Cross-Border Payment Routing

Criminals systematically move illicit proceeds through multiple jurisdictions with uneven AML enforcement, leveraging the partial or delayed adoption of standardized data identifiers (such as LEIs in ISO 20022 payment messages) to camouflage transactions and hinder detection. They exploit the limited coordination or inconsistent cross-border declarations and disclosures in certain jurisdictions, further complicating intelligence gathering and oversight. In many cases, offenders also take advantage of border authorities’ limited visibility or capacity in high-risk or conflict-prone regions, using cash smuggling and other physical handoffs to introduce additional layers of anonymity. By selecting specific intermediary banks or payment corridors with weaker controls, they obscure the funds’ original source, minimize overall transparency, and obstruct investigators’ ability to follow the transaction chain. These routing methods often coincide with layering tactics and can be combined with agent-based facilitation, thereby fragmenting oversight across multiple regulators and creating blind spots in enforcement. Criminals also capitalize on the uneven adoption of enhanced data standards—such as beneficial-ownership fields—to evade consistent monitoring within the varied ecosystems of global financial messaging.

[
Code
T0121
]
[
Name
Cross-Border Payment Routing
]
[
Version
1.0
]
[
Parent Technique
]
[
Tactics
]
[
Risk
Channel Risk, Jurisdictional Risk
]
[
Created
2025-03-12
]
[
Modified
2025-04-02
]

Cross-Border Payments Divergence

Tactics

ML.TA0007
|
|

By routing illicit proceeds across multiple jurisdictions, criminals create additional layers of transactions that obscure the funds' origin and complicate investigators' ability to trace the money back to its criminal source.

Risks

RS0003
|
Channel Risk
|

Offenders exploit cross-border payment corridors and messaging channels with inconsistent data standards (e.g., partial LEI adoption in ISO 20022) to route funds through multiple intermediaries, fragmenting oversight and masking the true source and destination of transactions. By selecting corridors with looser scrutiny, they add complexity to the payment chain, hindering detection efforts.

RS0004
|
Jurisdictional Risk
|

Criminals systematically route illicit proceeds through multiple countries with uneven AML enforcement, partial or delayed adoption of standardized data identifiers, and inconsistent cross-border disclosures, thereby obscuring the funds' origin and beneficiary details. By targeting regions with weaker controls, they reduce oversight and fragment investigative efforts across different legal frameworks.

Indicators

IND00367
|

Use of multiple consecutive intermediary banks across different countries within a short transaction chain, absent a clear operational rationale.

IND00368
|

Frequent cross-currency conversions in intermediate jurisdictions, not aligned with the company’s usual business activities or contractual obligations.

IND00369
|

Repeated wire transfers routed through high-risk jurisdictions where the sender has no established business presence.

IND00370
|

Client provides inconsistent justifications for utilizing multiple international banks in a single payment sequence when asked by compliance officers.

IND00373
|

Entities sharing the same beneficial owner appear as counterparties in layered cross-border transfers, using different intermediary banks each time.

IND00385
|

Cross-border payment instructions frequently omit standardized data fields (e.g., LEI or beneficial ownership details) despite applicable regulatory requirements or transaction thresholds.

IND00386
|

Frequent cross-border transportation of cash near conflict-prone or minimal oversight regions with incomplete or inconsistent customs declarations relative to the individual’s known profile.

Data Sources

Comprehensive documentation of the movement of goods and people across borders, including declarations, shipping routes, and related details. This data assists in identifying physical cash smuggling routes near conflict-prone or minimally supervised regions and detecting mismatched or incomplete customs declarations linked to illicit cross-border activity.

Provides consolidated risk ratings, regulatory information, and enforcement profiles for different countries and regions. By referencing this data, investigators can identify unusual cross-border payment routes involving higher-risk or conflict-prone jurisdictions, ensure enhanced scrutiny of transactions in weakly regulated areas, and spot potential layering schemes exploiting jurisdictional vulnerabilities.

Provides records of currency conversions, including timestamps, parties, exchange rates, volumes, and settlement details. By analyzing frequent or unjustified cross-currency activity, investigators can identify hidden layering or suspicious payment routing in different currencies.

Contains verified customer identities, personal and business details, beneficial ownership information, and due diligence interviews. This data is essential for assessing the legitimacy of a client’s cross-border banking relationships and identifying inconsistencies or unusual justifications for multiple international banks in a single payment sequence.

This data includes cross-border transaction amounts, participating institutions, involved countries, currencies, settlement processes, and account relationships. It enables tracing of intermediary banks and jurisdictions used within transaction chains, identifying anomalies such as omitted standardized data fields, routing through high-risk jurisdictions, and layering across multiple regulators.

Official or aggregated details of organizations, including registration data, shareholders, directors, and ownership structures. This data helps investigators detect repeated cross-border transfers among entities sharing the same beneficial owner, indicating potential layering or shell company usage.

Mitigations

Incorporate a specific focus on the adoption of standardized payment data requirements and beneficial ownership disclosures into the institution’s country risk matrix. Assign higher risk ratings to jurisdictions with partial or non-existent LEI usage, weakly enforced cross-border reporting policies, or limited regulatory cooperation, and apply enhanced scrutiny accordingly.

Require deeper scrutiny for cross-border relationships, especially where payment messages show missing or inconsistent data fields. Confirm the legitimacy of each intermediary bank, verify beneficial ownership across all involved jurisdictions, and demand supporting documentation for unusual routing paths that may be exploited to layer or conceal transaction origins.

Implement targeted monitoring scenarios for cross-border payments that omit or fail to populate standardized data fields (e.g., LEI, beneficial ownership details). Flag rapid multi-jurisdiction transactions lacking clear operational logic, and generate alerts for frequent cross-currency conversions in high-risk corridors to detect deliberate routing designed to obscure the origin of funds.

Use external databases, business registries, and media checks to validate the legitimacy of customers and counterparties in cross-border payment chains. When payment messages are missing LEIs or beneficial ownership details, verify the entity’s existence and business rationale to prevent reliance on anonymized or fictitious overseas relationships.

Establish or join cross-border intelligence-sharing partnerships with correspondent banks and regional regulators. Exchange data on payment corridors frequently used to bypass standardized data fields or conceal beneficial ownership, thereby reducing blind spots in oversight and enabling proactive identification of suspicious routing schemes.

Restrict or require elevated approval for cross-border transactions routed through high-risk or minimal oversight regions known for incomplete AML data requirements. Apply corridor-level transaction caps or manual intervention where LEI or ownership data is systematically omitted, preventing criminals from repeatedly exploiting weak control points along multi-country transfers.

Instruments

  • Criminals open or control multiple bank accounts in different jurisdictions with weaker AML enforcement, routing funds through successive cross-border transfers.
  • By exploiting partial or delayed implementation of data identifiers (e.g., LEIs) in ISO 20022 payment messages, they mask the true origin and beneficiary details.
  • These multi-jurisdictional account movements create fragmented records that hinder investigators’ ability to fully trace suspicious fund flows.
IN0051
|
|
  • Offenders physically transport currency across borders to circumvent formal payment channels subject to data reporting (e.g., LEIs in wire instructions).
  • In regions with limited border checks or inconsistent customs declarations, they smuggle cash to avoid triggering electronic monitoring or AML controls.
  • This direct, unrecorded movement of funds adds an extra layer of anonymity, further complicating cross-border investigative efforts.

Service & Products

  • Criminals gain indirect local banking access in another jurisdiction without full customer due diligence.
  • They exploit the reduced scrutiny on foreign account holders, using layered cross-border transfers to mask the origin and reduce transparency in the payment chain.
  • Criminals split illicit proceeds into multiple smaller remittances across different corridors, circumventing reporting thresholds and scrutiny.
  • They exploit poorly regulated or informal remittance channels to layer funds internationally, obscuring the ultimate source or beneficiary.
  • Criminals establish offshore accounts in jurisdictions with limited transparency, channeling cross-border transactions to obscure beneficial ownership.
  • Lax or inconsistent AML regulations allow partial or delayed identification of account holders, delaying or preventing investigators from tracing funds.
  • Offenders initiate multiple international wire transfers through various institutions, exploiting incomplete identification requirements to mask the origin of funds.
  • Repeated cross-border wires in quick succession or without sufficient payment details complicate investigative efforts, particularly in jurisdictions with lax reporting standards.
  • Criminals exploit the service’s global reach, routing funds through jurisdictions with weaker AML oversight to obscure the funds’ origin.
  • They leverage partial or delayed adoption of standardized data identifiers (e.g., LEIs) to limit transparency on ultimate beneficiaries and originators.
  • By selecting intermediary banks or corridors with weaker controls, they create complex transaction chains that hinder unified tracking by investigators.
  • Criminals use layered correspondent and respondent banking relationships to obscure beneficial ownership and transaction trails across different jurisdictions.
  • They exploit uneven AML standards, routing funds through multiple bank networks, creating blind spots that make tracing the source and destination more difficult.

Actors

Correspondent banks facilitate international transfers for respondent banks and can be compromised when:

  • Criminals route cross-border transactions through correspondents in regions with weaker AML enforcement.
  • Limited or inconsistent data requirements across jurisdictions mask ultimate beneficiaries and origins.

Organized crime groups exploit cross-border payment routing by:

  • Coordinating complex international transfers through jurisdictions with weaker AML controls.
  • Leveraging limited adoption of beneficial ownership data to obscure the true source and destination of illicit funds.

Offshore financial institutions are used to:

  • Channel funds through jurisdictions with lax or delayed AML regulations.
  • Delay or prevent investigators from tracing transactions by obscuring beneficial ownership details and leveraging bank secrecy laws.

Professional money launderers specialize in structuring and layering funds across diverse financial channels by:

  • Selecting intermediary banks or corridors with inconsistent oversight.
  • Capitalizing on delayed adoption of standardized identifiers (e.g., LEIs) to fragment audit trails and evade detection.
AT0064
|
|

Cash couriers transport physical currency across borders, enabling:

  • Smuggling large sums through conflict-prone or under-resourced regions.
  • Introducing additional layers of anonymity by bypassing electronic records and standardized data requirements.

Payment service providers enable cross-border transactions on behalf of diverse clients and can be misused when:

  • Criminals exploit partial or delayed integration of standardized data fields, reducing transparency on originators and beneficiaries.
  • Multiple rapid transfers across providers and jurisdictions obscure the true flow of illicit proceeds.

Money transfer agents process remittances and can be exploited when:

  • Offenders split illicit funds into smaller amounts routed across multiple corridors.
  • Jurisdictions with inconsistent reporting thresholds are chosen to avoid detection and layering controls.

References

  1. Financial Action Task Force (FATF). (2019, July). Terrorist financing risk assessment guidance. FATF.https://www.fatf-gafi.org/content/dam/fatf-gafi/guidance/Terrorist-Financing-Risk-Assessment-Guidance.pdf

  2. AUSTRAC (Australian Transaction Reports and Analysis Centre) and PPATK. (2016). Terrorism financing regional risk assessment 2016 South-East Asia & Australia. Commonwealth of Australia. https://www.austrac.gov.au/sites/default/files/2019-07/regional-risk-assessment-SMALL_0.pdf

  3. Bank for International Settlements. (2023, May). Project Aurora: The power of data, technology and collaboration to combat money laundering. Bank for International Settlements. https://www.bis.org/about/bisih/topics/fmis/aurora.htm