Money laundering is the process of moving criminal proceeds through a financial system until they no longer look fraudulent. It works in three stages: Placement gets dirty funds in, layering obscures their origin, and integration brings them back out as apparently legitimate money.
According to the United Nations Office on Drugs and Crime (UNODC), less than 1% of illicit financial flows are seized and frozen globally, a figure that reflects how rarely detection programs are calibrated to where in the laundering process risk shows up.
Knowing how each stage of money laundering works, and where detection is hardest, is what separates a compliance program that intercepts laundered funds from one that only processes them.
Key takeaways:
- Detection difficulty is not equal across the three stages
Placement is the most detectable stage because funds are still close to their criminal source. Layering is the hardest because each transaction looks routine, and the pattern only emerges across multiple institutions.
- Most AML programs are structurally better at catching placement than layering
Account-level rules catch placement anomalies. Layering requires network-level visibility across accounts and institutions that most programs are not built to provide.
- The cross-institutional blind spot is where schemes succeed
A launderer moving funds through multiple banks exposes each institution to only a fraction of the activity. Detection depends on mapping entity relationships and indirect connections, not just matching names against a list.
- Modern schemes compress the timeline without changing the underlying structure
Instant payment rails, mule networks, and virtual assets mean all three stages can be completed in minutes. Programs built on overnight batch review are examining activity that has already concluded.
- Sigma360 maps controls to each stage of the laundering cycle
Sigma360 covers sanctions and watchlist screening at placement, network intelligence and entity resolution at layering, and adverse media with perpetual monitoring at integration.
What are the 3 stages of money laundering?
The three stages describe the full arc of how illicit funds move from criminal hands into the legitimate economy. Each stage has its own methods, detection profile, and compliance controls. FATF and UNODC both use this framework as the basis for international AML standards and national risk assessments.
The table below shows each stage alongside its detection difficulty.
| Stage | What happens | Primary detection window |
| 1. Placement | Illicit funds enter the financial system through deposits, purchases, or cash-intensive channels | Highest: Funds are still close to their criminal origin |
| 2. Layering | Funds move through a series of transactions across accounts, institutions, and jurisdictions to obscure their trail | Lowest: Individual transactions look like ordinary activity |
| 3. Integration | Funds return to the criminal as apparently legitimate income, asset sale proceeds, or business revenue | Moderate: Signals are subtle but traceable when tied to earlier activity |
Many compliance resources treat structuring and layering as interchangeable, but they describe different stages.
Structuring (also called smurfing) is a placement technique, i.e., breaking cash into smaller deposits to stay below reporting thresholds and get it into the system. Layering begins only once those funds are already inside, when the focus shifts from entry to concealment. Treating them as the same thing puts controls at the wrong point in the process.
Stage 1: Placement
Placement is the point at which illicit cash enters the financial system. Drug trafficking, fraud, and organized crime generate cash at a scale that cannot move through a bank account without triggering reporting obligations.
Every method at placement serves the same end: making large volumes of cash look unremarkable enough to enter the system.
Placement draws on a consistent set of techniques, most involving cash fragmentation or a change of form:
- Structured deposits: Large sums split into smaller amounts and deposited across multiple accounts or locations over time, each below the reporting threshold
- Cash-intensive business blending: Illicit funds mixed with legitimate revenue from restaurants, car washes, retail, or other high-cash operations where the two are difficult to separate
- Smurfing networks: Multiple individuals (“smurfs”) each make small deposits or purchases on behalf of the criminal, spreading activity across many accounts
- Physical currency smuggling: Cash transported across borders and deposited in jurisdictions with weaker controls, then transferred back
- Monetary instrument purchases: Money orders, cashier’s checks, and prepaid cards bought with cash and used elsewhere to add a layer of transactional history
- Real estate and asset purchases: Property, vehicles, or high-value goods bought with illicit cash and resold for clean proceeds
AML programs have the clearest detection opportunity at placement. At this stage, the primary indicators are:
- Cash deposit patterns inconsistent with a customer’s business profile
- Transactions clustered just below Bank Secrecy Act Currency Transaction Report thresholds
- New accounts receiving rapid, high-volume inflows
Sanctions and watchlist screening adds a parallel control, catching sanctioned individuals or high-risk entities before funds enter the system.
Stage 2: Layering
Layering begins once funds are inside the financial system. The further the money moves from its criminal origin, the harder reconstruction becomes—and layering is built to maximize that distance.
Each individual transaction (a wire transfer, a securities purchase, a business payment) looks like routine commercial activity. The pattern that exposes a scheme emerges only across multiple accounts and institutions, and no single institution holds enough of the picture to see it.
Layering draws on techniques designed to be indistinguishable from legitimate finance:
- Electronic funds transfers: Funds moved through chains of personal and corporate accounts, each hop adding distance from the source
- Correspondent banking channels: Transfers routed through respondent banks to exploit gaps between national regulatory regimes
- Shell company and nominee structures: Ownership layered through multiple legal entities in different jurisdictions to obscure the ultimate beneficial owner
- Securities and investment activity: Stocks, bonds, and insurance products purchased and liquidated, with proceeds arriving as clean investment returns
- Loan-back arrangements: Illicit funds placed in an offshore account, then “loaned” back to the criminal through a front company, with repayments recorded as business expenses
- Virtual asset movement: Funds converted to cryptocurrency, moved across platforms and chains, then converted back to fiat through exchanges in different jurisdictions
Cross-border movement through correspondent banking chains is one of the most difficult layering typologies for any single institution to detect, a point the Wolfsberg Group has consistently emphasized in its guidance for respondent bank relationships.
Trade-based money laundering presents the same problem in a different form, routing value through over- and under-invoiced trade transactions, ghost shipments, or misclassified cargo to generate plausible commercial documentation at each stage. FATF identifies it as one of the most widely used methods for moving illicit funds across borders.
Stage 3: Integration
Integration is the final stage, when laundered funds return to the criminal as apparently legitimate income, assets, or business proceeds, free to spend, invest, or transfer without attracting scrutiny.
Criminal proceeds reaching integration have already been distanced enough from their source that tracing them requires rebuilding the entire layering chain. Detection depends on connecting integration-stage signals back to what came before, which is why it rarely works from a single transaction.
Once funds reach integration, the methods used to return them are designed to mirror legitimate commercial transactions:
- Real estate investment: Property purchased during layering is sold, with proceeds arriving as a clean real estate transaction
- Business injection: Capital placed into legitimate or fabricated companies, returning as dividends, profits, or director remuneration
- Loan repayment: A fictitious loan “repaid” through an offshore entity, with repayments recorded as debt settlement
- Payroll fraud: Payments processed through a payroll system to non-existent employees, with the criminal collecting the wages
- High-value asset sales: Artwork, jewelry, or collectibles acquired beforehand and resold at auction, with the sale recorded as legitimate income
Adverse media monitoring reaches integration-stage activity that screening does not. Regulatory enforcement notices and investigative journalism frequently expose beneficial ownership disputes, asset forfeiture proceedings, and suspicious business valuations well ahead of any screening match.
Source-of-funds checks on high-value transactions and enhanced due diligence on customers injecting unexplained capital into businesses are the primary controls at this stage.
Where detection programs break down
Placement produces anomalies confined to a single account (unusual deposit patterns, threshold-adjacent transactions, customer profile mismatches), which account-level rules are built to catch.
Layering produces patterns that exist only across accounts and often across institutions, which no single-account rule can expose. Recognizing this stage requires network-level visibility and the ability to connect activity that looks unrelated when examined in isolation.
The cross-institutional blind spot is the central problem
A launderer moving funds through five banks exposes each one to one-fifth of the activity, and no single compliance team ever assembles the full picture.
AML investigations that can map entity relationships and indirect connections are becoming operationally necessary. Sigma360’s AML investigations platform aggregates data across 260+ jurisdictions to support that kind of cross-entity analysis.
Modern typologies have changed the timing, not the structure
Instant payment rails have removed the time buffer that batch-based detection was built around. All three stages can complete within the same transaction window, which means detection built on overnight batch review is examining activity that has already concluded.
Mule networks distribute placement across hundreds of real accounts belonging to real people, many of whom are unaware they are participating. Virtual asset platforms achieve the same effect of layering, converting and reconverting funds across platforms in ways that give individual institutions no visibility into what comes before or after their transaction.
The three stages still describe what must happen for money to be successfully laundered. Their operational value is in showing practitioners where controls need to sit, even when modern schemes compress the timeline or blur stage boundaries.
How Sigma360 covers the full money laundering cycle
Effective detection requires controls built around each stage of the laundering process.
At the placement stage, the priority is identifying risk before funds enter the system. Sigma360’s sanctions and watchlist screening runs customers and counterparties against global government lists and PEP screening across 100B+ data points in 260+ jurisdictions. Match thresholds and filter sets adjust within the platform without engineering support, so compliance teams can calibrate sensitivity directly against their risk appetite.
Keeping false positives in AML screening low reserves analyst capacity for alerts that warrant genuine scrutiny.
At the layering stage, Sigma360’s network intelligence traces indirect connections across ownership chains, corporate registries, and relationship graphs that go beyond direct name-matching. The Match Agent clears easily resolved alerts autonomously.
Its Entity Summary generates a structured risk profile drawing on watchlist data, KYC records, adverse media, and network indicators, so analysts have everything they need at the point of decision, in one place.
At integration, adverse media screening monitors global news sources, regulatory filings, and court records for asset forfeiture proceedings, beneficial ownership disputes, and reputational exposure that watchlist screening alone does not catch. Perpetual KYC keeps the existing customer portfolio under continuous review, triggering alerts when a risk-relevant event occurs on an already-onboarded entity.
If you’d like to learn more, speak to a compliance expert to see how Sigma360 performs across all three stages of your AML program.
FAQ
What is the correct order of the three stages of money laundering?
Placement, then layering, then integration. Placement introduces funds into the financial system, layering obscures their origin through repeated transactions, and integration returns them to the criminal.
Is structuring the same as layering?
No. Structuring is a placement technique: It breaks large cash amounts into smaller deposits to stay below reporting thresholds. Layering begins only after those funds are already inside the system, when the focus shifts from getting funds in to hiding where they came from.
Do all three stages always happen in sequence?
Not always. Simple schemes can collapse placement and integration into a single step, and modern payment infrastructure has compressed the traditional timeline to the point where all three stages can be completed within a single session.
Is there a fourth stage of money laundering?
The standard model has three stages. Some legal frameworks and defense contexts add extraction as a fourth, describing the point at which laundered funds are spent. FATF and UNODC both use the three-stage model, treating extraction as the tail end of integration rather than a distinct stage.
How does cryptocurrency affect the three-stage model?
It compresses layering significantly. Chain-hopping, mixing services, and cross-platform conversion create transaction opacity that traditional monitoring was not built to detect, and all three stages can be completed faster and across more jurisdictions than they typically are through conventional cash-based schemes.
What is the difference between money laundering and terrorist financing?
Money laundering moves funds from illegal origins to make them appear legitimate. Terrorist financing moves funds toward illegal ends, and the source may be entirely legal. Both require transaction monitoring and customer due diligence, but the red flags and typologies differ at each stage.
What penalties apply to institutions that fail to detect money laundering?
Penalties can include civil fines, deferred prosecution agreements, consent orders, and individual criminal liability for compliance officers. OFAC, FinCEN, the FCA, and EU regulators have all issued nine-figure penalties for systemic AML control failures, and the correspondent banking consequences often outlast the fine itself.
