Wire Transfer Chains

Wire Transfer Chains involve sending illicit funds through a sequence of rapid electronic transfers across multiple financial institutions and jurisdictions. Criminals exploit these services by quickly moving proceeds through numerous intermediaries or shell accounts, often depositing or splitting amounts in ways that appear routine and remain below reporting thresholds. By dispersing transactions among different platforms and locations, they create complex layering that frustrates investigators attempting to aggregate data across endpoints. In some cases, funds are first placed into personal or third-party accounts and then repeatedly transferred to new accounts in different banks, sometimes alongside cash deposits, to conceal their true origin before being cashed out or integrated into lawful assets. This layering tactic is especially potent when carried out across international boundaries, as the frequent cross-border transfers obscure the initial deposit and complicate efforts to trace beneficiaries or related parties. Indicators include large sums divided into smaller wire transfers, multiple transfers executed in rapid succession, or wires to high-risk or unrelated jurisdictions, all of which may indicate an escalating effort to hide illicit proceeds and avoid detection.

[
Code
T0070.001
]
[
Name
Wire Transfer Chains
]
[
Version
1.0
]
[
Parent Technique
]
[
Tactics
]
[
Risk
Product Risk, Jurisdictional Risk
]
[
Created
2025-02-12
]
[
Modified
2025-04-02
]

Wire Transfer

Tactics

ML.TA0007
|
|

Wire transfer chains involve multiple rapid cross-border or multi-bank transactions specifically designed to obscure the origin of illicit proceeds and frustrate investigative attempts to trace funds back to criminal sources. The sequential transfers split or move sums through various accounts, creating complex layering that hinders detection.

Risks

RS0002
|
Product Risk
|

Criminals exploit the inherent vulnerabilities of wire transfer services—specifically their speed, cross-institution reach, and partial transaction visibility—to layer illicit proceeds. By splitting funds into multiple wire transfers across different banks, often below reporting thresholds, they take advantage of the product’s transactional nature to evade detection when each transfer is viewed in isolation. This constitutes the primary vulnerability in this technique.

RS0004
|
Jurisdictional Risk
|

Repeated cross-border wiring of funds exploits differences in AML oversight among multiple jurisdictions. Criminals route transfers through regions with weaker regulations or minimal financial disclosure requirements, complicating authorities' efforts to trace the ultimate beneficiaries and origins of the funds.

Indicators

IND00093
|

Large sums are split into multiple smaller wire transfers, each remaining below regulatory reporting thresholds, consistent with attempts to avoid aggregated detection.

IND02307
|

Multiple wire transfers executed in rapid succession across different financial institutions with minimal holding periods, consistent with layering activity.

IND02308
|

Wire transfers of unusually high amounts that do not align with the customer's documented financial profile or declared business activities.

IND02309
|

Multiple cross-border wire transfers to or from high-risk jurisdictions, particularly when inconsistent with the customer’s normal geographic operations.

IND02310
|

Funds routed through multiple intermediary banks across different countries before reaching the final beneficiary, consistent with layering to obscure fund origin.

IND02311
|

Transactions initiated with incomplete or inconsistent beneficiary details compared to the customer’s profile, indicating an effort to mask the true origin or destination of funds.

IND02312
|

Wire transfers initiated outside of normal business hours or during periods of low activity, indicating deliberate timing to evade scrutiny.

IND02313
|

A sudden, unexplained surge in the volume or frequency of wire transfers relative to historical account activity, indicating a significant shift in behavior.

IND02314
|

Frequent pass-through wire transfers where incoming funds are rapidly forwarded to one or more external accounts, leaving little or no residual balance.

Data Sources

  • Records all activities within customer accounts, including transaction frequencies, timestamp history, and usage patterns.
  • Detects sudden increases in wire activity or abnormal timing, consistent with layering techniques in wire transfers.
  • Consolidates information on high-risk jurisdictions and AML/CFT enforcement practices.
  • Facilitates analysis of wire transfers to or from regions flagged for elevated risk, aligning with known layering channels.
  • Captures all wire transfers, including timestamps, amounts, currencies, and counterparties.
  • Enables pattern detection of multiple, rapid wire transfers across accounts or jurisdictions indicative of layering.
  • Contains verified customer identities, financial profiles, risk metrics, and beneficial ownership details.
  • Allows comparison of wire transfers with the customer’s stated financial capacity and expected activity to flag anomalies in layering schemes.
  • Details intermediary banks, routing information, and settlement processes for cross-border wires.
  • Helps trace funds through multiple financial institutions and countries, revealing the layering chain in wire transfer schemes.
  • Provides official or aggregated details on company registration, ownership structures, and controlling parties.
  • Helps identify shell or front companies used to open accounts for layering, and uncovers undisclosed beneficial owners who may be involved in complex wire transfers.

Mitigations

Evaluate jurisdictions known to be exploited for cross-border layering due to weak AML frameworks, minimal regulatory oversight, or historical precedent. Assign heightened risk ratings to these countries and require additional approvals or enhanced scrutiny for wire transfers involving them, directly mitigating layering pathways.

For customers frequently conducting high-value or complex cross-border wire transfers, require documentation verifying the legitimate purpose and source of funds for each transfer. When signs of layering emerge—such as multiple account usage, frequent hops between jurisdictions, or a lack of clear business rationale—review beneficial owners, counterparties, and transaction details to uncover hidden or suspicious fund flows.

Implement targeted wire transfer monitoring rules to detect patterns of rapid sequential cross-border transfers or repeated transactions to unrelated beneficiaries. Use threshold-based triggers to flag attempts to evade reporting requirements by splitting large amounts into multiple smaller wires. Investigate when intervals between outgoing wires are unusually short or when funds are routed through multiple institutions in quick succession.

Maintain detailed logs of all wire transfers, capturing beneficiary details, intermediary institutions, timestamps, and any associated compliance checks. Comprehensive record-keeping provides investigators with the granular data necessary to reconstruct multi-step layering sequences and link funds to their ultimate origin or beneficiary.

Designate customers who conduct frequent or large-scale cross-border wire transfers as higher risk, triggering stricter monitoring scenarios and tailored alerts. Segregate industries or customer segments prone to layering, such as those with opaque ownership or offshore interests, ensuring enhanced scrutiny of complex wire flow patterns.

Coordinate with peer institutions and relevant authorities to exchange data on wire transfer patterns, suspicious beneficiary networks, and known typologies used in layering schemes. By sharing real-time intelligence or red-flag scenarios, institutions can collectively identify and interrupt layered wire chains spanning multiple banks or jurisdictions.

Regularly compare clients' wire transfer activity against their documented transaction profiles. Promptly investigate abrupt spikes in volume, novel destinations, or rapid succession of wires that may indicate layering. Where unusual patterns persist without a valid economic justification, escalate for further scrutiny or regulatory reporting.

Instruments

Criminals open or use multiple personal or third-party bank accounts, sometimes operated under shell names or false identities, to receive and hold illicit funds. They then execute a series of rapid wire transfers between these accounts across different financial institutions and jurisdictions, often splitting amounts below reporting thresholds. This layering disperses the illicit proceeds, making it difficult for investigators to track the transaction trail and identify the true origin of the funds.

IN0051
|
|

Criminals deposit illicit cash in structured amounts into multiple bank accounts, sometimes combining these deposits with wire transfers to further obscure the provenance of funds. By placing physical currency below reporting thresholds, they reduce immediate scrutiny. Once deposited, the money is quickly wired through additional accounts, intensifying the layering and complicating efforts to connect the funds back to their criminal source.

Service & Products

  • Allows repeated, small-value transactions across diverse remittance channels, contributing to layering by dispersing illicit funds into multiple accounts or payments.
  • Rapid processing and global coverage enable criminals to move funds quickly, making consolidated oversight more difficult and frustrate detection efforts.
  • Criminals can chain multiple wire transfers through various intermediary accounts or institutions, effectively layering transactions and obscuring the original source of funds.
  • By splitting large sums into smaller wire transfers, they remain below regulatory thresholds, reducing the likelihood of triggering reporting mechanisms.
  • Facilitates cross-border fund movements through networks of foreign and local banks, enabling criminals to route illicit funds through multiple correspondent accounts.
  • The indirect relationship between the originating and beneficiary institutions obscures transactional details, complicating AML investigations seeking to link endpoints and trace beneficiaries.

Actors

They orchestrate wire transfer chains by:

  • Arranging multiple rapid transfers across different banks or jurisdictions to disguise the origin of funds.
  • Splitting large sums into smaller, routine-sized wire transfers to avoid detection thresholds.
  • Coordinating personal, third-party, or shell accounts to obscure true beneficiaries and mask illicit proceeds from financial institutions.

They serve as nominal account holders for wire transfers by:

  • Holding accounts with minimal legitimate business operations, which reduces transactional transparency.
  • Concealing beneficial ownership through corporate paperwork or inactive entities.
  • Acting as a layering channel for quick cross-institution fund movements, thereby masking sources from financial institutions.
AT0076
|
|

They knowingly or unknowingly facilitate wire transfers from personal or third-party accounts by:

  • Receiving funds on behalf of others and quickly forwarding them to additional accounts.
  • Keeping balances low between transfers to prevent obvious red flags.
  • Executing repeated cross-institution transfers as part of a layering process.

Financial institutions, including correspondent banks, are unwittingly exploited by:

  • Processing consecutive wire transfers across multiple jurisdictions, each appearing routine in isolation.
  • Handling split transactions that remain below reporting thresholds, hindering detection.
  • Lacking consolidated oversight of layered transfers that traverse different institutions, complicating investigators’ ability to track proceeds.

References

  1. Asia/Pacific Group on Money Laundering (APG). (2006). The Asia/Pacific Group on Money Laundering (APG) Yearly Typologies Report 2005 – 2006. Asia/Pacific Group on Money Laundering (APG). http://www.apgml.org

  2. AUSTRAC (Australian Transaction Reports and Analysis Centre). (2008). Typologies and case studies report 2008. AUSTRAC. https://www.austrac.gov.au/business/how-comply-guidance-and-resources/guidance-resources/typologies-and-case-studies-report-2008

  3. United Nations Office on Drugs and Crime (UNODC). (2013). Risk of money laundering through financial and commercial instruments. UNODC. https://www.unodc.org/documents/colombia/2013/diciembre/Risk_of_Money_Laudering_version_I.pdf