Transaction Logs

Comprehensive records of financial transactions across all channels, capturing both account details (e.g., ownership, balances) and transaction data (e.g., timestamps, amounts, currencies, parties, transaction identifiers). This includes deposits, withdrawals, wire transfers, card payments, ATM usage, investment trades, remittances, gaming transactions, peer-to-peer transfers, cryptocurrency flows, and other forms of money movement.

[
Code
DS0019
]
[
Name
Transaction Logs
]
[
Version
1.0
]
[
Category
Transaction & Payment Data
]
[
Created
2025-04-02
]
[
Modified
2025-04-02
]

Related Techniques

T0016.004
|
|
  • Provides detailed records of all deposits, withdrawals, timestamps, and amounts, enabling investigators to identify frequent, low-value ATM transactions that aggregate just below reporting thresholds.
  • Allows cross-referencing with account data to confirm whether multiple individuals (smurfs) are depositing into the same account, thus revealing potentially structured deposits under threshold limits.
  • Facilitates pattern analysis of repeated amounts and deposit intervals to detect suspected ATM structuring schemes.
  • Captures each financial movement, including timestamp, amount, counterparty details, and channel, tied to the compromised account.

  • Helps investigators identify abnormal transaction patterns, unusually high-value transfers, or other anomalies occurring shortly after unauthorized account access.

Provides records of actual cash inflows and outflows, including timestamps, amounts, counterparties, and transaction identifiers. Investigators can compare these real transaction flows against accrual-based revenue or expense entries in financial statements to detect discrepancies indicative of potential accrual manipulation.

  • Provides comprehensive records of financial transactions, including timestamps, senders, recipients, amounts, and references.
  • Enables detection of repeated 'advance fee' references, multiple small inbound transfers from unrelated parties, and rapid onward structuring of received funds—hallmarks of advance fee fraud.
  • Captures inbound and outbound transaction details, including timestamps, amounts, and counterparties, across agent or sub-agent accounts.
  • Reveals patterns of structured deposits and layering, including multiple sub-threshold transactions.
  • Enables tracing of funds through different payment providers or aggregators, helping identify hidden links in the payment chain.

Comprehensive records of subsidy deposits include details such as amounts, timestamps, originating accounts, and subsequent fund movements. This data helps identify unusually large or frequent subsidy credits and trace rapid transfers into unrelated accounts, indicating potential layering or commingling of fraudulent proceeds.

  • Provides comprehensive records of deposits, withdrawals, wire transfers, and cash transactions tied to agribusiness accounts.
  • Allows detection of unusual or large inflows (e.g., government subsidies) and outflows that are inconsistent with typical agricultural revenue patterns.
  • Helps identify high-volume cash deposits that do not align with local farming practices or seasonal norms, indicating potential illicit fund placements.

Captures comprehensive payment information, including amounts, timestamps, deposit methods, and withdrawal channels. This data enables the detection of multiple cashier's checks or structured payments from different institutions used to fund real estate purchases and bypass reporting thresholds.

  • Captures detailed records of financial transactions and money movements across various channels, including timestamps, amounts, currencies, parties, and transaction identifiers.
  • Supports the detection of unusual patterns involving prepaid cards, app-based remittances, or cryptocurrency transfers, flagging rapid or high-volume movements indicative of layering or structuring.
  • Records timestamps, amounts, currency types, and parties involved in each financial transaction.
  • Facilitates the identification of recurring or structured transactions initiated from anonymizing networks, enabling pattern analysis of unusual transaction frequencies or amounts masked by hidden IP addresses.
  • Comprehensive records of financial transactions, highlighting amounts, dates, senders, and ultimate beneficiaries of arbitration-related transfers.
  • Supports identifying large or layered fund movements labeled as 'arbitration awards,' flagging discrepancies between named litigants and actual recipients.
T0143.002
|
|
  • Provides comprehensive records of financial transactions, including timestamps, amounts, currencies, parties, and transaction identifiers.

  • Enables investigators to pinpoint high-value or repetitive transfers that could indicate proceeds from arms sales, and flags suspicious transaction patterns or unusual flows linked to potential illicit arms dealings.

  • Provides time-stamped records of all financial transactions, including bidding increments, payment flows, and settlement amounts.
  • In the context of art auctions, these logs help identify anomalous bidding patterns (e.g., round-number or repetitive increments) and track unusual payment routes or multiple intermediaries indicative of potential manipulation.
  • Captures detailed deposit amounts, frequencies, cross-border wires, sub-account transfers, and other transaction metadata (e.g., timestamps, counterparties).
  • Enables detection of large lump-sum deposits from multiple unassociated sources, frequent reallocations of funds, and complicated layering strategies that indicate potential misuse of asset management accounts.
  • Captures deposit entries and subsequent refunds for canceled or uncompleted bids, providing a record of potential layering or integration activities.
  • Tracks payment flows across multiple accounts or third-party checks, helping identify suspicious layering or funneling patterns.
  • Enables detection of repeated deposit-refund cycles that may signify disguised movement of illicit funds through auction platforms.
  • Provides comprehensive transaction details such as timestamps, amounts, currencies, counterparties, and transaction identifiers across various channels.
  • Enables detection of sub-threshold structuring, frequent batch transfers, and recurring, precisely timed payments—key indicators of automated layering.
  • Helps identify abnormal transaction velocities and repeated uniform amounts consistent with scripted or algorithmic transfer activity.
  • Document all financial movements and provide details on amounts, timestamps, and originating and destination accounts.
  • Enable comparison of actual transaction activity against configured control thresholds to spot transactions that bypass normal alerts.
  • Help uncover anomalies related to insider suppression of alerts or unauthorized system parameter changes.

Encompasses all financial transactions, including account or ownership references, timestamps, amounts, and counterparties. Correlating changes in beneficial ownership with transaction details can expose suspicious sequencing, layering, or asset movement.

  • Comprehensive records of financial transactions, including timestamps, amounts, and counterparties.
  • Helps detect structured payments or suspicious commissions related to rigged contracts, such as round-number transactions or repeated smaller sums below reporting thresholds.

Captures all financial movements associated with Bill of Exchange transactions, including timestamps, amounts, and sender and receiver details. This information can reveal the repayment of illicit funds, layering attempts, and unusual repayment patterns or unrelated funding sources.

T0061.004
|
|

Captures bond purchase and redemption details, such as timestamps, amounts, and payment methods, across customer accounts. This data helps identify unusual patterns, such as frequent high-value bond purchases and rapid redemptions, as well as discrepancies in how funds are introduced or withdrawn. This supports the detection of layering within bond investment schemes.

T0006
|
|
  • Captures comprehensive transaction details, including timestamps, amounts, counterparties, and payment references, enabling the detection of suspicious or unexplained payments.
  • Supports investigations into bribery by correlating abnormal transfers with key decision-making periods or official involvement.

Includes comprehensive records for inbound or outbound capital injection transactions, capturing timestamps, amounts, counterparties, channels, and references. This helps identify unusual investment inflows exceeding a business's typical financial scale and track repeated or structured transfers from multiple sources, revealing potential layering or commingling of illicit funds.

  • Captures all financial activity within accounts, including timestamps, amounts, counterparties, and transaction channels.
  • In the context of CBI/RBI, these logs reveal sudden inflows or rapid movement of funds coinciding with golden passport applications, unusually high commissions to agents, or direct payments to officials.
  • Enables AML analysts to detect and investigate suspicious payment flows, asset liquidations, and potential bribery or corruption tied to citizenship or residency programs.
  • Capture all premium payments to the captive insurer and subsequent claim or refund disbursements to help identify circular flows of funds tied to potential laundering.
  • Reveal unusual payment patterns, such as inflated premiums or rapid and frequent claim paybacks, that exceed legitimate coverage or risk profiles.
  • Captures detailed records of all financial transactions, including carbon credit payments, rapid cross-border fund transfers, and subsequent outflows to high-value purchases or offshore accounts.
  • Facilitates tracing the frequency, volume, and timing of transactions to identify anomalies, such as unusually large or frequent carbon credit trades lacking commercial rationale.
T0144.007
|
|
  • Records comprehensive transaction data, including timestamps, amounts, account details, and counterparties.
  • Enables tracking of circular or repetitive fund movements among shell companies.
  • Assists investigators in identifying large-scale money flows consistent with carousel fraud patterns.
  • Provides detailed records of deposit timestamps, amounts, and transaction references for each account.
  • Enables detection of recurring deposit patterns, sub-threshold structuring, and unusually high deposit frequencies inconsistent with stated customer profiles.
  • Supports cross-checking deposit sources to identify potential third-party or multi-location deposit behaviors.
  • Provide a detailed record of cash withdrawals and transfers, including timestamps, amounts, and account details.
  • Tracking frequent or large cash withdrawals aligned with payroll cycles can detect illicit wage disbursements concealing illegal funds.
  • Provides a record of cash withdrawals and financial transactions, including timestamps, amounts, and account details.
  • Helps detect patterns of recurring, unexplained cash withdrawals coinciding with typical payroll periods, indicating off-the-books wage disbursements to undocumented workers.
  • Consolidates records of all financial transactions, capturing deposits of casino-issued checks into external bank accounts.
  • Allows investigators to trace subsequent fund movements and potential structuring across multiple accounts, revealing additional layering after casino chip redemptions.
T0005
|
|
  • Captures detailed records of deposits, withdrawals, and transfers, including timestamps, amounts, and account identifiers.
  • Enables detection of unusual patterns where frequent crypto conversions are combined with fiat transactions to obscure cross-chain activities.
T0091
|
|

Transaction logs provide complete records of all credit card and payment transactions, including:

  • Timestamps, transaction amounts, merchant details, and customer account identifiers.
  • Dispute data capturing who initiated chargebacks, when, and for how much.

These details directly help identify suspicious patterns of recurrent chargebacks, collusion between merchants and customers, or attempts to keep dispute ratios low by managing transaction volumes.

  • Captures granular transaction details, including timestamps, amounts, currencies, account identifiers, and metadata for each donation or payment flow.
  • Enables the identification of suspicious spikes in donation activity, rapid layering attempts, and cross-referencing of multiple high-risk donor sources or incomplete donor information.
  • Assists investigators in detecting anomalies such as unusually large or frequent donations that are inconsistent with typical funding patterns.
T0144.010
|
|
  • Capture check deposit details, including timestamps, amounts, payors, and deposit channels, as well as subsequent withdrawals or transfers.
  • Facilitate the identification of returned checks that have already been withdrawn, revealing potential fraudulent float exploitation.
  • Provide concrete evidence of suspicious deposit and withdrawal patterns linked to possible check fraud schemes.
  • Provides comprehensive records of financial transactions across accounts and channels, covering timestamps, amounts, currencies, parties, and transaction methods.
  • Enables investigators to trace and identify suspicious or unusual payment patterns potentially linked to illicit proceeds derived from child exploitation, such as repeated small deposits, irregular layering attempts, or funneling across multiple accounts.
  • Provides timestamps, amounts, currencies, counterparties, and geographic details for payments and deposits.
  • Enables identification of frequent cross-border transactions with tobacco suppliers in low-tax jurisdictions, supporting detection of inconsistencies with stated import duty or customs documentation.
  • Facilitates monitoring of large or repetitive cash deposits that exceed normal retail cigarette sales volumes, indicating potential smuggling proceeds.
  • Presents comprehensive timelines of financial transactions, including timestamps, transaction identifiers, and related accounts.
  • Identifies rapid or overlapping issuance of letters of credit, indicating circular movement of funds.
  • Pinpoints patterns where sequential letters of credit are used without corresponding underlying trade.
  • Provides comprehensive records of financial transactions across accounts and channels, including timestamps, amounts, currencies, counterparties, and unique transaction identifiers.
  • This data is critical for detecting cyclical transaction patterns where funds are returned to their original source, lacking legitimate economic purpose.
  • Provides comprehensive records of financial transactions, including timestamps, amounts, currencies, parties, and transaction identifiers, related to the purchase or sale of collectibles.
  • Enables detection of transactions priced significantly above or below typical market values, revealing possible price manipulation.
  • Helps identify repeated consecutive sales of the same item with inconsistent pricing, suggesting intentional layering or artificial inflation.
  • Facilitates recognition of structured transactions deliberately kept below thresholds to avoid AML scrutiny.
  • Allows monitoring of sudden spikes in activity for customers with no prior record of high-value collectible trading.

Tracks financial transactions in detail, capturing timestamps, amounts, counterparties, and account balances. This data helps pinpoint large or unusual commodity purchases by parties with no historical engagement in that sector, suggesting possible smuggling activity.

  • Captures all financial transactions, including amounts, timestamps, parties, and account details.
  • Enables detection of smurfing or structuring patterns, common at the placement stage of illicit proceeds from commodity trafficking.
  • Provides a transaction trail for tracing funds used in the purchase or sale of illicit commodities.

Comprehensive records of financial transactions detail senders, recipients, amounts, and timestamps.

  • Enable detection of third-party payments not listed on official trade documentation.
  • Assist in identifying unusual funding patterns that suggest trade-based money laundering.
  • Provides detailed records of financial transactions (e.g., timestamps, amounts, counterparties, and channels).
  • Facilitates detection of patterns such as multiple small-value deposits, sub-threshold structuring, and frequent peer-to-peer payments.
  • Helps identify anomalies in cash-intensive business operations, supporting investigations into potential laundering of illicit proceeds derived from common offenses.
  • Provides detailed records of financial transactions, including timestamps, amounts, parties, currencies, and transaction identifiers.
  • Enables detection of large or round-figure transactions, layering across multiple MSB-owned accounts, and unusual volumes compared to the MSB’s declared operations.
  • Supports AML teams in identifying and investigating transaction patterns that may indicate complicit or controlled MSBs masking illicit flows.
  • Identify large or unusual cash-based inflows or outflows that finance construction costs, highlighting potential over-invoicing or layering steps.
  • Track payment schedules and amounts, detecting irregular intervals or suspicious recipient accounts, such as shell entities.
  • Reveal foreign or unknown funding origins, flagging high-risk jurisdictions or unverified investor sources.
  • Monitor excessive payroll or wage disbursements to non-verified individuals, revealing ghost employees or inflated labor costs.
  • Expose the misdirection of NGO or charitable funds intended for construction into personal or affiliate accounts.
  • Records full details of financial transactions, capturing timestamps, amounts, parties, and references.
  • Supports cross-referencing of actual payments with consulting invoices to pinpoint inflated or fabricated transactions indicative of laundering.
  • Captures deposit timestamps, amounts, counterparties, and transaction references.
  • Allows detection of large or frequent member deposits that deviate from typical patterns.
  • Enables tracing of possible layering activities or funds cycling through multiple cooperative accounts.
  • Maintains detailed records of inter-company payments, including timestamps, amounts, and parties involved.
  • Helps identify unusual or frequent cross-company transfers that lack an economic rationale.
  • Correlates with invoice or contractual data to detect fabricated or inflated billing among affiliated entities.
T0051
|
|

Provides comprehensive records of account ownership, balances, and transaction details, including timestamps, amounts, currencies, and parties. In corruption cases, these logs help trace suspicious fund flows, identify layered transactions, and detect anomalies that exceed a public official’s legitimate income sources.

  • Provides detailed records of financial transactions, including timestamps, amounts, denominations, and account details.
  • Enables identification of suspicious deposit patterns (e.g., repeated small-denomination deposits, sub-threshold structuring, or sudden spikes).

Provides comprehensive records of all financial transactions (e.g., timestamps, amounts, parties) to detect patterns indicative of counterfeit pharmaceutical sales, such as large bursts of structured payments, multiple low-value transfers, or frequent refunds and chargebacks.

Captures detailed transaction records (timestamps, amounts, parties, references), revealing:

  • Large or frequent 'court-ordered' deposits that do not align with typical legal timelines.
  • Settlement funds suddenly appearing in accounts with no credible court documentation.

How it supports AML detection:

  • Identifies unusual or high-value movements labeled as legal settlements, enabling investigators to link potentially fraudulent court awards to suspected money laundering activities.
  • Captures transactional data, including timestamps, amounts, currencies, parties, and account details.
  • Enables tracing of suspicious transaction chains across jurisdictions, revealing layering attempts by local agents or fixers.
  • Supports correlation of transaction spikes with known or suspected cross-border agent activities.
  • Capture deposits, withdrawals, and transfers, including timestamps, amounts, and denominations.
  • Enable correlation of suspicious cash deposits or withdrawals with recent cross-border travel.
  • Reveal patterns of structuring or repeated transactions just below reporting thresholds after international trips.
  • Records all wire transfers and associated metadata, including timestamps, amounts, sender/receiver details, and reference fields.
  • Enables the comparison of declared trade values in cross-border settlement documents with actual transaction amounts, helping to detect inflated or fabricated payments.

Includes detailed records of all in-game and external transactions, such as timestamps, amounts, currency types, and counterparties. This enables the detection of unusual flows between different gaming platforms or third-party sites, helping to identify patterns of layering or value transfers that lack legitimate gaming rationale.

  • Captures comprehensive records of monetary flows (e.g., deposits, fund transfers, withdrawals) across accounts.
  • Identifies clustering of small donations or structured transactions suggestive of layering.
  • Enables tracking of disbursements to multiple unrelated accounts without clear charitable expenditures.
T0011.002
|
|
  • Captures comprehensive deposit and withdrawal records, including timestamps, amounts, account ownership, and cross-channel activity.
  • Enables detection of structured, repetitive, or round-amount cash deposits into crypto ATMs, revealing potential mule-based layering schemes.

Transaction logs from crypto ATMs capture deposit and withdrawal amounts, timestamps, and user or wallet identifiers. This data enables the detection of structuring attempts, such as repeated sub-threshold deposits, rapid consecutive deposits, and suspicious transaction bursts, supporting investigations into layering or unusual activity patterns.

  • Contains comprehensive records of financial transactions, including fiat-to-crypto conversions, timestamps, amounts, and counterparties.
  • Reveals frequent, large-value conversions associated with layering intentions, aiding in uncovering suspicious fiat-to-cryptocurrency entry points for this technique.
  • Capture all financial transactions tied to mining hardware purchases, energy bills, or cloud-based mining fees.
  • Help identify repetitive or large-sum payments that could signal layering or illicit funds being funneled into mining operations.
  • Enable cross-referencing of outgoing transactions for remote mining services, revealing potential money laundering flows.

Capture comprehensive financial movements, including deposit and withdrawal records, timestamps, amounts, and counterparties, across banking and cryptocurrency channels. For cryptocurrency mixing, these logs reveal repeated or structured flows to and from high-risk wallets, sudden spikes in outbound transfers, and deviations from a customer’s typical transaction profile indicative of layering or concealment.

  • Documents inflows to and outflows from accounts (especially when cryptojacking proceeds are eventually monetized via fiat bank transfers).
  • Helps detect unexplained deposits from exchanges or conversion platforms, inconsistent with the customer’s profile or declared business.
T0016.002
|
|
  • Provides comprehensive records of inbound deposits, including timestamps, amounts, sender information, and references.
  • Enables detection of mismatches between expected and actual senders or amounts, revealing illicit deposits substituting legitimate remittances.
  • Comprehensive records of financial transactions across accounts, including timestamps, amounts, currencies, and counterparties.
  • Enables correlation of currency exchange activity with subsequent layering transactions to different accounts or jurisdictions.
  • Assists in tracing the flow of converted funds through multiple financial channels.
T0003.001
|
|
  • Provides comprehensive records of deposits, withdrawals, timestamps, amounts, and counterparties.
  • Enables detection of patterns such as multiple small deposits, rapid withdrawals, and mismatches between deposit and withdrawal addresses—key indicators of custodial mixer usage.
T0013.006
|
|

Provides comprehensive financial transaction records, enabling the detection of the following Daigou-related red flags:

  • Repeated or large-volume purchases of high-value consumer goods, suggesting surrogate shopping on behalf of others.
  • Rapid succession of cash deposits followed by cross-border transfers for suspected luxury goods purchases.
  • Transaction references indicating purchases ‘on behalf of friends or clients’ without formal business arrangements.

This data supports investigators in identifying unusual spending patterns, layered transactions, and potential straw buyer activities linked to Daigou networks.

  • Contains detailed records of all financial transactions, including fiat deposits/withdrawals, transfers, and card payments.
  • Enables investigators to correlate spikes in account activity with inbound or outbound cryptocurrency flows tied to Darknet marketplace transactions, revealing potential layering or sudden volume anomalies.
  • Maintains a detailed record of all financial transactions, including timestamps, amounts, account identifiers, and transaction sources.

  • Allows for the correlation of unusual or high-value fund movements with potentially fraudulent voice requests, aiding in the detection of out-of-pattern transactions that may result from deepfake instructions.

Contain detailed transaction records (e.g., timestamps, amounts, involved accounts, and transaction references). Investigators compare original entries with altered records to uncover suspicious modifications or forged data, directly indicating digital document manipulation.

  • Captures timestamps, amounts, involved parties, and account identifiers for all financial transactions.

This data reveals transaction patterns linked to diplomatic or state-owned entities, including large or frequent cash movements, cross-border transfers, and potential structuring or layering activities, assisting AML teams in flagging suspicious flows under diplomatic cover.

Capture comprehensive details of deposits, including timestamps, amounts, denominations, parties, and channels. This enables the analysis of repeated sub-threshold transactions and unusual cash volumes. These records allow investigators to identify potential structuring that aligns with domestic bulk cash deliveries.

T0142
|
|
  • Provides comprehensive records of deposits, withdrawals, wire transfers, and other transactions, including timestamps, amounts, and counterparties.
  • Facilitates detection of unusually frequent or structured cash deposits, funneling patterns, and cross-border transfers tied to suspected drug proceeds.
  • Helps investigators trace the flow of funds and identify layering or integration steps used by criminal enterprises involved in drug trafficking.

Provides comprehensive records of monetary transactions, including timestamps, amounts, currencies, counterparties, and transaction types. This data helps detect unusual payment methods, structuring below reporting thresholds, and large or irregular flows tied to fraudulent online storefronts, enabling analysts to uncover potential layering of illicit proceeds.

Provides timestamps, amounts, and account identifiers for each superannuation withdrawal, enabling the detection of multiple or closely timed early withdrawal requests. Investigators can correlate the frequency and timing of withdrawals with suspicious documentation patterns.

T0086.001
|
|
  • Provides detailed records of premium payments, including amounts, timestamps, payer identities, and associated refunds, enabling the detection of suspicious or structured third-party payments.
  • Identifies short-lived policies that generate unusually large payout requests, supporting the investigation of potentially illicit early surrenders.
  • Provide comprehensive records of financial transactions, covering dates, amounts, parties, and counterparties.
  • Enable detection of rapid layering or structuring of disbursed relief funds into personal or third-party accounts lacking legitimate business purposes.
  • Support tracing of illicit proceeds across accounts or geographies, revealing suspicious fund flows.
  • Provides detailed records of transaction amounts, timestamps, parties, and related metadata.
  • Enables detection of unusually large or frequent tuition/donation payments from individuals not affiliated with the institution and helps identify layering or structuring patterns within the school's accounts.
  • Provide detailed records of deposits, withdrawals, wire transfers, card payments, and other monetary flows.
  • Enable investigators to spot anomalous or large inflows labeled as sponsorship, ticket revenue, or licensing fees beyond typical entertainment business norms.
  • Support detection of layering through round-number or repeated transactions consistent with laundering via entertainment fronts.

Provides detailed records of reimbursement transactions, including amounts, timestamps, and counterparties. This data allows for the detection of suspiciously high claims, duplicate submissions, or repeated partial claims strategically kept below internal review thresholds, all indicative of potential expense report fraud.

  • Records all financial transactions routed through professional intermediaries (e.g., attorney trust accounts), including timestamps, amounts, and parties involved.
  • Enables detection of structured transactions below reporting thresholds and rapid in/out flows that exploit professional secrecy.
  • Helps trace the movement of illicit funds disguised under attorney-client or professional privilege claims.
  • Provide detailed records of inbound and outbound financial transactions, including timestamps, amounts, and counterparties.
  • Monitor claimed export reimbursements and subsequent fund flows to identify anomalies or suspicious layering.
  • Detect rapid transfers and multi-step movements that obscure the ultimate beneficiaries of overvalued export proceeds.
T0049
|
|

Provides a complete record of all financial transactions across accounts (e.g., deposits, withdrawals, transfers). This data enables investigators to:

  • Identify recurring high-value or otherwise suspicious deposits that lack a legitimate explanation.
  • Detect suspicious transaction references (e.g., 'forced donation') or narratives indicative of coerced funds.
  • Recognize rapid transfers from receiving accounts to intermediaries shortly after deposit, suggesting layering of extorted proceeds.
  • Provide detailed records of incoming and outgoing funds, timestamps, and counterparties.
  • Help identify patterns of immediate pass-through transactions or unusually high volumes consistent with money mule activities.
  • Support detection of repeated incoming credits from unknown payors followed by rapid onward transfers.
  • Provides post-opening transaction details (timestamps, amounts, counterparties, velocities).
  • Assists in identifying abnormal usage patterns or rapid fund movements common in accounts opened with fake or stolen identities.
  • Provides comprehensive records of invoice payments, refunds, and other fund movements with timestamps and counterparties.
  • Uncovers partial refunds or suspicious redirections of funds soon after invoice settlement, aligning with bribery or fraudulent kickback schemes typical of fake vendors.
  • Provide detailed records of inbound and outbound wire transfers, deposit amounts, references, timestamps, and counterparties.
  • Enable detection of suspicious patterns, such as large deposits labeled as telemarketing income with no legitimate business rationale.
  • Help identify multiple small or medium-value inbound transfers from unrelated parties without supporting contracts or legitimate business relationships.

Transaction logs capture the flow of funds into and out of the fictitious consulting firm, including timestamps, amounts, sender/receiver details, and associated reference data. This enables the detection of rapid inflows followed by quick outflows, layering maneuvers, and inflated consulting fees that exceed typical market norms.

Documents the timing, amounts, and recipients of outgoing payments, enabling investigators to detect suspicious patterns of payables to newly formed or unverified creditors. Reveals potential layering of multiple outflows orchestrated to fictitious or shell entities under the guise of legitimate expenditures.

  • Data Provided: Detailed records of all incoming and outgoing financial transactions, including timestamps, amounts, and counterparty information.
  • AML Relevance: Identifies suspicious government benefit deposits, tracks concurrent wage and benefit payments, and flags rapidly withdrawn or transferred funds indicative of fraudulent claims.
  • Captures comprehensive records of inbound wire transfers, including amounts, timestamps, currencies, and counterparties.
  • Enables detection of unusually large or frequent inbound flows labeled as foreign capital injections that exceed an entity’s typical financial capacity or normal business activity.
  • Provides itemized records of financial transactions (e.g., dates, amounts, counterparties).
  • Enables investigators to spot recurring or unusually large invoiced amounts disguised as jewelry sales.
  • Facilitates cross-referencing transaction patterns with market benchmarks or shipping records to identify fictitious or inflated activity.

Detailed records of all financial transactions, including timestamps, amounts, initiating parties, and references to mergers and acquisitions (M&A). Investigators can identify unusually large or frequent merger-related payments, detect rapid layering maneuvers across multiple accounts, and uncover patterns inconsistent with legitimate corporate acquisitions, signaling possible fictitious or manipulative M&A activity.

  • Records the details of every financial disbursement, including amounts, timestamps, recipients, and account references for payroll payments.
  • Helps detect repeated payroll disbursements to the same individuals, multiple employees sharing the same bank account, and other anomalies indicative of ghost employees or fictitious wages.
  • Captures detailed financial transaction data, including deposit and withdrawal amounts, timestamps, involved parties, payer details, and related metadata.
  • Enables detection of overfunding patterns, such as excessive deposits above normal thresholds, and subsequent requests for partial or early withdrawals.
  • Identifies third-party payments made to policies or accounts, helping to flag unsupported relationships between payers and policyholders.
  • Facilitates tracing of layering activity across multiple institutions or jurisdictions by examining the timing and sequencing of transactions.
T0058.001
|
|

Captures details of financial transactions, including timestamps, amounts, currencies, and involved parties. These records help identify unusual wage payment patterns, large cash withdrawals, or the commingling of legitimate payroll with forced labor proceeds. By analyzing transaction flows, investigators can detect structuring or layering schemes associated with forced labor earnings.

  • Provide official transaction details, including timestamps, transaction identifiers, and amounts.
  • Cross-check these transaction records with the reference numbers and amounts on allegedly forged financial instruments to reveal mismatches indicative of document tampering.
T0144
|
|
  • Provides comprehensive details on financial transactions, including timestamps, amounts, parties involved, and account references.
  • Enables detection of unusual or repetitive transaction patterns that may indicate fraudulent funding or layering of newly acquired proceeds.
  • Facilitates verification of transaction authenticity and cross-checking against reported invoices or contracts in fraud schemes.
  • Captures all financial transactions, including timestamps, amounts, parties, and transaction IDs, across different channels.
  • Facilitates the detection of co-mingled legitimate and suspicious contributions, helping to identify layering or rapid fund movement characteristic of fraudulent fundraising schemes.
  • Captures timestamps, amounts, parties, and currency details for transactions flowing through free trade zone accounts.
  • Highlights large, round-sum, or structured transactions inconsistent with the stated business activities.
  • Reveals spikes or patterns of layering within FTZ-linked accounts compared to normal volume.

Provides itemized records of all financial transactions, including timestamps, amounts, counterparties, and references (e.g., 'storage fees'). This enables investigators to detect repeated high-value payments to freeport or private storage operators that lack apparent commercial justification, indicating potential layering or placement of illicit funds.

  • Captures timestamps, amounts, beneficiaries, counterparties, and transaction metadata for all incoming and outgoing funds.
  • Helps identify unusual increases in revenue, inconsistent transaction volumes, or other patterns indicating potential commingling of illicit proceeds within legitimate sales.
  • Provides detailed records of all deposits, withdrawals, transfers, and related metadata, including timestamps, amounts, and counterparties.
  • Enables detection of structured deposits below reporting thresholds and rapid inbound-outbound flows, directly revealing funnel account patterns.
  • Captures deposit timestamps, amounts, branch or institution identifiers, and account details.
  • Helps detect patterns of structured cash deposits below reporting thresholds across multiple locations to obscure the source of funds.
  • Facilitates monitoring of rapid or sequential deposits by multiple individuals, enabling quick identification of potential smurfing activity.
T0055.001
|
|
  • Captures comprehensive transaction details, including timestamps, amounts, counterparties, and transaction channels, for all financial movements.
  • Supports AML detection by identifying large or structured payments used to fund or liquidate gold purchases, highlighting patterns consistent with layering or integration strategies.

Logs capture all financial inflows and outflows, including timestamps, amounts, sender and recipient account details, and channels used. By analyzing transaction patterns, investigators can identify rapid transfers, layered movements, or other anomalies indicating potential misuse of government relief funds.

T0013.004
|
|

Provides a comprehensive record of deposits, withdrawals, and cross-border transfers, enabling the detection of unusual cash movements, high-frequency or structured transactions, and potentially unlicensed intermediary activity consistent with hawala operations.

  • Contains detailed records of all financial transactions, such as deposits, withdrawals, transfers, timestamps, amounts, and counterparties, for real estate or property-management accounts.

  • Allows investigators to identify patterns of commingled funds, unusual spikes in rent or service fee deposits, and repetitive transactions that may indicate layering in high-cash-flow real estate operations.

Comprehensive records of financial transactions, including note denominations, timestamps, and associated account details. Correlating the repeated use of large-value notes with cross-border activity helps detect the concealed transport of illicit funds.

  • Provides detailed records of financial transactions, including timestamps, amounts, accounts, and parties involved.
  • Enables identification of patterns such as large or frequent purchases of luxury goods or precious metals beyond a customer’s typical financial behavior, supporting detection of potential laundering through high-value asset conversions.
T0013.002
|
|
  • Provides comprehensive records of all financial transactions, including timestamps, parties, account details, transaction amounts, and identifiers.

This data helps detect Hot Transfers by identifying offsetting or reciprocal transactions with near-zero net movement, indicating potential informal value transfer arrangements.

  • Provide comprehensive records of deposits, withdrawals, wire transfers, and other account movements.
  • Enable identification of recurring structuring or layering patterns typical of trafficking networks.
  • Help detect funnel account usage and apparent co-mingling of illicit funds from forced labor or sexual exploitation.
  • Capture details on transactions (timestamps, amounts, counterparties) to identify unusual or high-risk activity linked to newly created or impersonated accounts.
  • Facilitate pattern analysis to detect abrupt large transactions soon after opening accounts with questionable identity credentials.

Captures comprehensive records of financial transactions from newly opened or existing accounts. Sudden high-value or rapid transaction patterns linked to questionable identity documentation can be identified and flagged, helping to expose potentially manipulated or fraudulent account setups.

T0145.001
|
|

Details financial transactions, including timestamps, amounts, and originating/destination accounts. By mapping the flow of timber sale proceeds, it reveals suspicious fund movements, layering, or rapid transfers commonly associated with laundering illicit logging revenues.

Comprehensive records of all financial transactions involving customers' accounts, detailing timestamps, amounts, recipients, and references. This data helps identify sudden spikes or unusual patterns in artifact-related transactions, such as private auction purchases at inflated prices.

  • Provides timestamps, amounts, and transaction channels (e.g., ATM, teller, online) for withdrawals.
  • Enables detection of structured patterns, such as multiple withdrawals under reporting thresholds, and rapid cash-outs following electronic deposits.
  • Captures detailed records of in-game financial transactions, including timestamps, amounts, counterparties, and transaction identifiers.
  • Helps detect suspicious patterns such as unusually large or rapid microtransactions, repetitive purchases of in-game currency using stolen payment methods, or swift conversions back into fiat or cryptocurrency.

Records all external financial inflows and outflows to gambling accounts, including timestamps, amounts, and counterparty details. This data enables the tracing of cross-border layering, repetitive structured deposits or withdrawals, and potential commingling of illicit funds leveraging gambling platforms.

  • Provides comprehensive records of financial transactions, including timestamps, amounts, currencies, involved parties, and transaction identifiers.
  • Supports detection of sub-agent activity hidden under the aggregator’s name and reveals anomalies in transaction volumes or patterns that can indicate unreported or high-risk payment channels.

Contains records of all financial movements, including timestamps, amounts, currencies, account details, and initiator information. This data supports AML detection by uncovering:

  • Large, round-amount transactions authorized by newly installed management without legitimate economic purposes.
  • Sudden spikes in transaction volumes or new account openings following ownership changes.
  • Unusual patterns of internal transfers or asset movements within the institution.

Such anomalies can highlight infiltration, where criminals exploit their control to conduct high-risk or suspicious activities.

  • Provide details of actual payment amounts, timestamps, and involved parties.
  • Highlight overpayments beyond contractual terms or frequent high-value transfers.

These records help detect recurring inflated payments with no corresponding refunds, a hallmark of inflated transaction pricing schemes.

Captures financial transaction details, including dates, amounts, counterparties, and account identifiers. This enables the detection of suspicious deposit-withdrawal patterns, rapid fund turnover, and concurrent contributions to multiple informal savings groups that exceed a participant’s verifiable financial profile.

  • Captures details of each financial transaction, including timestamps, amounts, counterparties, and channels.
  • Enables identification of sub-threshold structuring, multiple small deposits, or offset-based transfers—hallmarks of informal value transfer systems.
  • Supports detection of rapid movement or layering across accounts consistent with IVTS patterns.
  • Provide comprehensive records of financial transactions, including timestamps, amounts, currencies, counterparties, etc., across all channels.
  • Enable the identification of repeated manual overrides, suspiciously rapid approvals, or high-risk transaction patterns tied to specific employees, revealing potential insider collusion or bypass of established AML checks.
  • Captures all financial transactions with timestamps, amounts, currencies, and involved accounts.
  • Highlights sudden surges in conversion volume or after-hours activity, revealing potential layering or obfuscation patterns.
  • Provides detailed records of premium payments, policy surrenders, and beneficiary or policyholder changes, including timestamps, amounts, and transaction identifiers.

  • Enables detection of rapidly shifting or high-value payments characteristic of layering strategies in insurance beneficiary substitution, helping investigators trace potentially illicit account movements and analyze the funding sources behind large premium injections or surrenders.

  • Captures premium payment amounts, frequency, and timing, enabling the detection of overfunding or multiple high-value payments to insurance policies beyond typical requirements.
  • Shows funding sources, including third-party or cash-based contributions, highlighting potential layering or illicit inflows.
  • Tracks policy refunds, partial surrenders, or withdrawals, revealing suspicious early redemptions and rapid fund movements indicative of money laundering.
  • Provides detailed records of premium payments, claim payouts, refunds, and other insurance-related transactions to identify suspicious or inflated amounts.
  • Enables detection of layering schemes through frequent or structured cross-border payments.
  • Reveals patterns of early cancellations, large refunds, or partial surrenders inconsistent with typical insurance practices.
  • Provides comprehensive details of financial transactions, including timestamps, amounts, and involved counterparties.
  • Enables detection of unusual routing through intermediary accounts, repeated usage of the same intermediary, or abrupt changes in intermediary usage patterns indicative of layering.
  • Detailed bookkeeping of all deposits, withdrawals, wire transfers, and investment movements, including timestamps, amounts, and counterparties.
  • Enables detection of layering schemes, unusual fund flows, and cyclical transactions that deviate from legitimate investment patterns.
T0144.017
|
|

Provides detailed records of inbound and outbound financial transactions, including timestamps, amounts, counterparties, and account details. This data supports the detection of investment fraud by identifying suspicious consolidation of victim funds, rapid transfers to unrelated accounts, and potentially fraudulent transaction patterns.

Capture timestamps, amounts, counterparties, and transaction references. Analysis can reveal patterns of large capital inflows or outflows with no legitimate economic purpose, consistent with manipulated fund activities.

  • Provides comprehensive records of financial transactions, including timestamps, amounts, counterparties, and relevant identifiers.
  • Enables detection of suspicious transactions that match or slightly exceed CBI/RBI thresholds, monitoring of partial refunds after thresholds are met, and identification of patterns indicative of layering or concealment of funds.

Captures detailed records of deposits, withdrawals, transfers, and investment trades, including timestamps, amounts, counterparties, and associated account details. This information helps detect suspicious patterns such as large or structured deposits, unusual redemption activity, and rapid cross-border fund movements indicative of layering schemes in investment portfolios.

  • Provides comprehensive records of purchases, sales, and related financial transactions for jewelry.
  • By identifying repeat transactions of the same piece at inconsistent valuations, financial institutions can detect possible layering attempts or artificial price manipulation.

Captures financial transaction details, timestamps, involved accounts, and related metadata. When multiple departments or service providers handle segments of a transaction chain in isolation, these logs highlight segmented flows with limited cross-referencing, supporting the detection of compartmentalized processes.

Provides comprehensive records of financial transactions (e.g., deposits, withdrawals, wires). Investigators can cross-check acquisition-related flows, detect uncommonly large or frequent capital injections, and verify whether reported business income aligns with actual incoming funds when identifying potentially illicit business acquisitions.

Captures subsequent financial transactions after gambling proceeds are redeemed, including deposit timestamps, amounts, payment methods, and beneficiary account details. This helps identify patterns where illicit funds labeled as gambling winnings are consolidated or transferred to other financial accounts, facilitating the detection of layering techniques.

  • Provides a chronological record of all incoming and outgoing payments for loan disbursements and repayments.
  • Identifies suspicious patterns such as immediate defaults, closed-loop fund flows returning to the same beneficial owner, or third-party payors lacking clear ties to the borrower.
  • Supports retrospective tracing of funds to confirm whether loan proceeds are actually applied as stated or diverted to illicit recipients.
T0144.015
|
|

Captures timestamps, amounts, references, and counterparties for all financial movements, including deposits labeled as 'lottery fees' or 'prize taxes' and disbursements marked as 'winnings.' Investigators can track patterns of small incoming payments from unrelated parties and subsequent layering or structuring consistent with lottery scam operations.

T0107.001
|
|

Capture detailed records of all financial transactions, including timestamps, amounts, and payment methods. For lottery money laundering, these logs:

  • Reveal bulk cash purchases of tickets or frequent purchases in short timeframes.
  • Highlight repetitive prize redemptions near reporting thresholds.
  • Correlate sudden spikes in lottery activity with large cash deposits or other suspicious funding sources.

Transaction logs capture detailed records of loyalty point purchases, conversions, redemptions, and transfers, including timestamps, amounts, account identifiers, and cross-platform movements. These data points are critical for identifying unusual volume or frequency of loyalty point transactions, detecting cross-border or multi-jurisdiction transfers, and flagging rapid acquisition or redemption patterns indicative of layering or laundering activities.

  • Capture comprehensive details of financial transactions, including timestamps, amounts, parties involved, and transaction identifiers.
  • Facilitate direct comparison of actual transaction data with reported accounting entries. This helps detect backdated or altered financial records and identify discrepancies in recorded revenues or expenses.
T0107.005
|
|
  • Captures comprehensive transaction details, including timestamps, amounts, sources, recipients, and account information.
  • Reveals large, unexplained payments to players or officials from high-risk or flagged sources.
  • Supports tracing funds used for bribery or coercion in match-fixing schemes and identifying abnormal payment flows.
  • Provides comprehensive, timestamped records of deposits, withdrawals, transfers, and payments, including amounts, counterparty details, and transaction IDs.
  • Enables detection and aggregation of repeated small transactions under reporting thresholds, which collectively may indicate micro-structuring tactics.
  • Captures comprehensive records of financial transactions, including amounts, timestamps, currencies, and counterparties.
  • Supports detection of sub-threshold structuring or frequent cross-border wires consistent with smuggling proceeds.
  • Enables investigators to reconstruct transaction flows potentially linked to illicit migrant transportation fees.

Offers comprehensive records of fund movements, capturing timestamps, amounts, currencies, and account details. By correlating these logs with trading data, investigators can track subsequent fund transfers after mirror trades, identifying potential layering and quick cross-border shifts of illicit proceeds.

  • Records all financial transactions, capturing timestamps, amounts, parties, and account details.
  • Enables detection of improperly diverted public funds through unusual transfers to personal or third-party accounts, as well as large cross-border wires to secrecy jurisdictions.

Comprehensive records of financial transactions include declared payment purposes, timestamps, amounts, currencies, and counterparties. This data helps identify frequent or unauthorized modifications to stated fund purposes, revealing potential misrepresentation.

  • Capture timestamps, amounts, sending and receiving account identifiers, currencies, and transaction types to enable the detection of suspicious or repetitive deposits, structured amounts below reporting thresholds, and rapid in-and-out fund transfers.
  • Allow comparison of actual transaction behaviors against expected customer profiles, highlighting anomalies such as quick outbound transfers from newly opened accounts.
  • Facilitate tracing of layering or circular flows through multiple linked accounts, a hallmark of money mule exploitation.

Provides comprehensive records of inbound and outbound financial transactions, covering timestamps, amounts, currencies, and counterparties. This data helps detect frequent deposits from unconnected parties followed by quick withdrawals or transfers, as well as transaction volumes exceeding the customer's stated profile or occupation.

Comprehensive records of financial transactions, including timestamps, amounts, currencies, and counterparties, enable the detection of repeated or rapid currency swaps that indicate layering attempts. Investigators can trace the sequence and pattern of conversions used to obscure the illicit origin of funds.

  • Records cross-border and domestic fund flows, including timestamps, amounts, and involved accounts.
  • Identifies rapid layering transactions and complex routing through multiple corporate entities.
  • Correlates transaction patterns with corporate structures to spot suspicious multi-jurisdictional behavior.

Captures transaction timestamps, amounts, currencies, and involved parties. By reviewing these logs, investigators can identify multiple payments or disbursements for the same goods or services, revealing repeated billing patterns suggestive of multiple invoicing.

  • Provides comprehensive records of financial transactions, linking fiat inflows and outflows to NFT trades.
  • Enables identification of funds that enter or leave regulated channels immediately following high-value NFT sales, suggesting potential layering or integration steps.
T0023.002
|
|

Detailed cheque, wire, and digital-payment logs record both the declared payee name and the receiving account owner. Overlaying these fields exposes inconsistent spellings and evidences cheque tampering (e.g., payee line manually re-inked) that signals name-alteration abuse.

  • Provides comprehensive transaction details, including timestamps, amounts, payees, and instrument types, for each negotiable instrument purchase.
  • Enables the detection of structuring patterns, such as repetitive sub-threshold purchases or deposits, and rapid redemption across different institutions.

Logs both inbound and outbound account activity with timestamps, amounts, and references, helping to directly correlate cash introductions at borders with subsequent cryptocurrency purchases or sales indicative of NEP methods.

  • Capture deposit amounts, references to gaming proceeds, and payer details.
  • Identify payout amounts, recipients, and timestamps from gambling operator accounts.
  • Reveal inbound and outbound cross-border fund flows referencing e-wallets or prepaid cards.

These logs help detect unusual transaction patterns, such as large or frequent deposits labeled as gaming proceeds with minimal actual betting activity, and trace suspicious payouts, supporting AML investigations into potential layering of illicit funds.

Provides detailed records of all financial transactions tied to insurance policies, including timestamps, amounts, beneficiary details, and counterparties. This data helps detect irregular or rapid funding and redemption patterns indicative of potential layering and illicit fund movements through offshore insurance products.

Provide a comprehensive record of all financial transactions, including timestamps, transaction identifiers, amounts, and cross-border details. Tracking deposit frequencies, reload behaviors, and offshore flows helps uncover structuring, micro-deposits, and suspicious layering in prepaid and e-wallet accounts issued by secrecy-jurisdiction providers.

Captures detailed records of all financial transactions, including timestamps, amounts, counterparties, and account references. This data:

  • Reveals unusual or high-frequency transfers to offshore accounts.
  • Highlights cyclical fund movements, suggesting layering across multiple jurisdictions.
  • Allows comparison of the actual flow of funds against a customer’s historical profiles and stated business activities.
  • Captures detailed transaction records, including timestamps, amounts, currencies, sender/receiver details, and reference IDs, for both domestic and cross-border payments.
  • Enables detection of repeated or structured flows to and from secrecy jurisdictions, revealing potential layering and unusual routing of funds.
  • Facilitates pattern analysis to spot anomalies or deviations from a customer’s typical profile, highlighting offshore exploitation risks.
  • Records all financial transactions, including amounts, timestamps, currencies, and counterparties, covering deposits, wire transfers, and other movements.
  • Enables tracing of suspicious fund flows associated with manipulated oil invoices or shipments.
  • Supports identification of layering patterns where proceeds from falsified transactions move quickly through various accounts.
  • Provides detailed records of financial and in-game transactions, including timestamps, amounts, currency types, and account identifiers.

  • Enables detection of suspicious layering or structuring patterns where in-game tokens are acquired and rapidly converted back to fiat or cryptocurrency, facilitating early detection of potential laundering schemes.

Provides comprehensive records of incoming and outgoing transactions across financial accounts, including timestamps, amounts, counterparties, and account identifiers. By isolating large or repeated OTC-related inflows and outflows, investigators can spot patterns indicative of cash-to-crypto conversions that avoid regulated exchanges.

  • Provide comprehensive records of financial transactions, including timestamps, amounts, parties, and transaction codes, related to payroll-deduction installments.
  • Enable the detection of disproportionate or accelerated loan repayments that do not align with the borrower’s legitimate salary or normal pay cycles.
  • Contains comprehensive records of financial transactions, including deposits, withdrawals, checks, and transfers.
  • Facilitates matching of actual wage-related outflows with reported payroll amounts, identifying large cash withdrawals or unexplained transfers during payroll cycles.
  • Aids in uncovering off-the-books payments and discrepancies in reported wage expenses.
T0070.002
|
|

Comprehensive records of deposits, withdrawals, and other monetary movements across user accounts capture timestamps, amounts, account identifiers, and counterparties. These logs help correlate on-chain peel chain hops with off-chain transactions, revealing patterns of rapid micro-transfers and layering attempts.

Provides granular transaction data, enabling the detection of repeated peer-to-peer (P2P) transfers just below regulatory reporting thresholds, a common tactic for structuring.

Transaction logs capture deposit amounts, timestamps, origin accounts, and related metadata. This data helps identify large or frequent contributions that exceed the contributor’s known income and detect patterns of rapid layering or multiple rollovers across pension accounts, supporting investigations into potential illicit fund flows.

  • Tracks deposit timestamps, amounts, and counterparties, along with subsequent onward transfers.
  • Enables investigators to identify suspicious inflows soon after a victim responds to a phishing-based job offer.
  • Reveals transaction patterns consistent with money mule activity, such as near-immediate onward transfers and unexplained incoming funds.
T0144.009
|
|
  • Provides timestamps, amounts, currency types, sender/receiver account details, and transaction identifiers for all financial movements.
  • Enables detection of unusual spikes in crypto investments, frequent transfers to new wallets, and rapid outflows indicative of pig butchering scam activity.
  • Supports investigation by correlating suspicious transaction patterns with potential scam communications or high-risk jurisdictions.
T0148
|
|

Provide comprehensive records of all financial transactions (e.g., wire transfers, deposits, withdrawals). Investigators can trace ransom payments routed from insurers, shipping firms, or families to potential pirate networks, identifying suspicious transaction patterns or unexpectedly large cross-border flows that may indicate the laundering of ransom proceeds.

  • Provide comprehensive records of financial transactions and account details, including timestamps, amounts, currencies, and parties.
  • Enable detection of repeated round amounts, structured payments, or clusters of high-value deals in short timeframes, revealing potential layering or other suspicious patterns tied to inflated image rights payments.
  • Provides detailed records of financial transactions—including amounts, timestamps, parties, and routing details—that help identify large or irregular lobbying or campaign donations.
  • Enables detection of multiple reimbursements from a single source, highlighting potential straw donor schemes.
  • Assists in tracing funds routed through intermediaries or shell entities to uncover suspicious donation patterns.
T0144.019
|
|

Track all monetary inflows from new investors, outflows to earlier participants, and inter-account transfers. This enables investigators to identify the recycling of funds, short holding periods, and layering consistent with Ponzi-like operations, as well as detect the absence of genuine revenue generation.

  • Provides comprehensive records of financial transactions, including date, time, amounts, payors, payees, and transaction references.
  • Enables detection of multiple or structured commodity purchases below reporting thresholds, which may indicate smuggling or layering strategies.

Captures all inflows and outflows of funds, including timestamps, amounts, counterparties, and transaction channels, enabling the detection of:

  • Large or frequent purchases of precious metals or gemstones that deviate from a customer’s profile.
  • Rapid resale or short holding periods indicative of quick layering or integration.
  • Suspicious transaction flows potentially aimed at concealing illicit proceeds.
  • Provides comprehensive records of all financial transactions, including timestamps, amounts, and counterparties.
  • Enables detection of unusual payment patterns or incremental transfers to chemical suppliers or brokers lacking a clear business purpose.
  • Helps identify repeated small transactions, layering attempts, and structuring tactics used to obscure the procurement of precursor chemicals.

Capture comprehensive details on fund movements through accounts controlled or managed by professional intermediaries, including timestamps, amounts, counterparties, and transaction references. This helps investigators detect unusual patterns, layering, and frequent fund transfers lacking clear commercial rationale.

Provides comprehensive records of deposits, withdrawals, transfers, timestamps, amounts, and counterparties.

  • Enables investigators to correlate payment patterns with known extortion schedules.
  • Detects structuring below reporting thresholds, frequent cash deposits in high-crime areas, and immediate transfers laundered into legitimate accounts.

Provides comprehensive records of each financial transaction, capturing the initiator, time, amount, and the accounts involved. Helps detect potential proxy usage by identifying initiators who are not the registered owner or signatory and flagging patterns inconsistent with the known account holder.

T0015.002
|
|

Captures transaction origin IP addresses, timestamps, amounts, and involved parties, enabling cross-referencing of IP data against known proxy or suspicious hosting providers. This helps investigators detect potential anonymizing service usage, such as Tor, VPNs, or rotating proxies, and identify high-risk connection behaviors that mask the user’s true location.

  • Records timestamps, amounts, currencies, and IP addresses for all transactions, demonstrating when and where financial activities occur.
  • Enables detection of unusual or rapid high-value transfers originating from public WiFi hotspots, highlighting deviations from typical account behaviors.
  • Provides comprehensive records of both fiat and digital asset transactions, including timestamps, amounts, counterparties, and currency types.
  • Enables detection of abrupt shifts from traditional fiat usage to intensive cryptocurrency activity following ransom demands.
  • Helps investigators identify unusual spikes in transaction volumes or sudden changes in payment channels consistent with ransomware extortion.
  • Provides timestamps, amounts, and transaction identifiers for financial inflows and outflows, including deposits into and withdrawals from escrow accounts.
  • Assists in detecting irregular or rapidly repeated transactions linked to real estate purchases and flips.
  • Provides detailed records of remittance transactions, including sender/recipient details, timestamps, amounts, and transaction identifiers.
  • Enables detection of repeated small-value transfers from multiple senders, highlighting structuring below reporting thresholds.
  • Allows investigators to identify rapid withdrawals or cash pickups, supporting analysis of suspicious layering activities.

Capture deposit timestamps, transaction amounts, account identifiers, and subsequent fund movements to reveal repeated submissions of the same or near-identical checks and rapid outflow patterns. These logs directly aid in the AML detection of suspicious remote deposits and quick withdrawals.

Tracks financial activity post-onboarding, including transactional timestamps, amounts, and counterparties. Compares declared account profiles with actual high-value or anomalous transactions soon after remote identity setup, flagging potential laundering through newly established accounts.

T0020.001
|
|
  • Provide comprehensive records of financial transactions, including timestamps, amounts, parties, and referencing accounts.
  • In the context of remote mining, these logs help detect large or repetitive payments to hosting providers and unusual returns from unknown wallets, indicating potential laundering of newly mined assets.
  • Captures deposit amounts, timestamps, frequencies, and counterparties for rental payment transactions.
  • Enables detection of suspicious patterns, such as multiple large cash deposits exceeding market rates or clustered within a short period.
  • Facilitates identification of layering or commingling of illicit funds following the initial deposit.
  • Provides comprehensive records of inbound and outbound transactions, including timestamps, amounts, currencies, and counterparties.
  • Reveals potential romance mule activity by showing frequent incoming funds from multiple unrelated sources and rapid onward transfers with limited justification.
  • Highlights abrupt changes in transaction patterns, such as sudden increases in cross-border payments after establishing a romantic connection.
  • Consolidates information on all financial transactions, including the timing and amounts of safe deposit box rental fee payments.
  • Allows correlation of cash deposits or withdrawals with safe deposit box usage intervals.
  • Helps identify structured cash payments or other anomalies tied to the deposit box rental.
  • Provides comprehensive records of financial transactions, including timestamps, amounts, counterparties, currencies, and account details.
  • Enables detection of unusual transaction flows or persistent transfers to sanctioned entities, indicating possible sanctions evasion strategies.
  • Provides detailed records of financial transactions, including timestamps, amounts, recipients, and references describing permit or licensing fees.
  • Facilitates detection of anomalous high-value payments to newly formed or unverified entities, indicating possible reliance on forged sector-specific documentation to justify those transactions.
  • Contains transaction details (timestamps, amounts, account numbers, counterparties) for each financial movement.
  • Enables detection of large or frequent outgoing payments labeled as consultancy or management fees.
  • Assists in tracing flows of funds to shell or obscurely owned companies, revealing suspicious layering or integration of illicit proceeds.
  • Provides detailed records of all money flows, including credits, debits, timestamps, and parties involved.
  • Enables investigators to identify structuring, funnel account usage, or other suspicious patterns tied to the proceeds of forced prostitution or sexual exploitation.
T0001.001
|
|
  • Provides comprehensive records of all financial transactions, including amounts, timestamps, counterparties, and related metadata for each account.
  • Enables detection of sudden large inflows or outflows, rapid turnover of funds, or the reactivation of dormant accounts, all of which are red flags for shelf companies used to facilitate rapid layering or conceal illicit proceeds.
  • Provides comprehensive records of financial transactions, including timestamps, amounts, and counterparties.
  • Reveals suspicious layering patterns, structured deposits, or rapid fund movements associated with shell companies.
  • Enables comparison of transactions against the entity’s stated business activities to detect mismatches.
T0016.005
|
|

Provides detailed records of financial transactions, including timestamps, amounts, depositors, recipients, and channel information. This directly supports smurfing detection by:

  • Identifying numerous low-value deposits deliberately kept below reporting thresholds.
  • Aggregating transaction data to reveal hidden connections among accounts or depositors.
  • Highlighting patterns of frequent small deposits or withdrawals consistent with smurfing behavior.
  • Provide complete records of inbound and outbound transactions, including payment references or memos.
  • Reveal patterns such as multiple small inbound transfers from unrelated payers followed by quick onward forwarding.
  • Directly support AML investigations by highlighting suspicious movement of funds and unusual references connected to social media-based recruitment schemes.
  • Data elements: Comprehensive records of all financial transactions (timestamps, amounts, currencies, parties, etc.) linked to the sports club’s accounts.
  • AML Use: Allows detection of large, frequent, or unexplained capital injections and suspicious transaction patterns that may indicate inflated player fees, hidden sponsorship inflows, or other laundering tactics tied to club financing.
  • Records all financial flows labeled as sponsorship or image-rights payments, including timestamps, amounts, and counterparties.
  • Enables investigators to detect unusually large transactions, sudden spikes in club funding, or repetitive layering through multiple accounts, exposing potential money laundering patterns in sports sponsorship deals.
  • Provide comprehensive records of all transaction details, including timestamps, amounts, sources, and destinations.
  • Facilitate the identification of large, unexplained deposits or sudden capital inflows that enable manipulative stock trading.
  • Compare inbound funds with subsequent equity purchases to confirm the integration of illicit capital into market transactions.
  • Provides timestamps, transaction amounts, account identifiers, and deposit/withdrawal records for all financial movements.
  • Enables detection of multiple sub-threshold transactions conducted in quick succession or across various channels.
  • Facilitates aggregation analysis to identify total funds moved by a single user, flagging suspicious structuring patterns designed to circumvent reporting thresholds.
  • Comprehensively records transaction details, including loan disbursements, repayment amounts, and related parties.
  • Helps identify mismatched repayment patterns, phantom goods payments, or unusual flows inconsistent with legitimate trade finance arrangements.
  • Captures comprehensive records of financial transactions, including timestamps, amounts, parties, and currencies.
  • Allows investigators to identify missing entries, inconsistent transaction details, or anomalous changes that may indicate tampering.
  • Contains detailed records of all transactions, including timestamps, amounts, and counterparties.
  • Helps track potential unreported inflows of funds, cross-border transfers to concealed accounts, and suspicious layering indicative of tax evasion.
T0147.002
|
|
  • Records transaction details, including timestamps, amounts, accounts, and related metadata.
  • Enables the identification of rapid or large transfers of refunded tax proceeds to offshore or high-risk destinations.
  • Supports the detection of layering or swift fund diversion indicative of fraudulent rebate activities.
  • Captures inbound and outbound financial transactions, including timestamps, amounts, and counterparties.
  • Enables detection of sudden spikes in transaction volume or rapid fund movements before company dissolution.

This directly supports identifying short-lived shell entities used for quick laundering campaigns.

  • Provides detailed records of all financial transactions, including timestamps, amounts, parties, and transaction identifiers.
  • Enables detection of patterns where repeated small payments are followed by much larger transfers, indicating threshold probing attempts.
  • Supports identification of rapid or consecutive small transactions across multiple accounts or channels, aiding in investigating potential AML evasion strategies.

Captures all incoming and outgoing payments, including payer details, timestamps, and transaction references. This allows institutions to identify recurrent or unusual third-party payers who have no apparent relationship with the primary account holder, helping to flag potential attempts to obscure beneficial ownership.

T0144.014
|
|
  • Captures inbound timeshare-related fees or deposits from victims, including timestamps, amounts, and payor details.
  • Traces subsequent onward transfers, particularly rapid or high-volume outflows to unrelated or offshore accounts, revealing suspicious fund flows lacking legitimate timeshare resale or exit activity.
  • Enables pattern analysis of repeated inbound payments labeled as taxes, closing costs, or marketing fees.
  • Includes comprehensive records of each financial transaction, capturing timestamps, amounts, counterparties, and related metadata.
  • Enables detection of sudden surges in token purchases or repeated high-value transactions during fundraising.
  • Assists investigators in tracing subsequent money flows from the token sale to other wallets or accounts, revealing potential layering or fraudulent activities.

Captures the flow of funds associated with trade finance facilities (e.g., letter of credit proceeds) to verify whether they ultimately reach legitimate suppliers or shipping lines. Investigators can track suspicious onward transfers or layering patterns across multiple accounts and jurisdictions.

  • Captures timestamps, amounts, currencies, parties, and transaction identifiers across multiple channels.
  • Facilitates detection of micro-transactions, rapid fund flows, and layering across accounts or institutions.
  • Enables investigators to reconstruct complex transaction patterns and trace funds through multiple layers involved in transaction chaining.
  • Captures comprehensive financial transaction details, including timestamps, amounts, currencies, counterparties, and identifiers, across various channels.
  • Facilitates the detection of frequent or unexplained invoice adjustments, circular fund flows, and other anomalous inter-company transfers indicative of manipulated transfer prices.

Contains records of deposits, withdrawals, transfers, and other account activities, including timestamps, amounts, parties, and transaction identifiers. This data:

  • Facilitates comparison between actual cash inflows and the income declared in financial statements or tax filings.
  • Flags recurring high-value deposits or transactions inconsistent with an individual's stated occupation or salary range.
  • Highlights suspicious patterns of deposits labeled as 'business income' from entities lacking formal registration.
  • Captures comprehensive financial transactions across accounts, including timestamps, amounts, parties, and transaction types.

  • Reveals external flows of funds into or out of suspected gambling operations, highlighting unusual transfers or large cash movements tied to suspected underground venues.

  • Provide comprehensive records of transactions, including deposit amounts, timestamps, payer/recipient details, and transaction identifiers.
  • Enable detection of suspicious patterns, such as sudden settlement spikes, repetitive small-value deposits, or the commingling of multiple merchants’ funds into a single TPPP/aggregator account.
  • Support uncovering unusual refund or credit activities indicative of illicit mixing of proceeds.

Detailed records of financial transactions capture unemployment benefit deposits, enabling the detection of unusual patterns such as multiple benefit payments from different jurisdictions to the same account, concurrent wage and benefit deposits, or sudden spikes in government credits. This data is critical for identifying potentially fraudulent claims.

T0013.001
|
|
  • Tracks all financial movements, including deposits, withdrawals, wire transfers, and remittances.
  • Enables pattern analysis to uncover unusually high volumes or repetitive transfers linked to unlicensed MSBs.
  • Helps detect cash-heavy or off-the-books transactions that bypass regulated channels.

Provides comprehensive records of financial transactions, including amounts, timestamps, origin and beneficiary accounts, and payment instruments. This enables investigators to identify large or irregular payments processed through unlicensed brokers, detect transactions from unrelated overseas accounts, and trace flows of funds that bypass standard AML checks.

  • Provides comprehensive records of financial transactions, including timestamps, amounts, origin and beneficiary account details, and references.
  • Detects suspicious changes in vendor payment instructions or unusual layering and funneling of stolen funds.
  • Helps reveal anomalies in payment patterns consistent with vendor impersonation.

Captures all account and transaction details, including timestamps, amounts, currencies, and counterparties. This enables the detection of frequent high-value or cross-border transfers initiated by entities lacking any physical presence. Such patterns can indicate potential layering or integration efforts characteristic of virtual company structures.

  • Provides complete records of deposits, withdrawals, and transfers, capturing timestamps, amounts, and IBAN references.
  • Directly supports the detection of repeated usage of multiple virtual IBAN references, unusually short holding periods, and rapid fund layering outflows, enabling targeted AML investigations.
  • Records the details of financial transactions, including timestamps, amounts, sending and receiving account data, and source IP information.
  • Helps investigators identify high-value or structured transactions initiated from VPN endpoints.
  • Supports unraveling layered funds by correlating masked IP addresses with suspicious transaction patterns.

Provides detailed records of both in-game and external financial transactions, including timestamps, amounts, parties, and transaction IDs. This data enables the identification of unusual patterns, such as numerous small-value card charges, rapid conversions to or from in-game currencies, or cross-platform item trades, which may indicate potential money laundering through virtual worlds.

  • Captures detailed financial transaction data (e.g., timestamps, amounts, currencies, parties) across various channels.
  • Enables identification of unusual or structured payment patterns indicative of layering or commingling proceeds generated from illicit wildlife trafficking.
  • Supports tracing the flow of funds across accounts and institutions for investigative follow-up.
  • Captures all wire transfers, including timestamps, amounts, currencies, and counterparties.
  • Enables pattern detection of multiple, rapid wire transfers across accounts or jurisdictions indicative of layering.