Money Laundering Typologies: Placement, Layering, Integration

[Blacksec]

The three-stage laundering framework — placement into the financial system, layering through transactions, integration as apparently legitimate funds — still describes every scheme regulators write advisories about. Each stage's mechanics, real-world typologies, and where investigators look first: full breakdown hidden below.

Spoiler: Laundering typologies — click to expand

THE FRAMEWORK (KID VERSION)

Dirty value exists OUTSIDE banking (cash, stolen balances, fraud proceeds). PLACEMENT puts it IN. LAYERING distances it from the crime through transactions. INTEGRATION makes it spendable as clean money. Modern practice blurs stages — digital proceeds often skip placement (already in accounts) and live entirely in layering; FATF advisories, FinCEN guidance, and bank typology papers all structure risk this way because STRUCTURE is what monitoring detects.

PLACEMENT MECHANICS

• Cash-intensive businesses: restaurants, laundromats, parking, vending — reported revenue inflated to absorb cash (structuring below reporting thresholds, e.g. CTR $10k US-class rules).
• Monetary instrument purchases: cashier's checks, money orders in sub-threshold increments — classic smurfing pattern.
• Gambling: chips bought with dirty cash, played minimally, redeemed as "winnings" — casino reporting thresholds are the variable.
• Digital skip: stolen card funds/carded goods already in payment systems — placement happens at fraud stage; laundering starts at conversion (crypto buys, gift card liquidation).
• Funnel accounts: cash collected in one jurisdiction, deposited into structured accounts, wired out as "business receipts."

LAYERING TYPOLOGIES

Typology	Mechanic	Detection tell
Structuring	sub-threshold deposits/withdrawals timed to dodge reporting	repeat cadence near thresholds, multiple branches/accounts
Shell chains	invoices between invented entities moving value on paper	no employees/premises, circular flows, same-signatory clusters
Hawala/hundi	value moved by trust networks, settlement netted off-ledger	no wire trail; trade-value imbalances, remittance mismatches
Trade misinvoicing	over/under-invoice imports-exports to move value cross-border	price deviates from market index, round-trip commodity flows
Crypto hopping	chain hops, mixers, privacy coins, cross-chain bridges	velocity to high-risk services, peel-chain patterns
Mule fans	one source fans across many accounts, reconverges later	fan-out/fan-out graphs, dormancy then burst, shared device/IP
Loan-back	criminal "lends" clean money to self through legitimate-seeming loan	loan terms abnormal, repayments funded by same source
Investment fronts	fake trades/returns explain inflows (Ponzi-shaped)	returns uncorrelated with markets, redemptions from new money

INTEGRATION MECHANICS

• Salary/dividends from planted entities: real-looking payslips into real-looking accounts — employment tax filings make it denser.
• Real estate purchases: layering through title chains, rent from shells — property registries now require beneficial-ownership disclosure in many regimes.
• Luxury goods resale: art, vehicles, watches — valuation opacity is the feature.
• Credit/investment accounts: "clean" funds get mortgages and portfolio returns on dirty principal — integration achieved when debt serviced by layered money.
• Business acquisition: buying an existing cash-generating company with laundered proceeds — historical financials provide cover story.

WHERE INVESTIGATORS LOOK

1. thresholds: repeated activity just under reporting limits (structuring algorithms)
2. graphs: shared devices/phones/signatories across supposedly unrelated parties
3. behavior: revenue vs declared industry norms (restaurant with 400% of peer revenue)
4. narratives: source-of-funds stories that don't match transaction history
5. cross-institution: consortium databases connect what one bank can't see
6. timing: placement/layering/integration legs often compress under pressure (seizure risk, cohort arrests)

THE PRESSURE PATTERN

• Speed is the tell: schemes rushed by legal pressure compress timelines that should take months — compression creates detectable velocity.
• Cohort exposure: mules get caught first; graph traversal reaches operators — one weak node maps the network.
• Documentation asymmetry: prosecutors need clean narrative chains; operational security that fragments narrative is the counter-layer.
• Seizure path: parallel construction from tax/reporting violations lets investigators seize without proving the predicate crime first — asset traceability decides outcomes.

WORKING SEQUENCE

stage map: know which stage each leg occupies (conversion = layering, spend = integration)
  -> narratives: every layer carries consistent business story + documentation
  -> pacing: no threshold-cluster deposits, no same-week passthroughs
  -> graphs: counterparties with independent history, no shared fingerprints
  -> integration: assets acquired through plausible income structures, tax filings aligned
  -> review: read own flows as an investigator quarterly (typology checklist above)

Placement placed, layering narrated, integration documented — schemes die on structure, not intent. Thresholds never clustered, graphs never converged, stories never contradicted; the typology checklist read against your own flows before an examiner reads it first.

— RELATED GUIDES —

• Money Laundering 101: The Clean Cycle
• How Platforms Detect Cashout: Fraud Signals 101
• Cashout OpSec: Discipline After the Exit
• Wire Transfer Method: Moving Money Fast
• Chain Analysis 101: How Crypto Gets Traced

Stage-mapped, story-consistent, pace honest — the three-part framework still predicts how every advisory reads flows. Thresholds scattered, graphs independent, documentation matching movement; a scheme's structure is its confession, so build one that confesses nothing.