Criminals use virtual International Bank Account Numbers (IBANs) to mask the real origin of illicit funds and complicate AML/CFT controls by routing incoming transfers through reference numbers that appear identical to conventional IBANs. Although these virtual IBANs cannot hold balances—each refers payments back to a single underlying bank account—they enable bad actors to insert additional layers in the fund flow. Multiple virtual IBANs can be easily generated, often with lighter KYC or less direct oversight, making it more difficult to pinpoint beneficial ownership and scrutinize high-risk transactions. Financial institutions can be misled by the normal IBAN-like format, which obscures the true account destination and hampers transaction monitoring. Jurisdictions have flagged the misuse of virtual IBANs in cyber-enabled fraud and layering schemes, allowing rapid redirection of funds and further complicating investigative efforts.
Virtual IBANs
Tactics
Criminals generate or use multiple virtual IBANs to insert additional layers between illicit proceeds and their true origin, hindering investigative tracing.
Risks
Criminals exploit the inherent features of virtual IBANs—specifically, the ability to generate multiple IBAN-like references that all route to a single underlying account—thereby obscuring the true beneficiary and complicating AML controls. The standard IBAN-style format creates a product vulnerability by misleading financial institutions’ monitoring systems and frustrating beneficial ownership checks. This enables layering with reduced KYC oversight at the virtual reference level.
Indicators
Repeated routing of funds through multiple virtual IBAN references with minimal holding periods, culminating in onward transfers to multiple distinct beneficiary accounts.
High volume of transactions processed via virtual IBANs, which is inconsistent with the customer's normal business activity or risk profile.
Deposits into virtual IBANs are transferred out within unusually short time frames, commonly associated with layering techniques.
A sudden change in transaction patterns where a customer shifts from traditional IBAN usage to predominantly using virtual IBANs, deviating from historical behavior.
Discrepancies between the customer's declared business operations and the sudden integration of virtual IBANs in their transaction routing without a clear commercial rationale.
Anomalies in the IBAN format or reference metadata for virtual IBAN transactions that obscure identification of the underlying bank account or beneficiary.
Frequent creation of multiple virtual IBAN references for a single underlying account in a short timeframe, lacking any documented business rationale.
Data Sources
- Provides complete records of deposits, withdrawals, and transfers, capturing timestamps, amounts, and IBAN references.
- Directly supports the detection of repeated usage of multiple virtual IBAN references, unusually short holding periods, and rapid fund layering outflows, enabling targeted AML investigations.
- Provides details of underlying bank accounts to which multiple virtual IBAN references may point (e.g., ownership, balances, transaction history).
- Assists in correlating numerous virtual IBANs mapping back to the same account, revealing potential excessive layering or undisclosed connectivity among funds.
- Contains verified customer information, including beneficial owners, business activities, and account relationships.
- Enables validation of legitimate business purposes for virtual IBAN usage and identification of suspicious discrepancies in declared activities versus actual fund movements.
Captures cross-border transaction details, such as origin and destination countries, intermediary banks, currencies, and settlement paths. This helps identify multi-jurisdictional layering or suspicious rerouting of funds via virtual IBANs, clarifying the true flow of funds and highlighting potential high-risk regions involved.
Mitigations
Escalate to Enhanced Due Diligence (EDD) for customers who generate multiple virtual IBANs or exhibit complex layering behavior. This requires additional verification of the source of funds, beneficial ownership structures, and documented rationale for each new virtual IBAN. This process ensures that high-risk usage of virtual IBANs is scrutinized, preventing them from being used to obscure illicit fund flows.
Require thorough verification of the underlying bank account and beneficial ownership when a customer seeks virtual IBAN services. Confirm the legitimate business purpose for each virtual IBAN issued, ensuring consistency with the customer’s declared operational activities. This measure ensures transparency over the actual account holders behind ephemeral IBAN references, deterring misuse for layering.
Implement dedicated monitoring scenarios to flag frequent or rapid pass-through transfers involving multiple virtual IBAN references. Detect abrupt funding and disbursement patterns where funds are quickly routed out of virtual IBANs to unrelated accounts. This real-time or periodic analysis helps identify layering vulnerabilities unique to virtual IBAN usage.
Maintain detailed logs linking each virtual IBAN reference to its underlying account and counterparties. Record creation dates, usage durations, and disbursement pathways for all virtual IBAN transactions. Robust audit trails enable investigators to trace actual beneficiaries behind ephemeral references and identify layering schemes post-transaction.
Limit or require internal approval for multiple virtual IBANs tied to the same underlying account. Institutions may cap the number of virtual IBAN references a single client can open and demand documented business justifications for each request. By controlling the proliferation of virtual IBAN references, financial institutions reduce the risk of layering and fragmentation of fund flows.
Service & Products
- Criminals can generate multiple virtual IBAN-like references under a single underlying account, creating the illusion of distinct beneficiaries while ultimately funneling funds into one real account.
- The normal IBAN-style format deceives financial institutions, hampering beneficial ownership checks and complicating transaction monitoring.
- Lighter KYC or reduced oversight for these virtual references allows rapid creation and termination, adding extra layers to obscure the true origin of funds.
Actors
Cybercriminals engaged in fraud misuse virtual IBANs to rapidly reroute stolen or illicit proceeds through accounts that appear to be standard IBANs. This practice complicates investigative tracing and extends the layering process, taking advantage of the normal IBAN-like format to evade detection.
Professional money launderers exploit virtual IBANs by creating multiple references that all link back to a single underlying account. This multiplies the layers in fund flows and hampers beneficial ownership checks, frustrating financial institutions' efforts to detect and monitor suspicious activity.
Payment service providers may knowingly or unknowingly offer virtual IBAN references, allowing clients to generate multiple IBAN-like identifiers from one real account. In many cases, lighter KYC or reduced oversight at the reference level enables criminals to conceal ultimate beneficiaries and obscure transaction flows, challenging financial institutions’ due diligence.
Financial institutions are exploited by criminals using virtual IBANs that mimic standard IBAN formats, concealing the fact that multiple references route back to the same underlying account. This deception hinders beneficial ownership identification and complicates transaction monitoring, thereby weakening AML efforts.
References
EBA (European Banking Authority). (2023). EBA report on ML/TF risks associated with payment institutions (EBA/REP/2023/18). https://eba.europa.eu
FATF (Financial Action Task Force), Interpol, Egmont Group. (2023, November). Illicit financial flows from cyber-enabled fraud. FATF. http://www.fatf-gafi.org/content/fatf-gafi/en/publications/Methodsandtrends/illicit-financial-flows-cyber-enabled-fraud.html