shows an apartment bought in the company's name. Four sets of records, read in order, tie the small transfers to one asset.

The work falls into four steps.

1. The lead. A trace starts from a suspicious activity report, a 314(a) match, a tip or a firm's own monitoring. The Basel guide notes that watching live transactions for red flags can help detect a crime while it happens, which is the work transaction monitoring software does inside one firm.
2. The records. Investigators then obtain each firm's records with the order their law provides: account opening files and identity evidence, statements, wire messages naming originator and beneficiary, card and device data.
3. The map. Analysts lay the flows out account by account and mark where money splits, pools or changes form. Where records are thin, forensic accounting adds methods such as net worth analysis, which works out income from what a person owns and spends.
4. The assets. The map ends at property that can be frozen, confiscated or recovered, in a criminal case or by civil forfeiture.

A Justice Department release of 22 April 2026 shows the last two steps in a civil forfeiture complaint. The complaint alleges that a defense contractor obtained payments from the US Defense Logistics Agency through a scheme to defraud it. It alleges that funds from those payments went to a trust set up in Virginia for the private benefit of a foreign official, and that in 2018 about $30 million from the trust went to buy a house in Beverly Hills and, from 2019 to 2022, to renovate it. The FBI, the Defense Criminal Investigative Service and IRS Criminal Investigation investigated the case. The release adds that a civil complaint is merely an allegation and that the government must prove by a preponderance of the evidence that the house is subject to forfeiture.

What can investigators ask your firm for?

FATF Recommendation 31 asks countries to give investigators of money laundering and its predicate offenses the power to compel financial institutions to produce records, and a way to identify in good time whether a person holds or controls accounts. FATF revised Recommendations 4, 30, 31 and 38 on asset recovery in October 2023.

Table 1. What investigators can ask a firm for when they follow the money, as of November 2026

A 314(a) match is a lead only. To obtain documents from a firm that reported a match, the agency must still meet the legal standard of whatever tool it chooses, such as a subpoena. The rule also limits the firm. It may use the information only to report to FinCEN, to decide whether to open or keep an account or carry out a transaction, and to meet its own Bank Secrecy Act duties, and it may not tell anyone other than FinCEN and the agency FinCEN acts for that FinCEN asked, except as needed to comply. The UK reaches the same point by a different route. Under POCA s342, a person who knows or suspects that an investigation is under way or about to start commits an offense by making a disclosure likely to prejudice it, or by falsifying, hiding or destroying documents relevant to it; the defenses in the section include not knowing or suspecting that the disclosure is likely to prejudice the investigation.

One UK order can reach every bank at once. Picture a customer information order that names all financial institutions: each institution served with the officer's written notice must say whether the person holds or held an account there and hand over the identity details in Table 1. A financial institution that fails without reasonable excuse to comply with a customer information order commits an offense under POCA s366. Sharing under 314(b) has one limit on what may be shared: FinCEN's fact sheet says the section gives no authority to pass on a SAR or to disclose that one was filed.

Where does a money trail go cold?

A trail goes cold wherever no record links one step to the next. These five steps often leave none.

• Cash. Once money leaves an account as cash, no statement shows where it went next. Cuckoo smurfing uses that gap: criminal cash is paid into the accounts of people expecting a legitimate transfer from abroad, so value crosses a border without any payment doing so.
• Informal transfers. A hawala broker pays out of its own cash and settles with the sending broker later, so no bank message carries the payment between countries.
• Shells and nominees. A company run by nominee directors puts a name on the account that is not the person in control, and shell companies can move money with the owner's name nowhere on the account.
• Crypto hops. Swaps between assets and chains, and mixers that pool funds, break the links an analyst can follow on a public ledger.
• Borders. Every border adds a request for cooperation. The Basel guide warns that slow investigations risk the assets dissipating before there is enough evidence to seize them, and that laundering cases take longer still when they need international cooperation.

Go back to the payment firm's alert. If the company account had paid the money out in cash instead of buying an apartment, the trace would have stopped at a teller's counter, and the investigators would have had a suspect but no asset to freeze.

What must your records let an investigator do?

For a transaction under due diligence or ongoing monitoring, regulation 40 of the Money Laundering Regulations 2017 requires supporting records sufficient "to enable the transaction to be reconstructed". Eight checks show whether a firm's records pass.

1. Keep records five years and find them fast. 31 CFR 1010.430 sets five years and storage accessible within a reasonable period; regulation 40 counts its five years from the date the firm knows, or has reasonable grounds to believe, that an occasional transaction is complete or the business relationship has ended. Why: an investigator may ask years after the payment.
2. Answer a 314(a) list inside two weeks. Name an owner for each list and keep the search result. Why: the clock runs from the posting date, and only a match gets a reply.
3. Meet UK orders on their dates. Why: a production order defaults to seven days, and an account monitoring order can keep asking for account information for up to 90 days.
4. Keep originator and beneficiary data on wires. 31 CFR 1010.410 makes a sending institution in the US put on every transfer of $3,000 or more the sender's name and address, the sender's account number when the payment is ordered from an account, the amount, the execution date and the recipient's institution, with as many of the recipient's details as came with the order; an intermediary passes on what it received. Why: this travel rule data links one bank's record to the next.
5. Know the person behind a company account. Record the ultimate beneficial owner and how it was verified. Why: in the example the apartment belongs to a company, and the investigators still need the person who controls it.
6. Keep alert and search evidence. complead, formerly Sanction Scanner, records each screening search with who ran it, the term, when it ran and what came back, and it keeps searches that matched nobody as well. Why: investigators ask what the firm saw and when.
7. Follow a mule chain past your own firm. Registered US firms can share transaction data, device numbers and monitoring alerts under 314(b) to identify and report possible laundering or terrorist activity, which FinCEN says can shed "more light upon overall financial trails"; UK firms in the regulated sector can use s188 on the terms in Table 1. Why: a money mule account can be one link in a chain across several firms, and fraud and AML teams often hold different parts of it.
8. Write the SAR so the trail can be read. List the accounts, counterparties, dates and amounts in order, and say where the money went next. Why: a SAR can be the lead a trace starts from, as in the payment firm example.

Which tracing rules, reports and cases were new in 2026?

• 22 April: the Justice Department filed a civil forfeiture complaint that traces about $30 million, by its allegations, from defense contract payments through a trust to a Beverly Hills house.
• 12 June: FinCEN issued a 314(b) fact sheet that replaces its December 2020 version and confirms that registered firms may share information in real time.
• 3 September: a FATF report on underground banking and hawala found that more than 80 percent of jurisdictions see these systems as one of the main channels for professional money laundering in their territory.
• 10 November: FinCEN's count reached 9,641 314(a) requests, 8,670 of them money laundering cases.
• 23 November: the date by which member states must bring Directive (EU) 2024/1260 into national law.

FinCEN's next notice will bring more requests in the same form: subject names, a posting date and two weeks to search. Firms answer only from what they kept. The map an investigator draws from those answers stops where a firm's records stop: at a wire with no beneficiary details, a company account with no owner on file, or an alert closed with no reason written down.