What is layering in money laundering?
Layering is typically regarded as the second stage of the three-stage money laundering process. In this stage, the money laundering criminals perform multiple complex financial transactions to obscure the origin and ownership of their illicit funds.
Through layering, criminals stack numerous transaction layers to distance dirty money from its source. This can make it much more difficult for law enforcement and financial institutions to trace the funds back to their criminal origins.
Layering is all about creating complexity. To cover their money trail and frustrate tracking efforts, criminals may use multiple financial instruments and geographic locations. Learn more about how the process works.
How layering works in practice
The layering stage in money laundering follows the initial placement of illegal funds into the financial system (the “placement” stage) and precedes the final stage, in which cleaned money re-enters the legitimate economy (the “integration” stage). During layering, criminals attempt to create complexity and confuse investigators through rapid movement of funds across multiple accounts, institutions, jurisdictions, and asset types.
Multiple account transfers are the foundation of most layering efforts. Criminals rapidly move funds between numerous bank accounts, often using accounts held in different names, institutions, or countries. Each transfer creates another layer in the transaction chain, making it progressively harder to connect the ultimate destination with the illegal source.
Currency conversions (e.g. dollars to euros) and asset conversions (e.g. dollars to gold) add additional complexity. Funds might be converted from cash to foreign currencies, then to cryptocurrencies, then to precious metals or real estate, before being converted back to cash. Each conversion creates documentation gaps and complicates tracing efforts.
Geographic diversification spreads transactions across multiple jurisdictions with different regulatory frameworks and information-sharing agreements. Criminals may (and often do) route funds through countries with strong banking secrecy laws or limited cooperation with international law enforcement.
Shell companies may be used to feign legitimacy whilst obscuring the true ownership of laundered funds. Criminals may create fake businesses with complex ownership structures that span multiple countries or jurisdictions. These businesses may conduct transactions that appear related to their underlying business but actually serve to cover up the transfer of illicit funds.
Time delays and batch processing help disguise layering activities by spacing transactions over extended periods or coordinating them with legitimate high-volume transaction periods when unusual activity is less likely to trigger alerts and other fraud prevention mechanisms.
Common layering techniques
Financial criminals may use a variety of sophisticated methods in their layering schemes. Here are a few examples:
Wire transfer chains involve rapid sequential transfers between multiple accounts across different institutions and countries. Each transfer creates legitimate documentation whilst moving funds a step further from their source.
Trade-based layering uses import/export transactions with manipulated invoicing to transfer value across borders. Criminals may over-invoice goods or create fictitious trade transactions to justify large international transfers.
Investment layering converts cash into stocks, bonds, real estate, precious metals, or artwork. These assets can then be sold in different markets.
Digital currency layering takes advantage of the anonymity offered by cryptocurrency to move funds through multiple wallets, exchanges, and blockchain networks — all of which can be accessed from anywhere across the globe.
How to spot a layering scheme
Layering presents significant challenges for financial institutions, due in no small part to criminals’ deliberate attempts to make it as complex as possible. But that doesn’t mean there aren’t red flags to look out for.
High transaction volume and high transaction velocity — whether they occur alone or in tandem — may raise suspicion of layering activities. If an account has high transaction volumes inconsistent with its stated business purposes, that’s unusual and likely cause for investigation. Other red flags include rapid sequential transfers between related accounts or sudden increases in transaction activity following periods of dormancy.
Geographic inconsistencies may also raise suspicion, especially when transaction patterns don't align with customer profiles. Red flags in this area include transfers to countries with no apparent business connection, routing funds through high-risk jurisdictions, and patterns that deliberately avoid direct transfers between specific countries.
Suspicious patterns may also include:
Unnecessarily complex routing between accounts
Transactions that serve no apparent business purpose
Transactions designed to stay just below reporting thresholds (which may involve a technique known as smurfing)
Frequent exchanges between different asset types without a clear business purpose
Technology for detecting layering schemes
Modern anti-money laundering (AML) systems employ sophisticated technologies to identify layering patterns across large transaction datasets.
Transaction monitoring systems analyse real-time transaction flows to identify suspicious patterns that may indicate layering. These systems can track fund movements across multiple accounts and institutions, flagging complex routing patterns or unusual transaction sequences.
Network analysis maps relationships between accounts, entities, and transactions to identify hidden connections that criminals attempt to obscure through layering. This technology can reveal patterns invisible to traditional transaction monitoring that examines transactions in isolation.
Machine learning algorithms continuously improve detection capabilities by learning from historical layering schemes and adapting to new techniques. These systems can identify subtle patterns that human analysts might miss whilst reducing false positive rates.
Cross-border information sharing enables institutions to track layering activities that span multiple jurisdictions. Regulatory frameworks increasingly support real-time information sharing between financial intelligence units and institutions in different countries.
Prevention and compliance strategies
Financial institutions must implement multi-step processes to help detect layering activities whilst maintaining efficient operations and regulatory compliance.
Enhanced Due Diligence (EDD) can help identify higher-risk customers based on their business activities, geographic connections, or whether they are politically exposed persons (PEPs). Risk-based approaches allow appropriate scrutiny without burdening low-risk customers.
Automated alerts provide real-time notifications when transactions meet criteria indicating potential layering.
Regular employee training helps teams recognise layering indicators and understand reporting obligations.
Periodic reviews enable identification of layering patterns developing over extended periods that might not trigger real-time alerts, revealing suspicious patterns in historical data.
Effective layering detection typically requires sophisticated technology combined with expert human analysis. This hybrid approach has shown to be the best way to identify complex patterns that criminals use to obscure illicit fund movements through the global financial system.
Layering in money laundering FAQs
How does layering differ from other money laundering stages?
Layering is the middle stage between placement (introducing dirty money into the financial system) and integration (making the laundered money appear legitimate). While placement focuses on getting funds into the system and integration focuses on making them appear clean, layering focuses on creating complexity to fool and frustrate auditors.
What makes layering so hard to detect?
Layering exploits the complexity of modern financial systems by creating transaction patterns that may appear normal when viewed in isolation. Detection requires analysing multiple related transactions across time and institutions to identify the overall pattern.
How quickly can layering occur?
Layering can happen extremely quickly, with funds moving through multiple accounts and jurisdictions within days or even hours. But this isn’t always the case. Some layering schemes exploit longer timeframes to avoid detection, spreading transactions over months or years to appear more natural.
