Cash Wage Payments to Undocumented Workers

This technique involves employers deliberately hiring undocumented workers and paying them entirely off the books in cash, further reducing transparency around wage outflows. Because these workers lack formal documentation, they rarely appear in conventional payroll systems, intensifying the opacity and facilitating the commingling of illicit funds with purported labor costs. By avoiding official payroll channels, criminals can camouflage substandard recordkeeping and evade tax or social insurance obligations. This method is especially common in cash-intensive trades, such as construction or other labor-focused sectors, where subcontracting arrangements and multiple project layers provide cover for untracked wage payouts. Off-the-books payments may also be used by transnational criminal organizations leveraging shell businesses, minimal insurance coverage, or falsified records to pay a larger workforce in unrecorded cash, thereby masking the ultimate source of the funds. In doing so, illicit proceeds can be blended into ordinary operating expenses, shielded from standard audits, and concealed behind seemingly legitimate labor costs, significantly impairing oversight and detection efforts.

[
Code
T0052.001
]
[
Name
Cash Wage Payments to Undocumented Workers
]
[
Version
1.0
]
[
Parent Technique
]
[]
[
Risk
Customer Risk, Channel Risk
]
[
Created
2025-03-12
]
[
Modified
2025-04-02
]

Undocumented Worker Wages

Tactics

ML.TA0009
|
|

By paying undocumented workers exclusively in cash, criminals embed illicit proceeds within a business’s wage outflows, disguising them as legitimate labor expenses and fully incorporating dirty funds into normal operating costs. This technique leverages the opacity of untracked payroll to complete the laundering cycle, making the illicit origin of the funds exceedingly difficult to detect.

Risks

RS0001
|
Customer Risk
|

By hiring individuals lacking formal employment documentation, the business exploits the inability to verify workforce identities and payroll records. This lack of verifiable documentation allows illicit funds to be mingled with purported wages, concealing their true source. The core vulnerability lies in the obscured employee identity status, which undermines standard AML/KYC processes and creates a primary risk of disguising criminal proceeds within untracked payroll costs.

RS0003
|
Channel Risk
|

The exclusive reliance on cash payments bypasses traditional payroll and electronic channels, preventing standard transaction monitoring and recordkeeping. By conducting off-the-books disbursements, criminals exploit the opacity of untraceable cash flows, making it difficult for institutions to track or correlate wage outflows with actual payroll records. This distinct channel-based vulnerability becomes especially impactful when combined with unverified employees, further obscuring the illicit nature of the funds.

Indicators

IND00027
|

Significant cash outflows described as wages remain unaligned with officially reported labor costs over the same period.

IND00039
|

Frequent subcontracting to shell or minimally registered entities paid extensively in cash for labor costs not reflected in official payroll records.

IND00528
|

Recurring large cash withdrawals from business accounts around typical payroll dates with no matching entries in official payroll records.

IND00529
|

Employer’s reported number of employees in tax or regulatory filings is consistently lower than the workforce observed at worksites.

IND00530
|

Employer bypasses formal payroll systems by distributing off-the-books cash wages to individuals lacking standard employment documentation.

IND00531
|

Multiple workers receiving cash wages are linked to incomplete or invalid identification details without formal employee records.

Data Sources

  • Documents reported financial statements, including wage expenses, payroll taxes, and business income.
  • Allows investigators to compare official wage expenditures against actual cash outflows, revealing concealed labor expenses for undocumented workers.
  • Provides a record of cash withdrawals and financial transactions, including timestamps, amounts, and account details.
  • Helps detect patterns of recurring, unexplained cash withdrawals coinciding with typical payroll periods, indicating off-the-books wage disbursements to undocumented workers.
  • Authenticates and validates identity documents, checking for forgeries or inconsistencies.
  • Detects incomplete or invalid identification details used by workers receiving off-the-books wages, indicating possible undocumented status.
  • Maintains comprehensive data on officially registered employees, including their roles, wages, and tax-related information.
  • Exposes discrepancies between declared workforce details and the actual labor force observed on-site, highlighting off-the-books payments to undocumented workers.
  • Contains official incorporation, ownership, and directorship details for companies.
  • Helps identify shell or minimally registered entities used to channel cash wage payments off the books, obscuring the ultimate benefactors and the true number of employees or subcontractors involved.

Mitigations

For higher-risk accounts, require comprehensive proof of payroll-related tax and social insurance contributions. Verify workforce size through site visits or third-party records to uncover hidden or unregistered employees receiving cash wages outside official systems.

During onboarding and periodic reviews of labor-intensive businesses, require verifiable employee rosters and payroll documentation. Compare declared headcounts with registered tax, insurance, or regulatory data to detect discrepancies that may indicate off-the-books wage payments to undocumented workers.

Implement scenario-based monitoring rules focusing on recurring large cash withdrawals from corporate accounts around typical payroll cycles. Compare these withdrawals with declared employee counts or payroll records to identify unrecorded wage payments to undocumented workers.

Cross-reference public databases, labor authority reports, and on-site observations to confirm the actual workforce presence. Identify mismatches with claimed payroll figures to reveal undocumented wage payments.

Continuously scrutinize account activity for abnormal increases in cash outflows around paydays. Investigate each mismatch between official payroll records and observed cash wage distributions to undocumented workers, while maintaining accurate risk profiles.

Instruments

  • Employers deposit or aggregate illicit funds into business bank accounts and then make sizable withdrawals around payroll dates.
  • These withdrawals are falsely attributed to wage payments, allowing criminals to mask unlawful outflows as legitimate labor costs.
  • By mixing legitimate revenue with illicit deposits, the resulting cash withdrawals appear routine, further obfuscating the movement of criminal proceeds.
IN0051
|
|
  • Criminals withdraw illicit funds and directly pay undocumented workers in physical currency, leaving no formal payroll records.
  • The absence of documentation or electronic traces conceals both the source of funds and the identities of recipients.
  • This off-the-books method obscures labor expenses, helping to commingle illegal proceeds with purportedly legitimate wage outflows.

Service & Products

  • Enables direct cash payouts to undocumented workers, bypassing traditional payroll and electronic payment records.
  • The reliance on high-volume cash transactions obscures the ultimate source and destination of funds.
  • Criminals make substantial cash withdrawals from business accounts around payday without recording these disbursements in official payroll systems, thus paying undocumented workers off the books.
  • This tactic integrates illicit funds with legitimate business revenue, disguising illegal wage outflows as normal operating expenses.
  • Allows falsification or omission of wage records for undocumented workers, concealing these payments within ordinary labor expenses.
  • Bookkeepers or accountants may help aggregate illicit funds with legitimate costs, complicating oversight and disguising the true payroll size.

Actors

Organized crime groups exploit the cash-based employment of undocumented workers by:

  • Establishing or controlling front businesses that pay laborers off the books
  • Blending illicit funds into wage disbursements, reducing traceability and complicating financial oversight
AT0045
|
|

Accountants or bookkeepers may knowingly or unknowingly assist by:

  • Omitting or falsifying payroll records for undocumented workers
  • Integrating illicit proceeds into apparent labor expenses, impeding financial auditing and detection
  • Obscuring off-the-books cash wages from financial institution oversight, complicating transaction monitoring and due diligence efforts

Business entities, including shell or front companies and cash-intensive operations, enable this scheme by:

  • Hiring undocumented workers off the books and paying them entirely in cash
  • Concealing illicit wage outflows under supposed labor expenses or subcontracting arrangements
  • Mixing unlawful proceeds with day-to-day operating costs, obscuring payroll records for financial institutions

References

  1. Financial Crimes Enforcement Network (FinCEN). (2023). FinCEN Calls Attention to Payroll Tax Evasion and Workers' Compensation Fraud in the Construction Sector (FIN-2023-NTC1). FinCEN. https://www.fincen.gov/sites/default/files/shared/FinCEN_Notice_Payroll_Tax_Evasion_and_Workers_Comp_508%20FINAL.pdf

  2. Mohd Latif, H., Mohamed, N., Handley-Schachler, M. and Jalaludin, A. (2023). A professional money laundering scandal; a narrative-based exploration of undocumented foreign workers in a large construction project. Journal of Money Laundering Control, Vol. 26 No. 5, pp. 1054-1065. https://doi.org/10.1108/JMLC-07-2022-0106