AML Compliance
Fundamentals Handbook

Why does AML exist? Criminals need their money to look legal before they can spend it, invest it, or move it freely, and the financial system is where that usually happens. Many newcomers think an AML professional's job is to prove a crime happened. It is not. The job is to notice when activity does not match what is expected from a customer, and to keep clear records that still make sense when a senior person reads them later. Everything else in this handbook (KYC, monitoring, SARs) supports that one job: turning a suspicion into a written decision that can be explained and defended.

Most institutions split the work into three lines of defense, so no team checks its own work:

Every laundering scheme, simple or complex, has three stages. Put simply: get the money into the system, move it far from its source, then bring it back so it looks legal.

Placement is the moment dirty money first enters the financial system. Before placement, it is just cash or an asset that no bank can see. This is the criminal's problem: large amounts of cash cannot be wired, invested, or spent without people asking questions. Common example: someone deposits cash from drug sales in small amounts and pretends it is the daily income of a cash-heavy business they own, like a car wash or a restaurant.

Layering comes next: moving that money through a chain of transactions designed to hide where it really came from. Each transfer makes the source harder to trace. Common example: the deposited cash is wired to an account in another country, split across several shell companies (companies that exist only on paper), then changed into a different currency. Each step makes the paper trail longer and messier.

Integration is the last stage: the money, now far from its source, comes back into the legal economy as what looks like normal income or assets. Common example: the layered funds buy an apartment, a piece of art, or shares in a business. On paper, it looks like a normal purchase that is easy to explain.

Training teaches this as three steps that happen in order. Real cases often do not follow that order. Money can be placed and layered in the same transaction. Integration can start before layering is done. Use the model to ask which stage you are looking at right now, not as a checklist to follow in order.

Every country builds its AML rules on the same FATF standards, but each one adds its own laws, regulators, and reporting requirements. Plenty of AML professionals, especially at outsourced compliance and managed-service firms, work on cases from several countries in a single shift. They must switch between rule sets without mixing up what each regulator expects. Below is the current picture, as of 2026.

Regulators worth knowing

First, two terms to understand. A regulator is the government body with legal power to supervise financial institutions, set the rules, and penalize anyone who breaks them. An FIU (Financial Intelligence Unit) is the government body that receives the reports institutions file (SARs, STRs, CTRs), analyzes them, and passes useful leads to law enforcement. Some countries put both jobs in one agency; others split them. Here are the ones you will see most often on international cases.

How the rules got here, and where they're headed

Three regions, each shaped by different pressures, are moving toward the same goal: rules that are risk-based, in proportion to the risk, and harder to get around.

The FATF (Financial Action Task Force) is a group of governments, founded by the G7 in 1989. It writes the global standards that almost every country's AML law is based on. FATF does not enforce rules directly. It sets the 40 Recommendations that national regulators build their laws around. It then runs mutual evaluations, which are reviews that publicly grade how well each country actually applies them.

The most important of those 40 is Recommendation 1. It requires countries and institutions to identify, assess, and understand their own money laundering and terrorist financing risks, then use their resources in proportion: more checks where risk is higher, fewer checks where it is lower. That's the risk-based approach (RBA), and it is the main idea behind almost everything else in this field. For example: a retail customer with a salaried job and regular spending gets standard CDD and no extra checks. A shell company registered in a high-risk country, with no clear business purpose and unclear ownership, gets EDD, senior approval, and ongoing enhanced monitoring. Same bank, same onboarding team, very different levels of checks. Why? Because the same checks for everyone waste effort on low-risk customers and do not protect enough against high-risk ones.

FATF doesn't work alone. The Egmont Group connects FIUs so they can share information across borders. The Wolfsberg Group, a coalition of major global banks, publishes practical guidance that often affects bank policy sooner than formal rules do. The Basel Committee and IOSCO publish guidance for banking supervisors and securities regulators. None of them make law on their own. Still, a strong AML professional knows their names, because much of what the industry calls "best practice" comes from their guidance.

The Bank Secrecy Act (BSA), passed in 1970, is the starting point of AML law in the US. It requires banks and other financial institutions keep certain records and file certain reports, so the government has records to follow when money moves in ways that suggest crime. Almost everything else in this module is part of what the BSA requires in practice:

CTR (Currency Transaction Report): filed automatically when a customer's cash transactions in the same direction total more than $10,000 in a single business day. Same direction means all deposits, or all withdrawals, never a mix of the two. A $5,000 cash deposit and a $6,000 cash withdrawal on the same day don't trigger a CTR. Two $6,000 cash deposits on the same day do, and so do two $6,000 cash withdrawals. No suspicion is needed. The rule applies automatically every time.

SAR (Suspicious Activity Report): filed when an institution suspects activity may involve a crime and can't find a reasonable explanation for it. Unlike a CTR, a SAR takes judgment: a person has to decide that the activity does not make sense. Filing becomes mandatory at these US thresholds, and institutions can always file voluntarily below them:

CIP (Customer Identification Program): the steps a bank takes to actually verify who a customer is before opening an account, like checking a government ID against the name on file.

The USA PATRIOT Act, signed weeks after September 11, 2001, is one of the biggest expansions in the BSA's history. It did not replace the BSA. It added counter-terrorism duties to it: CIP became a formal legal requirement for the first time (Section 326), banks and the government got a dedicated legal channel for sharing information (Section 314, explained in the next paragraph), Section 312 required enhanced due diligence on foreign correspondent and private banking accounts, and Section 313 fully banned correspondent accounts for foreign shell banks (banks with no physical office anywhere). Much of what is now standard KYC traces back to this Act.

314(a) and 314(b): two information-sharing channels created by the PATRIOT Act. 314(a) lets law enforcement ask banks whether they hold any accounts tied to a name under investigation. 314(b) lets banks voluntarily share information with each other about a customer they both suspect, without that sharing counting as a privacy violation.

FinCEN, the US Treasury bureau that administers the BSA, oversees all of it. It issues guidance and updates what examiners expect each year. So read its advisories directly, and do not rely on training slides that may be a year or two old.

FinCEN writes the rules, but it doesn't examine most institutions itself. That job belongs to each institution's primary regulator: the OCC for national banks, the Federal Reserve for state member banks, the FDIC for state non-member banks, the NCUA for credit unions, the SEC and FINRA for broker-dealers, and the IRS for money services businesses and casinos. That is why one enforcement case often comes from several agencies at once, as it did with TD Bank in 2024.

BSA failures are not only a company problem. Individuals can be punished too. In 2017, MoneyGram's former chief compliance officer, Thomas Haider, agreed to pay $250,000 and accept a three-year industry ban to settle FinCEN's case against him for failing to stop fraud flowing through MoneyGram agents. In 2024, Binance founder Changpeng Zhao was sentenced to four months in prison after pleading guilty to failing to maintain an effective AML program. If you are aiming for a senior compliance role, remember this: you can be held personally responsible for the program you approve. The UK takes the same view: under the Senior Managers and Certification Regime, the MLRO holds a named senior management function (SMF17) and can be held personally accountable by the FCA for failures in their area.

One difference explains this whole module. A directive sets a goal that each EU country then writes into its own national law, in its own words, on its own timeline. This is why the same EU rule can be enforced differently in Germany and in Portugal. A regulation becomes law automatically in every member state on the same day. No national rewriting required.

The EU's AML rules began as a series of AMLDs (Anti-Money Laundering Directives). AMLD5 brought crypto exchanges into scope; AMLD6 made the definition of predicate crimes (the crimes that produce the dirty money) the same across the EU. Because these were directives, enforcement still varied country to country. That is now changing. The AMLR (Anti-Money Laundering Regulation) is a regulation, not a directive: one directly applicable rulebook across all 27 member states, no national rewrite needed. Alongside it sits AMLA, the EU's new central AML authority, which started operating in 2025 and takes on direct supervision of the riskiest cross-border firms from 2028. This ends the mix of national rules that let companies choose the country with the weakest enforcement.

So what changes in daily work when AMLR applies in July 2027? Here are a few examples. Cash payments above €10,000 for goods or services become prohibited across the EU, and member states can set a lower cap. The beneficial ownership threshold stays at 25%, but the rules for finding owners behind complex ownership chains become much more detailed and strict. Crypto-asset service providers follow the same rulebook as banks. And because it's a regulation, a compliance team operating across Germany, Ireland, and the Netherlands works to one text instead of three national versions.

An AML program is the actual set of policies, people, and processes an institution runs every day to detect and prevent money laundering: onboarding checks, alert queues, even the training new hires sit through. In the US, every program stands on five specific pillars, and examiners check all five, not just whether the institution is "doing AML" in general:

Internal controls: the policies, procedures, and systems (like transaction monitoring rules) that manage the institution's risk. Independent testing: a separate team, not the one that built the controls, checking whether those controls genuinely work. A designated BSA/AML compliance officer: one named person accountable for the program. Training: making sure staff actually know how to spot and escalate what the controls are built to catch. And customer due diligence, added as the fifth pillar by FinCEN's 2016 CDD Rule, covering beneficial ownership and ongoing monitoring of customer relationships.

Underneath all five sits the risk assessment: a documented analysis of where the institution's money laundering risk actually lives, by product, customer type, and geography. It isn't one of the five named pillars, but every pillar is set up based on it, and examiners will ask to see it first.

If one pillar is missing, the whole program gets flagged in an exam. A bank can have strong monitoring rules and still fail if no one independently tests whether those rules work in real life.

A Financial Intelligence Unit (FIU) is the government body sitting between banks and law enforcement. It receives the SARs, STRs, and CTRs institutions file, analyzes them for patterns, and passes anything actionable to police or prosecutors. FinCEN in the US and FIU-IND in India are both FIUs. Each is the national body that receives the reports this handbook describes.

An FIU can only work with the reports it receives. Many vague SARs full of generic, copy-paste text (boilerplate) do not help an investigator, even if each one technically meets the filing rules. FIUs also run public-private information sharing and cooperate across borders through networks like the Egmont Group. This is how a pattern found in one country can be linked to a case in another.

Each major jurisdiction handles reporting a little differently, and these differences matter in daily work. In the US, a SAR goes to FinCEN through the BSA E-Filing System. In the UK, it goes to the UK Financial Intelligence Unit inside the NCA, and the UK adds something most regimes don't have: the Defence Against Money Laundering (DAML) request. If a UK firm suspects funds are criminal property but needs to process a transaction, it can ask the NCA for consent first. The NCA has seven working days to respond, and silence counts as consent. In India, reporting entities file STRs to FIU-IND through its FINnet portal.

Plenty of FIUs don't build their own systems at all. They use goAML, reporting software developed by the UN Office on Drugs and Crime and adopted by dozens of FIUs, including the UAE's. That's why the same structured report format appears in very different jurisdictions.

A sanction is a government-imposed restriction on dealing with a specific person, company, or country. A simple example is an asset freeze on a named individual. Any institution holding their funds must freeze the account and cannot process any transactions for them.

Sanctions and AML are related, but they are not the same job. A sanctions hit isn't about whether something looks suspicious. It's about whether it's specifically prohibited. If you mix these up, you either miss a true match or create too many false positives (alerts that are not real matches) for the screening team. Ownership and control rules, like OFAC's 50 percent rule, matter more than new AML professionals often expect: a company might not appear on any list, but if one or more sanctioned persons own 50% or more of it, individually or in aggregate, it's treated as sanctioned too. Say a sanctioned individual owns 60% of Company X. Company X was never named on any list, but under the 50% rule it's blocked property anyway. If you screen only the company's name and never check who owns it, you miss the match completely.

Screening splits into two related jobs. Name screening checks who's involved (a customer, a counterparty, a beneficial owner) against sanctions lists and watchlists. Payment screening checks the transaction message itself, often a SWIFT message, for any sanctioned party appearing anywhere in the payment chain. They catch different things. A customer can pass name screening at onboarding and still trigger a payment screening hit years later, because a sanctioned party appears in one field of a wire. There is also transliteration, which means writing a name in a different alphabet. A name in Arabic, Cyrillic, or Chinese script can be spelled in English letters in several ways, and screening logic has to allow for that or it will not catch the match.

The lists themselves (save these links): OFAC's SDN search (US), the UK OFSI consolidated list, the EU consolidated list, and the UN Security Council consolidated list. Many institutions do not screen against them by hand. Instead, they pay for combined screening data from providers like Dow Jones Risk & Compliance or LSEG World-Check, which combine sanctions, PEP, and adverse media data in one feed.

What is KYC?

KYC (Know Your Customer) is the general term for everything an institution does to understand who it's dealing with, before the relationship starts and for as long as it lasts. It isn't one check. It is three layers built on top of each other, and the depth of each one grows with risk. Regulators don't expect every customer to get identical treatment. They expect the effort to match the risk, and the reasoning to be written down.

CIP: Customer Identification Program

CIP verifies identity and answers one question: is this person who they say they are? In the US, the CIP rule requires a bank to collect at least four data points before opening an account: name, date of birth, residential address, and an identification number (a Social Security number for US persons, or a passport or other government ID number for non-US persons). The bank then verifies those details, either documentary (checking a passport or driving licence) or non-documentary (matching against credit bureau or public records data), and checks the customer against government lists. Other countries describe it differently, but every country's rules have a similar first step.

CDD: Customer Due Diligence

CDD goes further and builds the customer profile that everything else depends on: why this customer wants the relationship, what activity is realistically expected, and where their money comes from. That picture becomes a risk rating (typically low, medium, or high) and an expected-activity baseline that transaction monitoring later measures against. For legal entities, CDD also means identifying the beneficial owners, the real people who own or control the business. And it is not a one-time task: the profile is kept up to date as the relationship changes.

EDD: Enhanced Due Diligence

EDD is a deeper, more detailed version of CDD, applied when specific risk factors call for it. Common triggers: politically exposed persons (PEPs), customers linked to high-risk jurisdictions, correspondent banking relationships, complex or opaque ownership structures, and cash-intensive businesses. Typical EDD steps: verifying source of wealth (SoW) as well as source of funds (SoF), senior management sign-off before onboarding, adverse media screening, more frequent reviews, and tighter ongoing monitoring.

How the three layers fit together

A simple comparison is renting out an apartment. CIP is checking the applicant's ID at the viewing. CDD is asking what they do for a living and how they'll cover rent each month. EDD is what happens when that applicant turns out to be a foreign official offering to pay a full year upfront, in cash. Now there is much more to verify before the landlord hands over the keys.

Concepts that trip people up

Source of funds (SoF) and source of wealth (SoW) confuse people often, even experienced AML professionals, because they sound alike but mean different things. Source of funds asks where this specific payment came from. Source of wealth asks how this person built their overall net worth. Take a retired surgeon wiring $80,000 to buy a boat. Source of wealth is easy: decades of surgical income, backed up by tax filings or employment history. Source of funds for that particular $80,000 might be something else entirely, like last month's sale of a rental property. If you check source of wealth ("retired surgeon, checks out") and stop there, without asking where this specific $80,000 came from, you've done only half the job.

A current change worth knowing: perpetual KYC. The old model refreshed a customer's file on a fixed calendar, every one, two, or three years depending on risk tier, no matter what happened in between. Perpetual (or continuous) KYC replaces the fixed schedule with triggers, meaning specific events. An unusually large transaction, a new PEP designation, a sanctions list hit, or a change in company ownership prompts an immediate review instead of waiting for the next scheduled refresh. More and more, regulators see fixed cycles as too slow, because customer risk can change quickly. Interviewers may expect you to know the term.

Two more concepts to learn early. Residual risk is the risk left over after controls are applied to inherent risk (the risk before any controls). A high-risk customer with strong, verified controls can carry lower residual risk than a medium-risk customer with weak documentation, which is why the starting rating alone does not give the full picture. And tipping off is a legal rule, not just good manners at work: once a SAR or investigation is underway, alerting the customer that they're under review, directly or indirectly, is itself an offence in most jurisdictions. Some new AML professionals learn this through a costly mistake, such as one harmless-sounding line in an email to a customer.

Many institutions now run identity checks through a dedicated eKYC provider rather than manual document review. Names worth recognizing: Onfido, Sumsub, and Trulioo.

A beneficial owner is the real, living person who ultimately owns or benefits from an account or company, even if their name never appears on the paperwork. Often a lawyer, a trust, or a chain of holding companies is listed on paper instead of them. Ownership tells you who benefits financially. Control tells you who actually makes the decisions. They're not always the same person. Layered structures (a trust owning a holding company that owns the operating company) usually exist for perfectly legitimate tax and estate reasons, but they're also a common way to hide who's really behind an account.

Where to actually look this up: UK Companies House is free and covers registered UK entities directly. In the EU, national registries connect through the Business Registers Interconnection System. For cross-border structures, OpenCorporates collects company filings from around the world, and the GLEIF LEI search shows which legal entities sit above or below each other through Legal Entity Identifier parent data. One limit for EU checks: since a 2022 EU court ruling, most national beneficial ownership registers are no longer fully public, and access usually requires showing a legitimate interest, which banks and other regulated firms usually have. The US has no public federal UBO registry. Ownership information collected under the Corporate Transparency Act sits with FinCEN, not in a searchable public database, so US entity ownership usually gets traced through individual state Secretary of State filings instead. Each state runs its own website, so finding the right one takes time. e-SecretaryOfState.com is a useful shortcut: a free directory linking out to every state's official Secretary of State business search page. Note: it is a privately run service (published by InCorp Services, a registered-agent and business-formation company), not a government source itself. It just points you to the right one.

A risk score tells you where to start looking closely. It is not a final decision. A common early-career mistake is treating a low-risk rating as permission to stop looking. Geography, product, channel, and transaction behavior all feed the score. If any one of them changes (say, a low-risk customer suddenly starts using a high-risk product), that should trigger a reassessment rather than waiting for the next scheduled review.

Risk models typically score four groups of factors. Know them well. Customer: individual or entity, occupation, PEP status, ownership complexity. Geography: residence, nationality, and where funds come from and go to, with FATF's grey and black lists as a baseline input. Product and service: a basic savings account carries very different risk from private banking or correspondent services. Delivery channel: face-to-face versus fully remote onboarding, or business introduced through a third party.

This is how they work together. A salaried resident opening a current account in person scores low on every factor. Change one input (the same customer starts receiving regular transfers from a grey-listed jurisdiction) and the geography score moves. Change two (a remotely onboarded business account with a nominee director) and the rating should reach the level that needs EDD. The exact math is not the point. It's that every factor is documented, so anyone reviewing the file can see exactly why the rating landed where it did.

A PEP (Politically Exposed Person) is someone who holds, or is closely connected to someone who holds, a prominent public position: a government minister, a judge, a senior military officer. Close family members and known close associates count too. They're flagged high-risk not because they've done anything wrong, but because their position gives them more opportunity to take bribes or misuse public funds than the average customer. Correspondent banking is when one bank holds an account for another bank, usually so the second bank's customers can access foreign currency or make international payments without the second bank opening its own branch abroad. An MSB (Money Services Business) is a company, like a money transmitter or currency exchange, that moves money for other people rather than for itself.

PEPs, correspondent banking, MSBs, cash-intensive businesses, and virtual-asset customers are all labeled high-risk for different reasons, and a one-size-fits-all EDD checklist misses what actually matters for each. A PEP's risk is about influence and corruption exposure. An MSB's risk is about being a pass-through: it doesn't just hold its customers' money, it moves it onward, so a single MSB account can carry thousands of other people's transactions. A cash-intensive business's risk is about how easily criminal cash can be mixed in with legitimate daily sales.

An LLC (Limited Liability Company) is a business structure that legally separates its owners' personal assets from the company's debts and liabilities. It's a real operating entity with its own name and bank account. A trust is a legal arrangement where one party (the trustee) holds and manages assets on behalf of someone else (the beneficiary), often used to plan how assets pass to family, or to protect assets for future generations. A shell company is a registered business with no real operations, employees, or physical presence. It exists on paper only.

Knowing these structures matters. It tells you what documents to expect and what a red flag really means. A trust with no clear beneficiary listed is normal for some estate-planning trusts and a serious concern for others. You can't tell which without knowing what the structure is for.

Every product carries its own kinds of risk. Wires move fast and cross borders easily. Cards generate large numbers of small transactions that are hard to review by eye. P2P (person-to-person) apps and payment wallets often have lighter KYC checks than traditional accounts. That is why they often show up in newer fraud and money mule typologies (known crime patterns).

Two changes are affecting product risk right now. The first is instant payments. India's UPI, the US FedNow service launched in 2023, and the UK's Faster Payments all settle in seconds and can't be recalled. This is good for customers, but it also helps fraudsters. A mule account (an account used to pass on criminal money) can receive and forward stolen funds before a monitoring rule has even finished running.

The second is liability (who pays for fraud losses). Since 7 October 2024, UK payment firms must reimburse most victims of authorised push payment (APP) fraud, up to £85,000 per claim, with the cost split equally between the sending and the receiving firm. The 50/50 split changed how banks behave, and quickly. Receiving banks now share the cost when scam money lands in a mule account they hold, so checking incoming payments now matters as much as checking outgoing ones.

Transaction monitoring (TM) is the mostly automated process of scanning a customer's transactions and flagging anything that doesn't fit an expected pattern, so a human AML professional can take a closer look. It runs on scenarios: pre-built rules that check for a specific pattern, like a threshold (a transaction over a set amount) or a velocity check (an unusual number of transactions in a short window). Every one of these rules creates false positives (alerts on activity that turns out to be normal), because a rule can't see the full story. It only sees numbers.

The key skill is not writing a perfect rule. It is adjusting thresholds to fit your real customers, so the alert queue shows real risk instead of flooding AML professionals with alerts that don't matter.

A few scenarios are standard in TM systems. Rapid movement of funds: money arriving and leaving within a short window, with little balance left behind. Structuring: cash deposits kept just under a reporting threshold. High-risk geography: transfers to or from FATF-listed jurisdictions. Profile deviation: activity well above the customer's expected volume. Repeated round amounts to the same counterparty.

Tuning means adjusting thresholds so they catch real risk without flooding the team with false alerts. It is the skilled part of the job. Teams run above-the-line testing, reviewing what the current threshold produces, and below-the-line testing, sampling activity just under the threshold to see what is being missed. US regulators also expect TM systems to be tested and approved under model risk management guidance. So every threshold change needs a written reason, not just a lower alert count.

An alert is just the system's way of saying "this activity matched a pattern, take a look." It lands in an AML professional's queue when a monitoring rule is triggered. It isn't a verdict. It's a starting point. Next comes the investigation. Good investigation starts with a chronology (a timeline): rebuild what happened, in order, before deciding what it means. If you decide on a conclusion first and then look for evidence to support it, you are working the case backwards. This always shows in the write-up.

Quick refresher: a SAR is the formal report a financial institution files when it can't reasonably explain a customer's activity. The narrative is the written section inside it, the paragraph where an AML professional explains, in their own words, why the activity looked suspicious enough to report. The rest of this module is about writing that paragraph well.

A good SAR narrative answers who, what, when, where, why, and how, in plain, factual language. It lets the evidence make the case, not strong descriptive words. "The customer is likely laundering money" is a conclusion your evidence must support. Do not write it just because it feels true. Tie every transaction you mention back to a typology where you can. This makes the narrative useful to the investigator who reads it later, not just compliant on paper.

Deadlines are strict. In the US, a SAR is due within 30 calendar days of first detecting facts that may require filing, which can be extended to 60 days if no suspect has been identified. Continuing activity is reviewed on a 90-day cycle, with any follow-up SAR due within 120 days of the previous filing. In India, STRs go to FIU-IND within 7 working days of concluding that a transaction is suspicious. The UK sets no fixed deadline, but reports are expected promptly, and the DAML process from Module 08 applies when a transaction is still pending.

A structure that works well in review: open with a one-paragraph summary covering who, how much, over what period, and why it's suspicious. Follow with the chronology, transaction by transaction. Then the investigation steps taken and what they found. Close with the action taken on the account. Where a FinCEN alert applies, include its key term, such as FIN-2026-A7NETWORK from October 2026, so FinCEN can link the report to others about the same activity.

Embedded finance is when a non-financial company (a ride-hailing app, an e-commerce platform) offers banking-like features (a wallet, a debit card, a loan) inside its own app, using a licensed bank's infrastructure behind the scenes instead of becoming a bank itself. Fintech didn't invent new ways to launder money. It removed the checks and delays that used to slow the old ones down. With instant onboarding, embedded finance, and automated account opening through APIs (software connections), a criminal can open, fund, and empty an account faster than traditional bank controls were designed to react.

First, some basics before the AML part. A blockchain is a public, shared record of every transaction ever made in a given cryptocurrency, kept by a network of many computers, not by one company. A wallet is what holds someone's crypto (in practice, a pair of cryptographic keys). A wallet address is the public string of characters people send funds to. It works like a bank account number, except no name is attached to it anywhere on the blockchain.

Blockchains are transparent but pseudonymous (users appear as addresses, not names). Every transaction is public, but the wallets stay nameless until one of them uses a service that runs KYC. Investigation means tracing: follow each transfer (hop) until you reach an exchange with identity records, a mixer (a service that blends funds to hide their source) that breaks the trail, or a swap service without KYC that pools funds into a shared reserve, where the on-chain link can no longer be proven. In most major jurisdictions, VASPs (crypto service providers, such as exchanges) are now regulated like banks. They must meet a similar KYC standard, even though no single party controls the asset.

The EU has gone further with MiCA, the Markets in Crypto-Assets Regulation. It is a dedicated set of rules for issuing crypto-assets, holding them for customers (custody), and licensing exchanges. It adds to the AML duties AMLD5 already placed on VASPs. It does not replace them. Since 30 December 2024, the EU's crypto travel rule has also required sender and recipient details to travel with every crypto transfer a regulated provider handles, the same principle bank wires have followed for years. Don't mix these up: MiCA is mostly about market conduct and prudential standards (how firms behave and how much capital they hold). AML duties for crypto firms still come from the AMLD/AMLR rules. A VASP can be fully MiCA-licensed and still fail an AML exam.

Two different tool categories do the work here. For blockchain analytics and tracing (the tools that follow each hop shown in the tracing diagram), know Chainalysis, TRM Labs, and Elliptic. Crypto-specific KYC and onboarding, the identity checks VASPs run when onboarding customers, is a separate category, where providers like Sumsub sit. Different job, different tool. Don't mix them up in an interview.

A typology is a known, named pattern of how money laundering usually happens. Here are five common ones. Each works differently, but they all have the same goal: making criminal money look like it came from a legitimate source.

Five classic typologies

Structuring: splitting one large transaction into several smaller ones specifically to stay under a reporting threshold. For example, depositing $9,500 on three days in a row instead of $28,500 once is structuring. In the US, structuring is a crime by itself, even if the money is fully legal.

Funnel accounts: one account that receives lots of small deposits from different people or places, then quickly forwards the combined total elsewhere. In short, money comes in from many sources and leaves as one amount.

Mule networks: groups of people who let their own bank accounts be used to receive and pass on someone else's criminal money, in return for a share. Many are recruited without fully understanding what they are agreeing to.

Shell companies: businesses that exist on paper, with a registration and a bank account, but do no real trading or operations. They make a transfer look like normal business activity when there is no real business behind it.

Trade-based laundering: hiding the movement of value inside an import or export deal that looks legitimate, usually by putting a price that is too high or too low on the invoice, so the money moves as if it were normal trade.

Worked example: a company exports 10,000 phone cases worth $5 each, so $50,000 of goods, but invoices them at $25 each. The overseas buyer pays $250,000 for $50,000 of product, so $200,000 of value has crossed the border looking like normal trade income. If the price is set too low instead (under-invoicing), value moves the other way. The warning sign: documents that agree with each other but do not match market prices.

These five methods are connected. The same few methods are used again and again across all asset types and jurisdictions. Once you learn the pattern, you can spot it in a bank statement or in a block explorer (a website that shows crypto transactions).

New and emerging typologies

Pig butchering: a long-running investment scam where criminals build the victim's trust for weeks, usually through dating apps or "wrong number" messages, then push them to invest on a fake crypto trading platform. Many of these scams are run from scam compounds in Southeast Asia, where the workers are trafficking victims. FinCEN's September 2026 alert tied nearly $13 billion in suspected activity to these scam centers.

Chinese money laundering networks: brokers who buy US dollars earned from drug sales from cartels, then sell those dollars to Chinese nationals who want to get around China's capital controls (limits on moving money out of the country). FinCEN issued a dedicated advisory on this typology in 2025.

It's a modern version of the Black Market Peso Exchange, the classic typology from the 1980s and 1990s. Colombian cartels sold US dollar drug proceeds at a discount to peso brokers, who then used those dollars to pay for goods that Colombian importers were buying from the US. The drug money left the country looking like payment for legal imports. The modern version uses the same idea, with different brokers and different capital controls.

Sanctions evasion through intermediaries and stablecoins: FinCEN's October 2026 alert on Russia's A7 network describes front companies (companies used to hide the real party) in other countries listed as the payers on trade documents, alongside a ruble-linked stablecoin, A7A5, used to move value outside sanctioned banking channels.

Mule recruitment through social media: "easy money" job posts aimed at students and young adults, offering a share of the money for receiving and passing on funds. Many recruits don't realize they're committing a crime until their account gets frozen.

Corruption covers offences like bribery (offering or accepting something of value to influence an official decision) and embezzlement (someone entrusted with funds, such as an employee or an official, stealing them for personal use). Trafficking covers the illegal trade of people, drugs, or goods. Human trafficking specifically means moving or holding people through force, fraud, or coercion for exploitation. A predicate crime is the underlying offence that generated the illicit money in the first place: bribery, embezzlement, trafficking, drug dealing, cybercrime. AML deals with the money these crimes produce. You don't need to prove the predicate crime yourself. You need to recognize financial patterns consistent with one, and document them clearly.

Human trafficking leaves recognizable financial signs: several workers' wages paid into one account, accounts opened by a third party who also "translates" for the customer, rent and travel paid for groups of people by one individual, and frequent late-night payments to online classified ad sites. The forced labor inside the scam compounds from Module 21 shows how trafficking and fraud now often share the same case.

Terrorist financing (TF) is providing or collecting funds, from either legal or illegal sources, intending or knowing they'll be used to carry out a terrorist act. Proliferation financing (PF) is the same idea applied to weapons of mass destruction: funding the development, acquisition, or transport of nuclear, chemical, or biological weapons, usually tied to a sanctioned state's weapons program.

TF often works the opposite way to money laundering (ML). Instead of large sums that need to look legitimate, TF often uses small, split-up transactions that need to stay hidden, sometimes sent through non-profits or informal channels. Because PF is usually linked to sanctioned states, it overlaps a lot with sanctions work and is reviewed from both the AML side and the sanctions side.

Hawala and similar informal value transfer systems move value without any money physically crossing a border. A broker in one country takes cash from a customer, a partner broker in another country pays out the equivalent, and the two brokers settle up later. Often no money moves at all for each transfer: payments flowing the other way are netted off against each other, and only the balance left after a few weeks or months gets settled. That balance is usually cleared through trade (one broker pays for goods the other needs, sometimes with over- or under-priced invoices), through transfers between bank or money-transfer accounts, or by moving physical cash across the border. Hawala is legitimate and widely used by migrant communities to send money (remittances) home, which is why abuse is hard to spot.

Non-profits need the same balanced approach. FATF Recommendation 8 asks countries to protect non-profits from TF abuse in a targeted, risk-based way, not by de-risking (cutting off) the whole charity sector.

Fraud is intentionally deceiving someone to gain a financial benefit or cause them a financial loss. A romance scam builds a fake relationship, often over weeks or months, before asking for money. An investment scam promises returns that don't exist to get someone to hand over funds. Account takeover is gaining unauthorized access to someone else's real account and draining it.

Fraud and money laundering are related, but in law they are different crimes. Fraud is how the money became illegal. Laundering is what happens to it afterward, so a good AML professional treats a fraud case as the start of a laundering trail, not the end of the investigation. Romance scams, investment scams, and account takeover all follow the same path once the victim's money moves: through mule accounts, into layering, and out as cash, fast.

Machine learning models in AML depend on the labeled data and assumptions used to train them, and "the model flagged it" is never a full reason on its own. Being able to explain a result matters as much as accuracy, especially once a regulator asks why a specific customer was flagged, or wasn't. AI does speed up research, finding patterns, and writing first-draft narratives. It does not replace the human decision on whether the evidence really supports a conclusion. Treating it as if it does leads to weak cases being filed.

Criminals use the same technology. FinCEN issued an alert in November 2024 on fraud schemes using deepfake media: AI-generated identity documents, photos, and video used to pass remote onboarding checks. Red flags include images that look edited or inconsistent, customers who can't complete live verification and blame "technical glitches," and devices or IP addresses that don't match the stated identity.

Regulators are getting explicit about AI too. The EU AI Act treats AI used for creditworthiness assessment as high risk, but it excludes systems used only to detect financial fraud. Across jurisdictions, supervisors expect firms to explain any model that drives a compliance decision, which is why being able to explain models is now a real job requirement on monitoring and model-validation teams.

For freshers (new graduates), the usual path into AML starts with KYC or basic transaction monitoring, not investigations. Get strong at that work first. SAR writing, harder cases, and later quality-review duties come with time. Certifications like CAMS, ICA's qualifications, or ACFCS's CFCS, all well recognized across the industry, help more with passing an ATS (Applicant Tracking System, the software that scans resumes before a human ever sees them) filter and a recruiter's checklist than with teaching you the job.

Their value has also changed. Five to ten years ago, mostly senior professionals took these certifications. Now freshers and people with one or two years of experience take them just as often, so many more people hold the same certification than before. As a result, the certification now helps at an earlier stage. It used to help you get the job. Now it mostly gets your resume past the first filter and gets you an interview. After that, the interview decides, along with how current and useful your knowledge is. You still learn the job itself by working cases, and from a reviewer who explains why your work was sent back.

Job descriptions do not usually mention this. Once you know the basics, most of the work is making decisions you can defend and documenting them to a set standard. There is often no single correct answer. Two AML professionals can close the same alert for opposite reasons and both be right, as long as the reasoning is written clearly enough to make sense to someone reading it years later: an examiner, an auditor, or a new hire trying to reconstruct what happened. The decision itself (close or escalate) is the smaller part. The real skill is knowing what an examiner will later ask for, and writing the file today so it already answers that question.

Every AML professional works a little differently. Every manager runs a team a little differently. Every institution covered by AML rules, whether a bank, a fintech, or a crypto exchange, builds its own process and its own shortcuts. But once a file is closed, one question matters more than all of that, in every role and every type of institution: does the reasoning still make sense when a regulator reviews it?

Questions that come up often in AML interviews