Layering Indicator

A layering indicator is a red flag suggesting that money is being passed through a series of transactions, accounts, products or countries in order to separate it from its criminal source and make it hard to trace. Typical examples are funds that arrive and leave an account almost at once, round-trip transfers between related companies, and repeated conversions between currencies or crypto assets with no clear business reason.

The term refers to layering, the middle of the three classic money laundering stages: placement (getting illicit cash into the financial system), layering (moving it to obscure the trail) and integration (bringing it back as apparently clean wealth). Indicators for the layering stage are widely used in transaction monitoring, investigator training and guidance from financial intelligence units. A single indicator rarely proves anything; investigators look for several together.

Imagine someone trying to shake off a person following their car. They do not drive straight home. They take a long route, switch cars in a car park, go round a roundabout twice and cross a border. Each move on its own might be innocent, but together they show someone who does not want to be followed.

Layering is that kind of driving, done with money. Criminal funds are moved from account to account, company to company, country to country, and sometimes into and out of crypto, so that by the end it is hard to tell where they started. A layering indicator is any sign of this pattern: money moving in ways that make little sense except as a way of losing whoever is watching.

• Pass-through activity. Large credits followed quickly by debits of a similar total, leaving a low balance, often called rapid movement of funds.
• Funnel patterns. Many deposits from different places gathered into one account and then wired out, typical of a funnel account.
• Chains of accounts. Funds hopping through several accounts at different banks, often held by recruits in a money mule network.
• Corporate layering. Payments between a shell company and related firms with vague descriptions such as "consulting" or "services", or loans that are never repaid.
• Jurisdiction hopping. Wires routed through several countries, especially secrecy centres, flagged by a geographic risk indicator.
• Product switching. Repeated movement between cash, wires, prepaid cards, securities and insurance products, or early surrender of policies.
• Trade-based moves. Over- or under-invoiced shipments used to shift value, a form of trade-based money laundering.
• Crypto obfuscation. Use of a crypto mixer, chain hopping across blockchains, or many fresh wallets in short succession.

Indicators differ by sector. In correspondent banking, a respondent bank processing payments for its own customers through a nested account can add layers that the correspondent cannot see. In securities, buying and quickly selling assets with no interest in returns is a warning sign, and in gambling, depositing funds and cashing out with little play is a well-known pattern.

Layering is harder to spot than placement because by this stage the money is already in the financial system and looks like ordinary transfers. Firms use a mix of tools:

• Scenarios. A transaction monitoring scenario for in-and-out flows compares money out with money in over a short window, for example flagging an account where more than 90% of incoming funds leave within a few days.
• Network analysis. Graph tools link accounts by shared counterparties, devices or addresses to reveal chains that look harmless one account at a time.
• Profile comparison. Activity is compared with what the customer declared under customer due diligence; a retail customer acting as a transfer hub is a mismatch.
• Blockchain tools. Blockchain analytics trace crypto flows across wallets and services.

Where layering is suspected, the case is investigated and, if suspicion remains, reported through a suspicious activity report or the local equivalent. Because layering often spans many institutions, information sharing between firms and with financial intelligence units matters; in the US, section 314(b) of the USA PATRIOT Act allows registered institutions to share information with each other for this purpose.

Many layering indicators also fit legitimate activity. Treasury departments sweep cash between group accounts, payment firms pass client money through settlement accounts, and traders move funds quickly between venues. Indicators must therefore be read against the customer's business model. Professional money launderers also study common rules and design flows to stay just inside them, so firms are expected to update their indicators as typologies change. Layering is also the stage where the trail is longest, so an indicator found late may still lead investigators back to placement and the original crime.

• Financial Action Task Force (FATF)
• Financial Crimes Enforcement Network (FinCEN)