Bank Accounts

• Shell companies often open business bank accounts to channel illicit funds under the guise of corporate revenue or capital injections.
• Routing proceeds through multiple shell-owned accounts across different jurisdictions obscures transaction trails and complicates beneficial ownership inquiries.
• Criminals leverage the apparent legitimacy of corporate banking to layer and integrate dirty money into the financial system without drawing suspicion.

• Many shelf companies come with pre-existing bank accounts, allowing criminals to quickly funnel or layer illicit funds under the guise of an established business.
• The account’s operating history and 'aged' corporate record reduce scrutiny from financial institutions, making large or irregular transactions appear as part of normal business activity.
• Ownership transfers can be rapidly arranged without triggering heightened due diligence, thus masking the true source of the funds.

• Temporary shell companies are quickly incorporated to open business bank accounts and receive illicit funds, such as fraudulent tax refunds or invoice payments.
• Criminals move these funds out via transfers or withdrawals in a short span, then dissolve the company and abandon the account.
• This rapid activity and subsequent closure hinder investigators' efforts to trace transactions or identify beneficial owners once the entity no longer exists.

• Criminals establish bank accounts under shell companies or layered corporate entities across different jurisdictions to funnel and obscure illicit proceeds.
• Variations in AML/KYC requirements among multiple countries allow opening accounts with minimal scrutiny, facilitating complex layering and movement of funds under the guise of legitimate corporate transactions.

• Criminals direct complicit or unwitting intermediaries to open bank accounts in the intermediary’s name, routing illicit funds through these accounts.
• This arrangement obscures the true owner and adds a layer of separation between the criminal and suspicious transactions.
• Bank accounts held by legitimate third parties complicate beneficial ownership tracing for investigators.

• Perpetrators open or misuse existing bank accounts to receive frequent structured cash deposits.
• By dispersing deposits across multiple branches or accounts, criminals obscure the funds' true origin and circumvent detection triggers such as large-sum reports.
• Subsequent intra-account transfers further complicate the audit trail, assisting in layering the illicit funds.

• Criminals deposit bribe payments into a bribe-taker’s personal or business account under innocuous labels (e.g., 'consulting fees' or 'family support').
• Once inside a bank account, these funds blend with legitimate income, making explicit links to corrupt activity less evident.
• Using ordinary banking channels helps disguise illicit inflows among routine financial transactions, impairing AML detection.

• Criminals receive and transfer funds linked to over- or under-invoiced trade transactions through bank accounts, disguising illicit inflows as legitimate commercial payments.
• By routing these manipulated trade proceeds into multiple accounts, offenders layer funds, making it more difficult for financial institutions to detect the underlying criminal origins.

• Criminals open bank accounts in the names of shell companies or offshore vehicles, making it difficult for investigators to identify the true controller.
• Multi-jurisdictional account setups exploit varying disclosure requirements and secrecy laws, effectively distancing illicit proceeds from their real owner.
• Nominee directors and minimal documentation allow criminals to maintain control without appearing in official banking records.

• Fictitious rental income from laundered properties is deposited into bank accounts, giving the illusion of legitimate revenue streams.
• Criminals use multiple accounts or frequent transfers to layer funds, distancing them from their original illicit source while maintaining an appearance of normal cash flow tied to real estate operations.

• Construction-related shell companies open multiple bank accounts to receive and move funds derived from inflated contracts or questionable investors.
• By circulating funds among these accounts—often across different entities or jurisdictions—criminals layer and conceal the illicit source.

• Illicit proceeds are channeled into property management or business bank accounts alongside legitimate revenue streams.
• Splitting deposits among sub-accounts and vendor accounts helps conceal abnormal spikes in balances.
• This layering tactic impedes financial oversight, masking the origin of the criminal funds as normal operational income.

• Criminals route illicit proceeds through offshore or multiple bank accounts to fund foreign property acquisitions.
• Minimal transparency requirements in certain jurisdictions allow layering and integration by distancing funds from their illicit origins.
• These accounts provide the liquidity needed for cross-border transactions while shielding beneficial owners behind complex transfer chains.

• Offenders deposit the purported rental payments into bank accounts connected to real estate operations, commingling illicit funds with legitimate revenues.
• Structured deposits and withdrawals are employed to avoid detection while creating the impression of stable monthly rents, hindering source-of-funds traceability.

• Criminals recruit money mules and instruct them to open or use existing personal or business bank accounts under the mule’s own credentials.
• Illicit funds are deposited into these accounts and quickly transferred onward, layering the transactions and concealing the true controller.
• The legitimate appearance of routine banking activity helps evade immediate suspicion from financial institutions.

Criminals or their mules open bank accounts using falsified or incomplete documentation and then link these accounts to regulated exchange profiles. By transferring illicit funds into or out of these bank accounts under multiple account holders, they embed illicit proceeds within normal banking flows, creating layers of transactions that obscure the true source and beneficiary.

• Illicit funds are quickly withdrawn as cash from bank accounts and then deposited into crypto ATMs, creating an additional layer between the illicit source and the converted cryptocurrency.
• The rapid withdraw-and-deposit cycle makes it harder for financial institutions to track the movement of funds, facilitating layering.

• Once a casino-issued check is obtained, mules or associated parties deposit these checks into various personal or corporate bank accounts, further distancing the funds from their illicit origin.
• The bank deposit step leverages the veneer of legitimate gambling winnings, reducing suspicion from financial institutions.
• Distributing checks across multiple accounts complicates tracing efforts, aiding in layering and potential integration into the legitimate economy.

• Criminals use forged personal or corporate identification documents to open accounts in fictitious names or with misrepresented entities, bypassing standard KYC checks.
• They may submit falsified bank statements or references to mask illicit inflows, making suspicious transactions appear legitimate and hindering compliance oversight.

• Criminals deliberately edit digital transaction logs and account statements, removing or altering suspicious credits and debits to evade automated detection.
• Forged bank confirmation letters and other supporting documents align with the manipulated logs, making illicit inflows appear legitimate in compliance checks.
• Weak or bypassed audit trails enable tampering without timely discovery, frustrating oversight and due diligence.

• IVTS operators maintain accounts in different jurisdictions to settle cross-border obligations off the formal radar.
• Funds are deposited into or withdrawn from these offset accounts without rigorous customer due diligence.
• Repetitive credits and debits across multiple jurisdictions mask the true flow of illicit proceeds, complicating bank and regulatory oversight.

Unlicensed MSBs often channel deposits or wire transfers through personal or corporate bank accounts without disclosing their money service activities. By mixing legal and illegal proceeds in the same accounts and avoiding mandated KYC or suspicious transaction reporting, they obscure the traceability of clients’ funds and facilitate layering.

• Hawaladars routinely maintain pooled or personal bank accounts to collect illicit proceeds from clients using fictitious or third-party names.
• Because hawala transactions are trust-based and lack formal documentation, criminals exploit these accounts to obscure beneficial ownership, bypassing traditional KYC and AML checks.
• The absence of detailed records hinders investigators in tracing the origin of the deposited funds or linking them to criminal activity.

• Brokers or their intermediaries deposit illicit US dollars into bank accounts to pay foreign suppliers for goods.
• Commingling these funds with normal business transactions obscures their criminal origin, presenting them as routine transfers.
• This layering tactic makes it difficult for investigators to distinguish illicit proceeds from legitimate commercial activity.

• Illicit funds are funneled into bank accounts in Southeast Asia to pool proceeds outside of direct scrutiny.
• From these accounts, criminals withdraw cash or conduct transactions to purchase goods, masking the original source of funds.

Front companies open one or more business-current accounts that receive both genuine customer takings and criminal cash or wires; daily deposits, merchant settlements, and payroll debits create the appearance of normal activity, while the account provides the essential conduit for layering and later distribution of commingled funds.

• Illicit proceeds are deposited into legitimate-looking business bank accounts under the pretext of normal revenue or capital injections.
• Daily transactions from genuine customers mask illegal inflows, blending them with legitimate cash flows.
• The credible façade of a functional business bank account complicates detection, facilitating the layering of dirty funds as part of ordinary operational activity.

• Criminals operating fictitious call centers establish business bank accounts in the name of the sham entity to receive funds from defrauded victims.
• They label these deposits as legitimate service fees for telemarketing or support, blending illicit proceeds with purported business income.
• The routine appearance of client payments through bank accounts conceals suspicious origins, complicating scrutiny by financial institutions.

• Fictitious consulting firms open business bank accounts to receive purported advisory fees, allowing criminals to deposit illicit proceeds under the façade of legitimate services.
• The intangible nature of consulting makes it difficult to verify whether actual work was performed, enabling the layering of funds across multiple jurisdictions.
• By channeling funds through these accounts, perpetrators seamlessly blend illicit cash with any genuine transactions, complicating AML oversight.

• Criminals open or control agribusiness bank accounts, co-mingling illicit proceeds with payments for seeds, equipment, or farm labor.
• Government agricultural subsidies or grants flowing into the same accounts legitimize large deposits, obfuscating suspicious inflows.
• Routine operational transactions and purported farm-related expenditures layer illegal funds under everyday business activity.

• Criminals deposit illicit proceeds into the fictitious jewelry business’s bank account under the guise of legitimate sales.
• By blending illegal funds with purported commercial revenue, they obscure the true source, effectively integrating the money into regular financial flows.

• Illicit funds introduced as production budgets, sponsorships, or ticket sales are deposited into the entertainment venture’s bank accounts.
• Because entertainment revenues can fluctuate greatly, large deposits may not immediately raise red flags.
• Complex or cross-border entertainment transactions (e.g., licensing, co-productions) further obscure the origin of these funds once housed in a bank account.

• Criminals deposit illicit proceeds into personal or corporate bank accounts while underreporting these funds on tax returns, presenting them as lower or fictitious revenue streams.
• Multiple domestic or offshore accounts help obscure the true origin and volume of funds, making it harder for tax authorities to match declared income with actual deposits.
• By intermingling illicit funds with legitimate business cash flow, criminals reduce visible taxable income and conceal illegal proceeds within routine banking activity.

• Criminals connect to online banking platforms through Tor or multi-hop VPNs, concealing their real IP addresses.
• This bypasses institution-level geolocation or device-fingerprint checks used to detect suspicious login patterns.
• Repeated high-value or cross-border transactions remain harder to tie to a specific physical location, complicating AML investigations.

• Criminals use VPNs to obscure their true IP addresses and bypass geolocation checks when opening or accessing bank accounts remotely.
• By posing as legitimate users from acceptable jurisdictions, they circumvent location-based AML controls, enabling them to deposit and layer illicit funds with reduced scrutiny.
• This tactic makes it harder for financial institutions to identify suspicious cross-border activities or detect account usage inconsistencies tied to high-risk regions.

• Criminals connect to online banking portals through proxy servers to mask their actual IP addresses and circumvent geo-restrictions or suspicious login alerts.
• By frequently switching proxy endpoints, they avoid consistent location tracking and disrupt risk-based monitoring, effectively concealing the real origin of deposits or transfers.

• Criminals connect to online banking portals from public WiFi hotspots, obscuring their true IP addresses and circumventing traditional device or location-based red flags.
• By rotating across multiple shared networks, they hinder efforts to reliably identify customers, complicating beneficial ownership tracing and transaction monitoring.

• Criminals use multi-hop VPNs to obscure their real IP addresses and geolocation during online account creation and ongoing transactions.
• This bypasses location-based AML controls and makes it more difficult for banks to detect suspicious cross-border activity or inconsistent login patterns, complicating efforts to trace illicit fund flows.

• Offenders deposit multiple low-value amounts into bank accounts, each below automated monitoring triggers for suspicious or large transactions.
• They often use multiple accounts or shell/nominee accounts, making it difficult for financial institutions to detect the overall volume of illicit funds when viewed in isolation.

• Criminals deposit illicit funds in numerous small increments—each below local reporting thresholds—into multiple bank accounts. This prevents triggering automatic reporting mechanisms tied to larger deposits.
• They often coordinate multiple depositors, known as "smurfs," to spread these micro-deposits across different banks or branches, further reducing the likelihood of detection.
• Each individual transaction appears benign, but aggregated amounts can be substantial once consolidated or transferred again.

• Criminals exploit unsuspecting bank accounts by depositing illicit proceeds under the guise of normal inbound remittances.
• The recipient, genuinely expecting funds, often does not question these credits, allowing illicit money to blend seamlessly with legitimate transfers.
• Multiple small or structured deposits further evade detection, leveraging weak verification of third-party deposits.

• Sub-threshold ATM deposits feed directly into a linked bank account, allowing illicit proceeds to be commingled with legitimate funds.
• Once in the account, criminals can conduct subsequent transfers or withdrawals to further obscure the transaction trail.
• The reliance on self-service ATM channels circumvents more rigorous in-person branch monitoring, aiding the layering process overall.

• Smurfs maintain multiple bank accounts, often under different names or at various institutions, to deposit or transfer funds in amounts below mandated thresholds.
• Distributing what would otherwise be a large sum across numerous accounts obscures the true volume of illicit proceeds, preventing immediate detection by financial institutions.

• Criminals exploit the dedicated bank accounts of charitable organizations by depositing illicit funds labeled as regular donations.
• Once these funds enter the non-profit’s main account, they are commingled with legitimate contributions, making it challenging for authorities to identify illicit origins.
• Complicit management can further disguise withdrawals or transfers as operational expenses, layering illicit proceeds under a charitable veneer.

• Criminals open or control bank accounts under the nonprofit educational institution’s name to receive large donations, scholarships, or tuition payments from illicit sources.
• The institution’s philanthropic reputation deters deeper scrutiny, allowing criminals to distribute proceeds across multiple accounts and mask beneficial ownership.

Employees with authority over account openings and maintenance can create accounts under false identities, circumvent beneficial ownership checks, or downgrade the risk classifications of suspicious clients. By quietly approving high-risk transactions or suppressing automated red flags, they help launder illicit proceeds through routine banking channels.

• Fictitious vendor entities open or register business bank accounts to receive payments for sham invoices.
• By blending these transactions with legitimate outflows, criminals disguise the origin and destination of illicit funds, making ordinary operating expenses appear valid on the books.
• The ability to commingle lawful and unlawful payments within one account compounds tracing difficulties for financial institutions.

• Criminals use stolen or forged identity documents to satisfy KYC requirements and open both personal and business bank accounts under false credentials.
• Once operational, they deposit illicit funds and move them through multiple transfers or deposits to create layers, making the true beneficial owner difficult to identify.
• By holding accounts in different fabricated identities, they further reduce the likelihood of being linked to the underlying criminal activity.

• Criminals submit fake or stolen identification documents when opening or updating bank accounts, circumventing standard KYC checks that rely heavily on ID verification.
• Once approved, they deposit or transfer illicit proceeds under these false identities, preventing financial institutions from linking the funds to their true owners.
• This enables layering and integration of illegal funds with minimal scrutiny, as the account details appear legitimate at face value.

Aliases or slight spelling changes enable new current or savings accounts that hide historical alerts tied to the customer’s original name.

• Criminals use different passports to open separate bank accounts in the same or multiple jurisdictions.
• Presenting alternate national identities circumvents routine KYC checks that rely on matching personally identifiable information.
• Illicit proceeds are then distributed across these accounts, masking the ultimate beneficial owner and complicating investigations into consolidated financial activity.

• Criminals open new bank accounts using newly acquired CBI/RBI identities, depositing illicit funds while representing them as legitimate personal or business assets to meet investment requirements.
• Once a new passport or residency status is granted, these accounts bypass the heightened scrutiny associated with the launderer's actual background, enabling cross-border transfers with reduced due diligence.

• Criminals inject illicit funds into the sports club’s business account by falsely labeling them as legitimate ticket sales, merchandising proceeds, or sponsor payments.
• Because these deposits appear to be routine revenue streams, financial institutions often treat them as normal operational inflows, reducing scrutiny.
• This direct placement of illegal capital into official club finances obscures the origin of the funds, facilitating their eventual integration.

Automated scripts spread one lump-sum across dozens of owned or mule bank accounts, scheduling sub-threshold transfers that mimic ordinary activity; each account acts as a transient hop, turning the banking system’s speed and “pass-through” capability into a layering conveyor-belt.

• Criminals establish merchant or business bank accounts linked to their e-commerce storefronts to receive proceeds from sham sales, inflated refunds, or fabricated orders.
• By mixing illicit earnings with legitimate online transactions, they create a layered flow that appears to be standard commercial income, making it harder to detect the criminal source of funds.

• Criminals funnel illicit proceeds into a bank account designated for payroll deposits, falsely representing that money as legitimate wages.
• Automated payroll-based deductions then repay the loan, disguising the source of funds by blending them with genuine salary flows.
• This layering tactic exploits the routine appearance of payroll transactions, reducing scrutiny of recurring outgoing payments.

• Shell or front companies maintain accounts in various jurisdictions to receive payments tied to falsified trade documentation, commingling illicit proceeds with legitimate commercial flows.
• Cross-border transfers between these accounts appear as normal trade settlements, yet actually facilitate large-scale layering of misrepresented funds.

• Shell or front companies open bank accounts to receive payments from bogus sales transactions, presenting dirty money as routine business inflows.
• Funds derived from false invoices or staged auctions are deposited as normal operating revenue, complicating scrutiny by financial institutions.

• Criminals initiate small deposits or withdrawals to identify the transaction amounts or frequencies that trigger enhanced scrutiny or alerts.
• By monitoring the bank’s response, they learn how to stay under the radar and later aggregate larger sums without triggering the bank’s AML controls.

• Criminals deposit illicit funds into a legitimate business's bank account under the guise of operating revenue or capital contributions, blending dirty money with the company's legitimate finances.
• Because these accounts are routinely used for normal commercial transactions, the illicit origin of deposited funds is obscured, complicating AML detection efforts.

• Proxies open and manage accounts on behalf of the true principal, diverting scrutiny away from the real source and ownership of funds.
• Delegating signing authority to a proxy hides the identity of the actual controller, complicating due diligence by financial institutions.
• This arrangement allows illicit funds to be deposited, transferred, or withdrawn under another individual’s name.

• By rapidly cycling illicit proceeds among multiple bank accounts—often held across various jurisdictions—criminals create a convoluted audit trail that obscures the original source of funds.
• The repeated transfers serve to layer and reroute capital, frustrating detection by financial institutions.

• Criminals deposit or transfer illicit funds into bank accounts while falsely labeling them for legitimate personal or business purposes (e.g., consulting fees, rental income, family gifts).
• By submitting misleading documentation or explanations, they mask the true origin and nature of the funds, reducing scrutiny from financial institutions.

• Collusive arbitration awards are paid from one bank account to another, disguising illicit transfers as legitimate legal settlements.
• The purported losing party transfers large sums to the winning party’s account under the pretext of fulfilling the arbitral award, reducing suspicion among financial institutions.
• Documentation referencing an arbitration decision further validates the transaction, helping criminals integrate illicit funds into the legitimate financial system.

• Criminals orchestrate fraudulent or coerced legal proceedings that 'award' them large sums. These funds are then deposited into bank accounts, appearing to originate from legitimate court-ordered settlements.
• Because bank accounts are recognized as standard repositories for legal payouts, the court's ruling grants the illicit funds a seemingly lawful basis, reducing suspicion from financial institutions.

• Criminals deposit proceeds from contraband cigarette sales into personal or corporate accounts, often in small or structured amounts to avoid reporting thresholds.
• They leverage front businesses or legitimate enterprises to co-mingle illicit funds with lawful income, obscuring the proceeds’ origin.
• Transfers across multiple domestic and offshore accounts layer and disguise the source of smuggling profits, hindering detection by regulators.

• Once cash or electronic transfers are extorted, perpetrators often deposit the funds into personal or front-company bank accounts.
• They label these coerced payments as ordinary business proceeds or personal transactions, commingling them with legitimate deposits.
• Rapid intra-bank or inter-bank transfers then layer the funds, further complicating the trail and hindering detection by financial institutions.

• Offenders deposit extorted funds into personal or business accounts under the guise of ordinary revenue.
• Recurring structured deposits, such as small and frequent amounts, reduce suspicion and impede detection.
• Transferring funds across multiple linked accounts further masks their origin, making it difficult for authorities to trace the payments back to extortion.

• Criminals falsify or backdate entries to show phantom deposits and withdrawals in company bank accounts, aligning these fabricated movements with manipulated invoices or accrual adjustments.
• By reflecting non-existent transactions in official ledgers, they create a misleading financial narrative that conceals the true origin and destination of illicit funds.
• These bogus records frustrate AML efforts by presenting seemingly legitimate account activity that is difficult to distinguish from real customer transactions.

• Corrupt public officials divert or deposit misappropriated government funds into personal or third-party bank accounts, bypassing standard controls.
• They often employ multiple or 'funnel' accounts across different institutions, layering funds to conceal their illicit origin.
• Bank accounts offer high liquidity and broad financial integration, making subsequent transfers to other assets appear legitimate.

• Employers deposit or aggregate illicit funds into business bank accounts and then make sizable withdrawals around payroll dates.
• These withdrawals are falsely attributed to wage payments, allowing criminals to mask unlawful outflows as legitimate labor costs.
• By mixing legitimate revenue with illicit deposits, the resulting cash withdrawals appear routine, further obfuscating the movement of criminal proceeds.

• Once smurfs deposit small amounts of cash into separate bank accounts at various branches, the funds can be swiftly transferred or aggregated elsewhere.
• Normal transaction monitoring may fail to link these geographically dispersed deposits to a single criminal operation.
• The ability to hold multiple accounts in different locations makes it easier to compartmentalize and layer illicit funds, reducing the likelihood of detection.

• Once TITO vouchers are redeemed for cash or checks, criminals deposit the proceeds into bank accounts as purported gambling winnings.
• Financial institutions typically regard verified casino payouts as legitimate, enabling launderers to integrate illicit funds with minimal suspicion.
• These deposits complete a layering step by transforming illicit cash into apparently legitimate account balances.

• Illicit proceeds are initially deposited into personal or corporate bank accounts and then paid out as campaign donations or lobbying fees.
• Multiple accounts across different financial institutions or jurisdictions obscure the origins of funds, circumventing donation limits or identity checks.
• Official bank transfers lend a veneer of legitimacy, reducing immediate suspicion while quietly integrating criminal proceeds into the political financing system.

• Criminals deposit proceeds from illegal environmental activities (e.g., unauthorized logging or mining) into accounts nominally operated by front or shell companies.
• By mixing illicit funds with legitimate revenues, they obscure the original source of proceeds and begin layering through additional transfers.
• Standard banking channels, including cross-border wires, help disguise the illicit origin of transactions under legitimate business operations.

• Human traffickers open multiple bank accounts under the names of shell or front companies (e.g., bars, massage parlors), depositing funds from forced labor or sexual exploitation alongside legitimate revenues.
• They structure deposits below reporting thresholds or use funnel accounts across jurisdictions, making it difficult to trace the original illicit source.
• Repeated inter-account transfers further layer the funds, masking the links to trafficking victims and complicating oversight by financial institutions.

• Criminals deposit withheld or underpaid wages from forced labor into business bank accounts, falsely labeling them as legitimate payroll or operating income.
• Multiple accounts are often opened under different names or entities, enabling layering that conceals the origin of funds.
• Because banks typically rely on self-reported business activity, these illicit proceeds can blend with genuine transfers, complicating detection by financial institutions.

• Criminals operating sexual exploitation rings deposit illicit funds into personal, business, or funnel bank accounts, sometimes distributing the deposits below thresholds to evade AML scrutiny.
• By using vague transaction references (e.g., 'entertainment' or 'events'), traffickers mask the true nature of income and commingle legitimate with illicit funds.
• The ease of opening accounts in multiple names or jurisdictions facilitates layering and complicates law enforcement efforts.

• Traffickers open or control multiple bank accounts, sometimes using fraudulent identification documents or shell entities, to deposit and move illicit proceeds.
• By intermingling legitimate and criminal funds or making frequent small deposits, they layer illicit child exploitation revenue, impeding straightforward tracing efforts.

• Smuggling organizations deposit illicit cash into personal or commercial bank accounts under the guise of legitimate earnings.
• Structured deposits, kept below reporting limits, mask the illegal origin of funds, blending them with normal business transactions.
• Funnel accounts aggregate proceeds from multiple locations, complicating efforts to trace the source of smuggling revenue.

• Professionals open or manage bank accounts (e.g., escrow, corporate, or client accounts) in names other than the criminals', lending an appearance of legitimacy.
• Illicit funds are funneled through these accounts, using the intermediary's credibility to reduce scrutiny.
• Multiple account transfers and cross-jurisdictional layering obscure the money trail, hampering standard KYC and transaction monitoring measures.

• Criminals transfer illicit funds across borders into local bank accounts, labeling them as inbound foreign capital injections.
• By routing these wires through overseas entities, they obscure the true origin and ownership of the funds.
• The placement stage is disguised as routine foreign investment, circumventing stricter domestic scrutiny of large deposits.

• Criminals establish bank accounts in the name of an investment company, depositing illicit funds disguised as legitimate capital under ordinary portfolio management.
• By routing funds through multiple jurisdictions and claiming rebalancing or cross-border investment flows, they obscure the original illicit source.
• Commingling dirty money with legitimate investor contributions causes transactions to appear ordinary, impeding AML scrutiny.

• In high-risk jurisdictions, banks often have weaker customer due diligence standards, allowing criminals to open or maintain accounts with minimal scrutiny.
• Funds can be quickly transferred between multiple accounts in secrecy-friendly locations, making it harder for authorities to trace the true origin or beneficial owner.
• Bank secrecy laws and limited disclosure requirements in these regions hide the identity of illicit operators, inhibiting cross-border investigation and enforcement efforts.

• Offshore gambling businesses maintain accounts in secrecy-friendly jurisdictions, receiving illicit deposits labeled as 'gaming revenue' or disbursing them as 'winnings.'
• Minimal disclosure requirements and rapid cross-border transfers hinder law enforcement efforts to trace and identify beneficial owners behind suspicious transactions.

• Criminals open accounts in offshore jurisdictions with strict banking secrecy laws to layer and obscure illicit funds.
• By routing transfers through multiple accounts under different company or trust names, they create complex transaction chains that hinder investigators from tracing the source.
• Minimal disclosure requirements in these locations further conceal beneficial owners, facilitating repeated cross-border movement of illicit proceeds.

• After layering NFT transactions across multiple wallets, criminals liquidate proceeds into bank accounts under the guise of legitimate art or collectible sales.
• Deposits from NFT sales appear as conventional business income, allowing illicit funds to blend seamlessly with lawful financial flows.
• Traditional banking destinations complete the final integration step, presenting disguised funds as legitimate earnings.

Criminals exploit business or personal bank accounts to launder illicit proceeds disguised as legitimate payroll disbursements. For example:

• They set up direct deposits for ghost employees or padded wages, funneling extra funds into accounts they control.
• By mixing these inflated payroll entries with genuine salaries, the illicit transactions appear routine in bank statements, reducing AML red flags.
• Multiple accounts may be used across mini umbrella companies to remain under reporting thresholds, further obscuring suspicious activity.

• Multiple bank accounts in diverse jurisdictions receive or send funds labeled as payments for non-existent cross-border trade.
• By routing transactions through accounts that appear linked to legitimate invoicing, criminals conceal the illicit nature of their activities.
• Variations in AML standards across countries make it challenging to detect that the underlying trade documentation is fabricated.

• Criminals open multiple bank accounts across different jurisdictions or financial institutions to conduct sequential wire transfers or deposits in rapid succession.
• By splitting transactions into smaller sums and distributing them among various accounts, they circumvent typical alerts and threshold reporting, creating a complex transaction chain that frustrates investigators.
• The ease of initiating cross-border wires via online banking accelerates layering and obscures the ultimate origin of illicit funds.

Criminals open or use multiple personal or third-party bank accounts, sometimes operated under shell names or false identities, to receive and hold illicit funds. They then execute a series of rapid wire transfers between these accounts across different financial institutions and jurisdictions, often splitting amounts below reporting thresholds. This layering disperses the illicit proceeds, making it difficult for investigators to track the transaction trail and identify the true origin of the funds.

• Multiple shell companies open accounts at various financial institutions to receive and disburse funds tied to letters of credit.
• The same illicit funds rotate among these accounts, with each transaction disguised as a settlement of purported trade obligations.
• By using numerous bank accounts in separate institutions, criminals fragment the transaction trail so that no single bank sees the entire circular flow, concealing the scheme’s true nature.

• Pre-shipment financing proceeds are deposited into bank accounts controlled by criminals.
• Subsequently, illicit funds are injected into these same accounts under the guise of export payments, obscuring their illicit origin.
• By blending these transactions with regular business account activity, criminals conceal the nature of the deposited funds, effectively layering the proceeds.

• Criminals instruct third parties, such as family members or associates, to deposit illicit funds into a bank account opened in the third party’s name, ensuring there is no direct link to the actual owner of the money.
• Multiple, smaller deposits by different, unrelated payers fragment the transaction trail to evade detection.
• This arrangement conceals the real beneficial ownership by making it appear that the funds belong to the nominal account holder rather than the criminal.

• Once the fraudulent advance payment is issued, criminals disperse these funds across multiple bank accounts in various jurisdictions.
• This layering, often executed through shell entities or collusive beneficiaries, obscures the audit trail and conceals the illicit origin of the proceeds obtained via manipulated letters of credit.

• Criminals submit falsified or stolen identity documents to open new accounts or take over existing ones, bypassing KYC requirements.
• Once impersonators control an account, they can deposit illicit funds or reroute victim assets under the guise of a legitimate customer.
• Law enforcement tracing is hampered, as the official records reflect the forged identity rather than the true perpetrator.

Criminals exploit remote or online account registration by submitting falsified or synthetic identity documents. Without in-person verification, they can reuse the same device or IP address under multiple aliases, manipulating digital IDs until automated systems approve new accounts. Once opened under false credentials, these accounts receive, store, and move illicit funds without raising immediate suspicion, bypassing standard AML checks reliant on accurate identity information.

• Criminals use stolen credentials to access legitimate bank accounts.
• They leverage the established transaction profile to integrate illicit funds, making them appear as normal deposits or withdrawals.
• Swiftly adding new payees or updating contact details under the compromised owner’s profile enables rapid transfers to external accounts without triggering typical AML scrutiny.

• In syndicated trade loan schemes, disbursed funds are channeled into multiple bank accounts across participating lenders or affiliated entities.
• Criminals exploit partial due diligence among co-lenders to disperse and layer proceeds, making each account’s suspicious flows less detectable.
• This fragmentation of funds across various accounts obscures beneficial ownership and complicates tracing the source of illicit money.

• Manipulated contract payments flow into business bank accounts, recorded as ordinary income or supplier payments.
• Collusive entities can route bribes and kickbacks among these accounts, blending them with legitimate transactions.
• The use of standard bank accounts gives the appearance of lawful financial activity, making it more challenging for institutions to detect suspicious flows arising from rigged bids.

• Criminals establish multi-currency or offshore bank accounts to process partial or advanced payments in various currencies.
• By cycling these transactions through multiple jurisdictions, they distort exchange rates and disguise the true origin of funds under the appearance of routine foreign trade.
• The layering of funds through numerous accounts impedes traceability, making it difficult for AML systems to link payments back to illicit sources.

• Complicit MSBs maintain corporate bank accounts where they deposit illicit funds disguised as legitimate transactions. By controlling internal compliance, they avoid filing necessary reports on suspicious deposits.
• Criminals layer funds across multiple accounts and branches, making it difficult for regulators or partner financial institutions to detect unusual patterns or identify the true beneficial owners.

• Funnel accounts are bank accounts, either personal or business, used to place multiple small deposits of illicit cash.
• Once funds are deposited, fraudsters rapidly transfer or withdraw them from a different region, making it difficult for financial institutions to maintain a clear transactional link between deposits and ultimate recipients.

• Diplomatic or state-owned entity status can reduce scrutiny when opening and managing accounts, bypassing standard due diligence.
• Officials may channel large sums through these accounts under the guise of ‘official government’ operations, obscuring the true source of corruption or bribery proceeds.
• Diplomatic immunity deters deeper investigation of suspicious banking activities, facilitating layering and integration steps of laundering.

• The captive insurer maintains one or more bank accounts, receiving incoming premium payments that often originate from illegitimate sources or exceed industry benchmarks.
• Funds are then dispersed in the form of claim payouts, refunds, or other insurance-related transactions, effectively layering illicit funds under the cover of normal insurance operations.
• The use of offshore or secrecy-friendly banks further obscures transactional trails, hindering financial transparency and AML monitoring.

• Criminals deposit counterfeit currency into business or personal accounts, mixing it with legitimate cash to evade detection.
• By structuring multiple small deposits below reporting thresholds, they limit scrutiny and bypass automated monitoring systems.
• Gaps in teller training or inadequate counterfeit-detection technology can result in banks crediting these deposits as genuine funds.

• Criminals with system access can alter or delete transaction logs in bank account statements, removing evidence of suspicious inflows or outflows.
• By falsifying balances or backdating transactions, they corrupt official audit trails, making it difficult for regulators or investigators to trace illicit fund flows.
• This manipulation conceals the true origin, path, or recipient of the funds, frustrating attempts to accurately reconstruct financial activity.

Offenders use bank accounts held by shell or nominally owned companies to collect inflated consultancy or licensing fees that appear as normal business income. By routing funds through these accounts and labeling them as proceeds from contracted services, criminals integrate illicit capital into regular financial systems while obscuring the underlying criminal source.

• Fraudulent or sham loan proceeds are commonly deposited into and disbursed from bank accounts, giving them a veneer of legitimacy through documented "lending" activity.
• Criminals maintain multiple accounts—often across different jurisdictions—to layer, move, and mingle illicit funds, disguising their true origin.
• Routine account statements and normal banking processes help conceal abnormal inflows and outflows, which appear to be standard loan disbursements or repayments.

• Criminals establish or control consulting firm bank accounts that receive both legitimate client payments and illicit funds disguised as consulting fees.
• The intangible nature of the services allows funds to be deposited without raising immediate suspicion, especially when tax payments and regular documentation create an appearance of legitimacy.
• By mingling illicit inflows with genuine revenue, offenders obscure the illegal source of funds, frustrating due diligence and transaction monitoring by financial institutions.

• By controlling the bank's leadership or compliance staff, criminals can open accounts under fictitious or shell entity names without adequate KYC.
• Large amounts of illicit funds can be deposited and transferred with minimal oversight, enabling both layering and integration.
• Internal monitoring systems can be manipulated or disabled to avoid suspicious transaction reports entirely.

• Illicit outflows are disguised as routine payables by transferring funds from a legitimate business account to accounts held by fictitious creditors.
• Because vendor payments typically flow through ordinary business accounts, these transfers blend seamlessly with genuine expenses, reducing suspicion.
• Once deposited, criminals can further layer or withdraw the proceeds from the sham vendor’s account, continuing the laundering process.

• Criminals open or control respondent bank accounts where lax AML checks allow illicit funds to be deposited with minimal scrutiny.
• These funds are then transferred across borders via the correspondent bank's infrastructure, relying on the assumption that the respondent's due diligence is sufficient.
• Because the correspondent bank often does not independently validate the ultimate account holders, cross-border wires from these accounts escape deeper inspection, effectively concealing both the origin and the final beneficiaries of illicit proceeds.

• Criminals deposit or receive illicit proceeds into newly opened or rarely used bank accounts.
• They then make frequent, structured cash withdrawals (e.g., just below reporting thresholds) to avoid triggering alarms.
• This process quickly converts digital or otherwise traceable balances into physical currency, hampering investigators’ ability to trace funds once withdrawn.

• Criminals deposit purported gambling winnings into personal or business bank accounts after structuring wagers below reporting thresholds at licensed betting shops.
• By consolidating multiple small deposits, they avoid triggering AML alerts, making the funds appear legitimate.
• This layering step exploits the perception of legitimacy tied to regulated financial institutions, further obscuring the source of illicit cash.

• Criminals utilize personal or business bank accounts to deposit illicit proceeds, which are then used to fund wagers on predetermined match outcomes.
• After winning bets are paid out, the funds entering these accounts appear to be legitimate gambling earnings.
• Standard financial institutions may perceive these deposits as normal transfers from reputable betting operators, obscuring the underlying manipulation.

• Criminals channel funds generated by under- or over-invoiced oil and fuel sales into multiple bank accounts, obscuring their illicit origins under the guise of legitimate trade transfers.
• Rapid movement of these funds across accounts in different jurisdictions adds layers of complexity, making it difficult for financial institutions to detect suspicious transaction patterns.
• By commingling money from falsified oil deals with legitimate business proceeds, criminals further conceal their illicit activities.

• Sub-agents open or manage bank accounts under a principal’s licensed umbrella, receiving funds from multiple unrelated sources and structuring them below detection thresholds.
• Layering is achieved by quickly routing deposits through various agent-held accounts, fragmenting the transaction chain.
• The receiving institution sees only the aggregator’s account, effectively obscuring sub-agent and beneficial owner details.

• Independent sub-agents deposit criminal proceeds into aggregator-held or aggregator-labeled bank accounts, obscuring the true origin of the illicit funds.
• Since only the aggregator’s name appears on transaction records, details of sub-agents or end-customers remain hidden, bypassing meaningful AML scrutiny.
• This layering tactic leverages the limited oversight of sub-agents to move illicit funds under the umbrella of a legitimate institution.

• Criminals deposit illicit proceeds into accounts and request currency conversions, often transferring funds among multiple accounts or banks to layer transactions.
• After each conversion, proceeds can be swiftly wired to new jurisdictions, increasing complexity in tracing the financial trail.

• Criminals open or maintain accounts (often multi-currency) in different jurisdictions to deposit illicit proceeds in one currency and then convert them into another.
• By quickly wiring funds among multiple bank accounts, each holding different fiat denominations, they add layers of transactions that obscure the original source.
• Inconsistent AML controls across jurisdictions enable repeated conversions and transfers with less scrutiny, making it harder for authorities to trace the funds back to their illicit origins.

• Multiple bank accounts, including offshore ones, receive proceeds from carbon credit sales, compartmentalizing funds and obfuscating their origin.
• Rapid cross-border transfers between these accounts add layers of complexity, diminishing the effectiveness of AML controls.
• Criminals exploit bank secrecy laws in certain jurisdictions, making it harder for authorities to trace ultimate beneficiaries and disrupt the flow of illicit funds.

• After transporting illicit cash domestically, criminals deposit it into bank accounts in amounts deliberately kept under mandated reporting thresholds to avoid raising red flags.
• By spreading multiple sub-threshold deposits across various accounts and branches, they obscure the total volume of illicit proceeds.
• Domestic transactions often face weaker oversight than cross-border transfers, facilitating prolonged layering and integration of the funds with minimal detection.

• Criminals open or use member deposit accounts at cooperative or mutual institutions, taking advantage of lighter KYC checks or community-driven missions.
• They channel illicit funds across multiple member accounts in smaller increments to avoid raising red flags.
• Illicit deposits are disguised as purported membership contributions or social-welfare payments, masking their actual origin.
• The cooperative’s reduced oversight enables layering strategies via sub-accounts or 'hub-and-spoke' setups, making it difficult for authorities to trace funds.

• Criminals open or control multiple bank accounts in different jurisdictions with weaker AML enforcement, routing funds through successive cross-border transfers.
• By exploiting partial or delayed implementation of data identifiers (e.g., LEIs) in ISO 20022 payment messages, they mask the true origin and beneficiary details.
• These multi-jurisdictional account movements create fragmented records that hinder investigators’ ability to fully trace suspicious fund flows.

• Criminals use trusted local agents to open or control personal and business bank accounts in jurisdictions with weaker AML controls, circumventing scrutiny that foreign nationals might face.
• These agents receive, deposit, and transfer illicit funds across borders, fragmenting oversight because transactions appear to originate from legitimate local account holders.
• The layering of funds through multiple locally held accounts in different countries obscures the true owner, complicating investigation efforts.

• Criminals register corporate bank accounts in the names of virtual or intangible enterprises, concealing the true controllers behind remote or digital setups.
• These accounts receive illicit funds presented as legitimate revenue for fictional online services, complicating detection by financial institutions.
• Minimal in-person verification and the absence of physical premises enable rapid cross-border transfers and swift relocation of accounts to evade scrutiny.

• Criminals deposit illicit proceeds into these accounts and then move funds into cryptocurrency exchanges as the initial step in placing funds into digital assets.
• By structuring deposits or using third-party/shell account details, they circumvent detection measures when converting fiat to cryptocurrency.
• Once fiat is converted to crypto, further layering via multiple trades and transfers becomes more challenging to trace back to the original illicit source.

• Illicit sponsorship and image-rights payments are routed through multiple bank accounts, often across jurisdictions, to obscure money trails.
• Criminals mix legitimate sports revenues with unlawful funds, complicating beneficial ownership inquiries and AML checks related to sports finances.

• Criminals route inflated or fictitious image rights fees through bank accounts, often located in offshore or secrecy-prone jurisdictions. This enables the layering of illicit funds within routine financial transactions.
• By commingling purported sponsorship or royalty income with legitimate deposits and withdrawals, criminals obscure the true source of the funds, complicating AML detection efforts.

• Criminals register multiple business bank accounts under interlinked or shell corporate entities, integrating illicit proceeds as ostensible corporate income.
• Repeated transfers among these accounts create a complex money trail, layering funds and masking their origin.
• The legitimate appearance of business transactions in daily corporate banking activity helps conceal beneficial ownership and true fund sources.

• Criminals route illicit proceeds into corporate bank accounts controlled by shell companies, categorizing incoming funds as merger or acquisition payments.
• They move these funds across multiple accounts and jurisdictions under the guise of corporate transactions, complicating tracking efforts.
• The seemingly legitimate corporate purpose of M&A transactions helps deflect initial scrutiny from financial institutions and regulators.

• Criminals exploit misconfigured or overridden transaction-monitoring thresholds tied to bank accounts, enabling illicit funds to move undetected.
• By colluding with insider staff or abusing system vulnerabilities, they can bypass alerts or falsify data entries, hiding unusual volumes and suspicious transactions.
• This manipulation leverages legitimate bank infrastructure to obscure ultimate beneficiaries and fund origins, evading standard AML checks.

• Criminals route illicit funds from offshore or domestic bank accounts into property transactions arranged by unlicensed brokers, bypassing regulated AML scrutiny.
• Because unregistered intermediaries lack formal AML obligations, they often do not question incoming wires or verify the ultimate source of funds.
• This facilitates the seamless movement and integration of tainted money into real estate assets.

• Criminals submit stolen or forged identification documents during digital onboarding to evade standard remote verification checks and open bank accounts under false identities.
• Once established, these fraudulent accounts allow them to deposit, transfer, and withdraw illicit funds while evading conventional KYC controls.
• The ability to open multiple accounts with minimal in-person scrutiny enables layering and conceals true beneficial ownership.

• After liquidating insider-traded stocks, criminals deposit proceeds into one or more bank accounts, often under personal names or shell corporations.
• By splitting funds across different banks or jurisdictions, they layer and commingle illicit proceeds, making it harder to detect suspicious activity.
• The routine appearance of deposits and transfers in these accounts disguises the criminal origins of the funds.

• Criminals deposit undeclared funds from unregistered or informal business operations into personal or business bank accounts, labeling them as legitimate revenue or personal wages.
• Complicit or negligent accounting practices underreport these deposits, obscuring their true origin from tax authorities and financial regulators.
• Combining illicit and legitimate deposits in the same account makes it harder for institutions to detect abnormalities, as daily revenue patterns or smaller structured deposits appear routine.

Criminals recruit individuals to open new bank accounts or provide access to existing ones, allowing illicit funds to be deposited under the mule’s name. The mule then follows instructions to transfer or withdraw the funds, effectively obscuring the original criminal owner. Since the accounts are legally registered to the mule, the criminal’s direct connection is concealed, enabling layering by moving funds through multiple mule-controlled accounts.

• Criminals recruit individuals on social media under the guise of offering quick-income opportunities, instructing them to use personal bank accounts to receive illicit funds.
• Recruits then forward the money to third parties, masking the true source and complicating investigators' efforts.
• Because personal accounts generally appear less suspicious and often have lower due diligence requirements, repeated layering and transaction structuring can occur before detection.

• Criminals send deceptive job offers or financial service emails, prompting victims to open or share existing personal bank accounts under the guise of legitimate "payment processing."
• Illicit funds are then deposited into these accounts, appearing under the victim’s legitimate credentials.
• Victims, believing they are performing legitimate duties, forward these funds to other accounts at the criminal’s direction, thereby obscuring the true origin and beneficiary.
• Because the account belongs to the victim, financial institutions initially see a legitimate customer profile, making it difficult to detect the underlying criminal control and complicating law enforcement tracing efforts.

• Criminals instruct romance scam victims to open or repurpose personal or business bank accounts under emotional pretenses (e.g., 'urgent' or 'private' needs).
• Believing they are helping a trusted partner, victims overlook red flags and forward received funds, effectively layering illicit proceeds.
• By leveraging victims’ legitimate account credentials, scammers distance themselves from transactions, masking the true beneficiaries and complicating AML detection efforts.

• Criminals posing as employers instruct recruits to receive illicit funds through their personal bank accounts, falsely labeled as legitimate wages or business payments.
• Since these accounts belong to everyday individuals with no apparent criminal ties, financial institutions apply lower scrutiny at account opening and during initial transaction monitoring.
• The recruits, unaware of the funds’ unlawful origins, subsequently forward the money to third-party accounts or through remittance channels, creating additional layers and obscuring the true source.
• This use of personal accounts effectively exploits lower suspicion thresholds and leverages established customer relationships, hindering investigators’ ability to trace illicit activity.

• Adversaries open or control bank accounts—often in permissive jurisdictions—under front or shell company names, concealing sanctioned parties as the ultimate owners or beneficiaries.
• These accounts are used to route funds in or out of sanctioned regions, forging or omitting documentation to obscure the true source or destination of money.
• Weak customer due diligence and beneficial ownership controls enable offenders to bypass sanctions screening by masking who actually controls the account.

• Drug organizations regularly use funnel or multiple bank accounts to deposit illicit cash proceeds, commingling them with legitimate income.
• These accounts allow rapid transfers between jurisdictions, obscuring audit trails as funds move across various financial institutions.
• Criminals may rely on straw account holders or shell company accounts to further conceal beneficial ownership and distance the deposits from obvious criminal sources.

• Criminals deposit narcotics proceeds into bank accounts under shell or front company names, masking the true source of funds.
• They then layer payments across domestic and international accounts labeled as legitimate business expenses (e.g., ‘industrial supplies’), ultimately paying chemical suppliers without alerting financial institutions.
• The routine appearance of conventional bank wires helps camouflage the procurement of precursor chemicals among seemingly lawful transactions.

• Cross-border bank accounts are often used to layer funds derived from commodity trafficking, distancing them from the illicit source.
• Shell or front companies open business bank accounts, masking true beneficial owners and enabling purportedly legitimate commercial transactions.
• Criminals use multiple inter-account transfers, often between high-risk or secrecy jurisdictions, scattering funds so that tracking by authorities becomes more difficult.

• Proceeds from the sale of counterfeit goods are deposited into business or personal bank accounts, making them appear as normal revenue streams.
• Criminals perform repeated withdrawals and re-deposits (layering) across multiple accounts, blurring the origin of funds.
• The established legitimacy of bank accounts helps mask suspicious transactions, enabling counterfeit-related proceeds to blend with genuine earnings.

• Arms traffickers deposit proceeds from weapons sales into bank accounts held under aliases or shell entities, masking the origin of funds.
• Layering tactics, such as multiple transfers between domestic and offshore accounts, obscure transaction trails and complicate AML investigations.

• Criminals deposit or receive counterfeit pharmaceutical proceeds into personal or business bank accounts, often without raising immediate suspicion if transactions appear routine.
• They may commingle illicit funds with legitimate sales or distribute them across multiple accounts to layer transactions, complicating efforts by authorities to trace the beneficial ownership of the funds.

• Fraudsters commonly open or misuse bank accounts under real or fictitious names, often using forged identities or shell company registrations, to deposit newly generated fraudulent proceeds.
• These accounts receive funds from bogus invoices, false government disbursements, or inflated loan payouts secured under deceptive pretenses.
• Criminals then commingle illicit and legitimate funds in the same account, rapidly transferring or layering the money to reduce traceability and obscure its fraudulent origin.

• Criminals use deepfake audio or video to impersonate legitimate account holders, such as executives or customers, tricking bank personnel into releasing funds or approving transfers.
• The highly realistic voice or visual imitation bypasses typical verification measures, like voice-based identity checks or personal Q&A, leading staff to believe they are dealing with the genuine account owner.
• This deception enables unauthorized withdrawals or wire transfers, directly generating illicit proceeds under false pretenses.

• Fraudsters instruct victims to deposit or wire 'advance fees' into accounts controlled by scammers or money mules.
• Once the funds arrive, criminals immediately move them across multiple accounts or jurisdictions, creating layers that obscure the original source of the payments.

• After a rug pull, perpetrators often convert stolen cryptocurrency into fiat and deposit those funds into domestic or offshore bank accounts under false or third-party credentials.
• By rapidly moving deposits through multiple accounts, they break the transaction chain, frustrate AML controls, and conceal the origins of illicit proceeds.

• Criminals fraudulently enroll in relief programs and direct disbursements into bank accounts established under stolen or synthetic identities, or controlled by shell entities.
• Once funds are deposited, offenders rapidly initiate transfers across multiple accounts, mixing legitimate and illicit balances to obscure the original source.
• Opening these accounts in different jurisdictions further complicates AML monitoring by reducing transparency and bypassing standard KYC checks.

• Criminals fraudulently obtain relief funds and deposit them into personal or business bank accounts set up with falsified or synthetic credentials.
• They then layer these funds by splitting them into smaller transfers or commingling them with legitimate deposits, making it harder for financial institutions to spot illicit origins.
• By using multiple accounts—often under shell entities or nominees—fraudsters create a network of transactions that obscures the ultimate beneficiary and frustrates straightforward detection efforts.

• Criminals submit falsified or inflated expense claims, prompting the organization to transfer reimbursement funds into personal bank accounts.
• Since these outflows are recorded as legitimate business expenses in corporate ledgers, the diversion of funds appears ordinary, effectively laundering the proceeds.

• Criminals open multiple business bank accounts under different shell or front companies to receive the proceeds of fraudulent VAT refunds.
• These accounts facilitate the ongoing circulation of funds across related entities, making it difficult for authorities to pinpoint the scheme’s true purpose.
• By leveraging the same or multiple financial institutions across jurisdictions, fraudsters exploit inconsistent oversight and obscure the illicit origin of the money flows generated by repeated import-export cycles.

• Fraudsters direct fraudulent unemployment deposits into personal checking accounts opened under falsified credentials.
• Because these benefit payments appear to originate from a legitimate government source, they often face minimal investigation by financial institutions.
• Multiple accounts further distribute and layer the funds, complicating transaction tracing and reducing the likelihood of detection.

• Fraudsters set up bank accounts (personal or business) using stolen or fabricated identification to deposit worthless checks.
• Once the funds are credited and become available, they quickly withdraw or transfer them across multiple accounts, obscuring the transaction trail.
• The routine nature of check deposits into these accounts helps criminals evade immediate scrutiny, making it easier to move or convert illicit proceeds before the checks are returned unpaid.

• Criminals set up personal or newly opened bank accounts with minimal due diligence or misleading details, taking advantage of limited identity checks at certain financial institutions.
• They collect and consolidate numerous small donations—obtained through fraudulent social media appeals—directly into these accounts, blurring the line between legitimate and illicit proceeds.
• By co-mingling multiple donation streams and misrepresenting the purpose of the accounts as charitable, offenders conceal the funds’ origins and mask their ultimate beneficiaries.

Criminals direct fraudulent subsidy payments into business bank accounts, often under the guise of normal agribusiness proceeds. By commingling legitimate deposits with these illicit funds, the origin of subsidy proceeds becomes obscured. This blending of revenue streams complicates detection for financial institutions and regulators reviewing account inflows.

• Timeshare scammers instruct victims to wire or deposit upfront fees, labeled as taxes, closing costs, or exit fees, into the scammers’ bank accounts.
• Once received, the funds are rapidly transferred to additional accounts, frequently in offshore jurisdictions, to obscure their origin.
• Bank accounts enable swift layering of illicit proceeds using seemingly legitimate payment references, complicating financial institutions’ efforts to identify fraudulent activity.
• Scammers may also re-target previous victims, prompting repeated inbound transactions under timeshare-related pretenses, which are then commingled or dispersed across multiple accounts to further conceal the source.

Criminals instruct victims to deposit purported 'lottery fees' or 'release taxes' into personal bank accounts under their own or money mules' names. Once the funds arrive, the scammers quickly transfer or withdraw them—often in multiple smaller transactions—to other accounts or jurisdictions, creating layers that obscure the original illicit source. Continual incoming deposits from unrelated individuals remain below suspicious transaction reporting thresholds, hindering detection by financial institutions.

• Fraudsters create fictitious or shell businesses and open corresponding bank accounts, posing as legitimate employers.
• Government agencies deposit unemployment or wage benefits for nonexistent employees into these accounts, believing them to be standard payroll-related transactions.
• Because the deposits originate from an official source, banks often apply lower scrutiny, making it easier for criminals to disguise the fraudulent nature of the funds.
• The illicit proceeds are then rapidly dispersed to personal or third-party accounts, withdrawn in cash, or otherwise moved to obscure their criminal origin.

• Fraudsters instruct victims to deposit purported "investment" funds into bank accounts opened under shell companies or false identities, maintaining a façade of legitimacy.
• Once funds arrive, perpetrators layer proceeds across multiple accounts or jurisdictions, obscuring beneficial ownership and complicating any attempt at tracing.
• The ease of receiving wire transfers and conducting rapid onward payments makes bank accounts a primary conduit for storing and dispersing ill-gotten gains from investment fraud.

• Criminals impersonate a recognized vendor and instruct victims to route payments for legitimate invoices into attacker-controlled bank accounts.
• Because bank accounts can be opened under false or straw identities and quickly dispersed across multiple jurisdictions, criminals can layer and move stolen funds before the fraud is detected.
• The familiarity of routine vendor payments reduces scrutiny, enabling attackers to receive and funnel illicit proceeds in a manner that appears as normal business transactions.

Ponzi scheme operators directly receive investor contributions into bank accounts, blending hidden illicit funds with legitimate deposits. They pay out purported returns to earlier participants from the same accounts, obscuring the source of the money and complicating any attempt to distinguish criminal proceeds from authentic investments.

• Criminals deposit funds from illegal resource extraction (e.g., unreported logging or fishing) into bank accounts controlled by front or shell companies, obscuring the true origin of the money.
• The ability to commingle legitimate and illicit proceeds in standard business accounts conceals the illicit source.
• Cross-border transfers between multiple accounts in different jurisdictions further layer and disguise criminal proceeds, taking advantage of varying regulatory standards.

• Criminals deposit proceeds from unauthorized timber sales into bank accounts, often opened under shelf or front companies to obscure the true origin of funds.
• They commingle illicit proceeds with legitimate revenues, creating a seamless flow of money that appears to stem from normal timber-related business activity.
• This layering process frustrates investigations by masking the actual source of the funds and making it difficult to differentiate illicit deposits from regular commercial transactions.

• Criminals use bank accounts opened under shell or front companies to commingle illicit proceeds from wildlife trafficking with legitimate revenue, concealing their true origin.
• Funds are layered through multiple transfers across various domestic and offshore accounts, making it difficult for financial institutions to trace or detect the criminal source.

• Offenders open or utilize existing personal or business bank accounts to deposit small sums of illicit cash, blending them with legitimate transactions.
• By structuring these deposits below typical monitoring thresholds, criminals avoid red flags, especially when the accounts are linked to cash-intensive businesses whose daily receipts often fluctuate.
• This practice hinders financial institutions’ ability to distinguish illicit funds from normal account activity.

Tax evaders deposit unreported income or shift profits into personal or corporate bank accounts, often offshore, without declaring them to tax authorities. By obscuring or omitting these accounts and balances from official filings, they reduce visible taxable income. The use of multiple or foreign accounts further conceals earnings and hampers oversight by complicating tax authorities’ ability to trace and reconcile reported income.

• Offenders open or use business bank accounts under shell companies to deposit the portion of wages not submitted to tax authorities.
• Repeated deposits and withdrawals obscure the true wage base, making it harder for authorities to detect gaps between reported payroll and actual payments.
• Banks provide standard financial services (e.g., transfers, check issuance), allowing illicitly saved payroll funds to be mixed with seemingly legitimate transactions.

• Fraudulently obtained rebates are deposited into corporate or personal bank accounts, blending illicit proceeds with seemingly legitimate revenues.
• Criminals move the funds across multiple accounts, often under shell or nominee entities, obscuring their origin through layering.
• These transactions create the appearance of ordinary business activities, making it harder for financial institutions to detect the fraudulent gains.

• Payments from inflated exports are deposited into bank accounts, commingling illicit proceeds with ordinary trade revenue.
• The surplus beyond actual production costs remains disguised as legitimate incoming funds.
• By routing these funds through routine accounts and subsequent transfers, criminals conceal the illegal origins under normal commercial transactions.

• After receiving ransom payments, criminals may deposit or transfer funds into multiple bank accounts, often in different jurisdictions, to break up larger sums.
• By layering transactions across several accounts, they obscure beneficial ownership and cross-border fund movements, hindering regulatory oversight.

• Multiple bank accounts are opened at different institutions or branches, with separate parties overseeing each account.
• By ensuring each institution and account manager only sees a fraction of the total transactions, criminals create fragmented records that conceal the larger movement of illicit funds.
• No single bank or compliance team gains a full view of the overall flow, hindering AML systems from catching suspicious patterns spanning multiple accounts.