Money Laundering Methods and Typologies: 2026 Guide

Placement, layering, and integration. Placement is the point at which criminal proceeds first enter the financial system or are converted into another asset: Cash deposited in amounts below a reporting threshold, illicit revenue mixed into the takings of a cash-intensive business, or cash spent on goods that can be resold. It is the riskiest stage for the launderer, because it is the first time the money touches a regulated institution and the first opportunity a control has to see it. Layering is the stage that separates the funds from their origin through transactions whose only purpose is to obscure the trail: Wires between jurisdictions, transfers through shell company accounts, conversion between currencies and asset classes, and loops that bring funds back to where they started. Integration returns the money to the launderer in a form that looks like legitimate wealth, such as a property purchase, an investment in a business, a loan secured on laundered collateral, or fees paid to a company the launderer controls. The three-stage model is a way of organizing detection rather than a description of how every scheme runs. Some schemes compress all three stages into one transaction; a fraud network that already holds digital proceeds may skip placement entirely; a trade-based scheme may integrate value without ever layering it through a bank. The model is useful because each stage leaves a different kind of trace, and a control built for one stage is often blind to the others. Placement produces a suspicious transaction, integration produces a suspicious asset, and layering produces neither, which is why it is the hardest to detect. The guide to the three stages of money laundering explains each stage with examples and the controls that apply to it.

Structuring is the deliberate splitting of a transaction so that each part stays below a reporting threshold. In the United States the threshold is the $10,000 currency transaction report, but most jurisdictions have an equivalent, and structuring is a criminal offense in its own right whether or not the funds are illicit. A single customer making a series of $9,000 cash deposits over several days is the classic pattern. Smurfing takes the same activity and spreads it across many people, accounts, or branches, so that no single account shows the pattern. The name comes from the runners, or smurfs, who each deposit a small amount. The distinction matters for detection because the signals are different: Structuring appears as a pattern within one account or one customer over time, while smurfing appears as many apparently unrelated depositors funding the same beneficiary, which only becomes visible when accounts are linked by the destination of the funds, shared addresses, devices, or timing. A third variant, cuckoo smurfing, is the one that catches compliance teams unprepared. A launderer with illicit cash intercepts a legitimate international remittance, deposits the cash into the intended recipient's account, and keeps the clean funds that were supposed to be transferred. The recipient has done nothing wrong and has no idea the deposit came from a criminal source, so customer-level red flags do not fire. Detection depends on noticing that a deposit was made in cash by someone other than the account holder and that it matches an expected inbound transfer that never arrived through normal channels. The guide to smurfing versus structuring covers the patterns and the rules that catch each, and cuckoo smurfing covers the remittance variant.

Trade-based money laundering, or TBML, moves value by misrepresenting a commercial transaction rather than by transferring money directly. The mechanics are simple. Over-invoicing charges more than the goods are worth and transfers value from the importer to the exporter; under-invoicing does the reverse. Multiple invoicing bills the same shipment more than once, often through different banks. Phantom shipments invoice goods that were never shipped at all, and misdescription of goods or quantity inflates or deflates the value on paper. Each of these produces a payment that looks like ordinary trade settlement to the bank processing it. TBML is hard to detect because banks see documents rather than cargo. A bill of lading, a packing list, and a commercial invoice are commercial instruments that no one in the payment chain verifies against the physical shipment, valuations are legitimately subjective for many goods, and a single transaction can involve parties in several jurisdictions with no institution seeing the whole picture. Goods with wide valuation ranges, such as scrap metal, used machinery, gemstones, and art, are favored because there is no reference price to test against. Practical defenses include benchmarking invoice values against market price data, cross-checking shipping documents against customs and vessel-tracking records, flagging counterparties and goods types with known TBML exposure, and looking for trade flows that make no commercial sense, such as goods routed through countries that have no market for them. FATF treats TBML as one of the largest and least detected laundering channels, and its guidance stresses that no single institution can see enough of a trade transaction to judge it alone, which is why customs data, shipping data, and bank data have to be combined. The guide to trade-based money laundering sets out the invoicing schemes, the red flags, and the documentary checks in detail.

The techniques are digital versions of layering. Mixers and tumblers pool funds from many users and pay them out to new addresses, breaking the on-chain link between deposit and withdrawal. Chain-hopping converts assets from one blockchain to another, often several times, so that tracing has to cross networks with different tooling. Cross-chain bridges do the same job across networks with uneven compliance coverage. Privacy coins, peer-to-peer trades, and unhosted wallets keep funds away from regulated intermediaries that would apply identity checks. The cash-out step, where crypto becomes fiat, usually runs through exchanges, over-the-counter brokers, or payment services in jurisdictions with weak controls, and increasingly through accounts opened with synthetic identities or deepfake-assisted verification. The scale is large. Chainalysis estimated that illicit addresses received at least $154 billion in 2025, a 162 percent increase driven mainly by sanctioned entities, with stablecoins carrying 84 percent of illicit volume, even though illicit activity remained below 1 percent of attributed on-chain transactions. Two features cut the other way. Blockchain records are permanent and public, so tracing can follow funds across years and jurisdictions in a way that cash investigations cannot, and stablecoin issuers can freeze balances on request, which has produced recoveries that conventional laundering cases rarely achieve. FATF's March 2026 report identified peer-to-peer stablecoin transfers outside regulated intermediaries as the central vulnerability, and its July 2026 update flagged an emerging risk of stablecoins designed to resist freezing, alongside the use of deepfakes and synthetic identities at the point where funds are cashed out. For a compliance team the practical consequence is that crypto monitoring has to join on-chain tracing to off-chain account behavior, since neither view is sufficient on its own. The guide to money laundering through cryptocurrency covers the typologies, the analytics, and the Travel Rule obligations in depth.

Layering is detected by looking at sequences rather than transactions. Each step in a layering chain is designed to look ordinary: A transfer between two accounts in good standing, in a normal amount, with a plausible reference. Rules that examine transactions one at a time will not fire, so detection has to connect them. The signals that survive are structural. Rapid movement, where funds arrive and leave within hours and the account never holds a resting balance. Round-tripping, where money leaves and returns to the same beneficial owner through a chain of intermediaries. Pass-through accounts with high throughput, near-zero balance, and none of the payroll, rent, or supplier payments a real business generates. Fan-in and fan-out patterns, where many sources consolidate into one account or one account disperses to many, with no commercial logic connecting the parties. Repeated conversion between currencies or asset classes with no hedging or trading rationale. Three things make layering harder than other stages. It crosses institutions, so no single bank sees the whole chain and each sees only a fragment that looks benign. It crosses jurisdictions, where information sharing is slow or legally blocked. It crosses asset classes, moving from wire to trade to crypto and back, while most monitoring systems are built for one of them. Graph and network analytics have moved into production monitoring because they treat accounts and transfers as a connected structure and reveal the shape of a chain that no single rule can see. Behavioral analytics add a second reference point by flagging deviation from a customer's own baseline. The guide to layering detection patterns sets out the sequence-based signals and how to encode them, and the knowledge base entry on layering in money laundering covers the stage itself.

Hawala is an informal value transfer system in which a customer pays a broker in one country and a corresponding broker in another country pays the recipient, with the two brokers settling their balance later through trade, cash, or offsetting transfers. No money crosses the border at the time of the transaction, and often no transaction touches a regulated institution at all. The system predates modern banking, is used legitimately by millions of migrant workers to send remittances cheaply and quickly, and is licensed and supervised in some jurisdictions. Its usefulness for laundering comes from the same features that make it useful for remittances: Speed, low cost, trust-based operation, and minimal paper trail. From a monitoring perspective the problem is that there is nothing to monitor. A hawala transfer appears, if at all, as a cash deposit or a trade payment unrelated to the underlying transfer, and the settlement between brokers can be netted across hundreds of unrelated clients so that no individual flow is visible. FATF's September 2026 report on underground banking found that more than 80 percent of reporting jurisdictions identify hawala and similar providers among the principal channels for professional money laundering, and described the emergence of money laundering as a service, where specialist networks move value for many unrelated criminal clients at competitive rates. The same report documented digital variants that use messaging apps, stablecoins, and fintech accounts for settlement. Detection therefore depends on recognizing the broker rather than the transfer: Accounts with high cash and trade throughput inconsistent with the stated business, settlement patterns with counterparties in remittance corridors, and links to known informal operators. The guide to hawala and informal value transfer covers how the system works, where it is licensed, and the indicators that identify an unregistered operator.

Red flags are the observable traces that typologies leave, and they group by stage. At placement: Cash deposits clustering just below a reporting threshold, deposits across multiple branches or by multiple people into one account, cash volumes inconsistent with the stated business, and reluctance to provide identification or explain the source of funds. At layering: Funds arriving and leaving within hours, transfers to and from jurisdictions with no connection to the customer, accounts with high throughput and no operating expenses, round-tripping through intermediaries, rapid conversion between currencies or assets, and counterparties that resolve to shell companies or nominees. At integration: Asset purchases inconsistent with declared income, loans secured on opaque offshore holdings, consulting or management fees paid to related companies with no visible services, and real estate bought through layered corporate structures. Customer-level flags cut across stages: Unusual interest in reporting thresholds, unexplained changes in transaction pattern, use of third parties to conduct transactions, inconsistencies between documents, and a business whose revenue makes no sense for its size, location, or sector. No single flag is conclusive. Most describe behavior that has an innocent explanation in isolation, and a program that escalates every one produces the alert backlogs that appear in enforcement actions as often as missed typologies do. The value is in combination and context: Several flags together, on a customer whose profile does not explain them, in a pattern that matches a known typology. That is why red flags are encoded as monitoring rules segmented by customer type, and why the rules are tuned rather than applied globally. The reference list of money laundering red flags and indicators organizes the flags by stage and sector, and the guide on how to detect money laundering explains how they are turned into detection logic.

A shell company is a legal entity with no meaningful operations, employees, or physical assets. It exists on paper, and many exist for legitimate reasons: Holding structures, special purpose vehicles, joint ventures, and investment vehicles all use them. Their value for laundering comes from exactly that ordinariness. A shell provides a bank account, a registered address, a name that can appear on an invoice, and a layer between the money and the person behind it, and nothing in its filings distinguishes a tax-planning structure from a laundering vehicle. Shells appear in nearly every large layering scheme on record. Funds move from one shell to another across jurisdictions, each transfer justified by an invoice or a loan agreement between entities that are ultimately controlled by the same person, until the trail is long enough that no single institution can reconstruct it. Nominee directors and shareholders, trust and company service providers, and jurisdictions with weak beneficial ownership disclosure make the structure cheap to build and hard to unwind. The Danske Bank case is the reference example: Roughly €200 billion in non-resident flows through the Estonian branch, much of it routed through shells registered in the United Kingdom, Cyprus, and New Zealand, each transfer individually unremarkable. Detection focuses on the account rather than the entity. A shell used for layering shows high throughput with a near-zero resting balance, no payroll, no rent, no supplier payments, counterparties that are themselves shells, and activity that starts shortly after incorporation. Ownership resolution at onboarding, which identifies the natural persons behind the entity, is the other half of the control, because a shell whose beneficial owner is known is far less useful to a launderer. The guide to shell companies and money laundering covers the structures, the red flags, and the onboarding checks that expose them.

Both sit outside the classic three-stage model, which is why controls built around placement, layering, and integration tend to miss them. Reverse money laundering is the movement of clean money toward a criminal purpose. Instead of disguising the origin of illicit funds, it disguises the destination of legitimate ones: Salary, business revenue, or donations that are moved through layers so that their eventual use, typically terrorist financing, bribery, or the purchase of illicit goods, cannot be traced back to the source. The funds are lawful at the point of placement, so source-of-funds checks pass, and the suspicious element is the destination and the pattern of concealment rather than the money itself. Transaction laundering is the processing of sales from an illicit or undisclosed business through the merchant account of a legitimate one. A front merchant, often an ordinary online retailer, submits card transactions on behalf of a hidden merchant selling drugs, counterfeit goods, unlicensed gambling, or other prohibited products, and the acquiring bank sees only the legitimate merchant's category code. The illicit business gets access to the card networks it could never obtain directly, and the proceeds arrive as ordinary settlement. Detection for transaction laundering depends on merchant monitoring rather than customer monitoring: Transaction volumes and average ticket sizes inconsistent with the merchant's stated business, traffic arriving from websites unrelated to the merchant, chargeback and refund patterns that do not match the product, and mismatches between the merchant's declared inventory and its sales. Acquirers and payment facilitators carry the primary exposure, and card network rules impose direct penalties for undetected transaction laundering. The guide to reverse money laundering and transaction laundering covers both variants, the sectors most exposed, and the monitoring approaches that catch them.

Every regulated sector is exposed, but the typologies differ, and the same signal can mean different things in different industries. Banking carries the widest surface because it runs every payment rail, holds the accounts that shells and mules depend on, and processes the trade finance that TBML flows through. Money services businesses and payment firms see placement and cross-border layering, with high volumes of small transfers that make smurfing and remittance-based schemes hard to isolate. Cryptocurrency exchanges and service providers face chain-hopping, mixer exposure, and the fiat off-ramp where digital proceeds become spendable. Real estate is the classic integration channel: Property bought through layered corporate structures, often with cash or with loans secured on opaque collateral, converts illicit funds into an asset that appreciates and can be resold cleanly. Gaming and casinos absorb cash through chip purchases and cash-outs with minimal play, and online gaming adds the transaction laundering dimension. Trade and import-export businesses are the vehicle for TBML, with commodities that have wide valuation ranges attracting the most abuse. Luxury goods, art, and precious metals offer high-value portable assets with subjective pricing. Professional services, including lawyers, accountants, and trust and company service providers, form and administer the structures that other typologies depend on, which is why FATF treats them as gatekeepers. Cash-intensive businesses such as restaurants, car washes, and vending operations blend illicit takings into legitimate revenue at the placement stage. A monitoring rule tuned for retail banking will produce noise in a casino and miss activity in a trade finance book, so typologies need to be read through the lens of the sector. The guide to money laundering typologies by industry maps the methods to each sector, and emerging money laundering typologies tracks the methods appearing in recent enforcement.