Money laundering stages are the phases criminals use to disguise the illegal origin of funds and make them appear legitimate. The classic sequence is placement, layering, and integration. Placement introduces illicit money into the financial system, layering obscures traces through complex transfers, and integration returns funds as apparently lawful assets.
How Money Laundering Works Across Its Main Stages
Money laundering is usually described as a sequence rather than a single act. Each stage solves a different problem for the offender: getting cash into the system, breaking the audit trail, and later spending or investing the proceeds without drawing attention.
Placement is the most exposed phase because illicit cash must first enter banks, businesses, payment systems, or other financial channels. That is why regulators focus so heavily on customer due diligence, cash-intensive businesses, and source-of-funds checks.
Layering is designed to make tracing harder. It often uses rapid transfers, shell entities, nominees, cross-border movement, or repeated conversion between assets so that the origin of the value becomes obscured. The more complex the path, the more difficult it becomes for investigators to reconstruct ownership and control.
Integration is the final phase, where the criminal seeks normal-looking assets, income streams, or business interests that can be held and used openly. At this point the funds no longer look illicit on the surface, which is why earlier detection is far more effective than waiting until the money has been reused.
Why the Stage Model Matters
The classic placement, layering, and integration model remains useful because it explains how laundering risk changes over time. Different controls are strongest at different points, so understanding the stage helps analysts choose where to look for suspicious behaviour and where the trail is likely to be most fragile.
The model also helps distinguish between movement that is merely unusual and movement that is strategically designed to conceal provenance. A single transfer may be legitimate, but repeated restructuring of value, ownership, or destination can indicate an attempt to defeat visibility and accountability.
In practice, the stage model is less a rigid sequence than a working heuristic. Real laundering schemes can skip, repeat, or blur stages, especially when proceeds move through digital channels, intermediaries, or cross-border networks.
Common Techniques Seen at Each Stage
At placement, common methods include smurfing, cash deposits below reporting thresholds, cash-heavy front businesses, and purchases of easily resold assets. The aim is to replace raw illicit cash with something that looks routine enough to avoid immediate scrutiny.
At layering, the techniques shift toward fragmentation and concealment. Common patterns include wire transfers across multiple accounts, trade-based movement, use of offshore structures, nominee ownership, gambling transactions, and conversion into high-value goods or digital assets.
At integration, the focus is on legitimacy. Funds may re-enter the economy through business revenue, loans, property transactions, luxury purchases, or investments that give the proceeds a lawful story and a defensible paper trail.
What Investigators and Compliance Teams Look For
Detection often depends on seeing the whole pattern rather than any single transaction. Unusual velocity, circular movement, inconsistent customer profiles, rapid account opening and closure, unexplained source of funds, and transactions that appear structured to avoid review are all warning signs.
FATF Recommendations, the AML and KYC framework are the main global reference for this work. They shape how institutions assess customer risk, identify beneficial ownership, monitor activity, and file suspicious activity reports.
For financial institutions, the practical challenge is combining transaction monitoring with entity resolution and customer context. A transfer that looks ordinary in isolation may become suspicious once linked to a new counterparty, an offshore intermediary, or an account profile that does not match the stated business purpose.
Modern AML programs also rely on escalation discipline. False positives are common, so the value lies in connecting alerts to a broader narrative of concealment rather than treating each alert as an isolated event.
Risk and Threat Considerations
Money laundering is dangerous because it converts criminal proceeds into assets that can be reused, hidden, reinvested, or spent with much lower friction. The main risk is not only financial crime proceeds becoming harder to recover, but also the way laundering infrastructure can support fraud, corruption, sanctions evasion, and organised crime.
Failure mechanism: Offenders exploit gaps in customer due diligence, transaction monitoring, beneficial ownership transparency, and cross-institution visibility. They spread activity across many accounts, entities, or jurisdictions so that no single control sees the whole sequence.
Impact: Once proceeds are integrated into apparently legitimate assets, recovery becomes harder, law enforcement timelines lengthen, and financial institutions may face regulatory scrutiny, reputational damage, and exposure to facilitating predicate crimes.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Laundering controls depend on restricting account access and limiting misuse paths. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Suspicious movement is detected through review and correlation of transaction records. | |
| IA-2 — Identification and Authentication (Organizational Users) | AML operations rely on authenticated staff access to sensitive monitoring and case systems. | |
| Recommendation — Apply least-privilege account access to reduce abuse of financial systems and monitoring workflows. Correlate and review audit records to identify unusual transaction patterns and escalation triggers. Enforce strong authentication for staff who access AML monitoring, case management, and escalation systems. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Log retention and review are central to tracing placement, layering, and integration patterns. |
| Recommendation — Centralize and review logs to support tracing of suspicious financial activity across systems. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | AML systems and evidence handling require controlled access to reduce misuse and tampering. |
| Recommendation — Restrict access to AML case data and investigation records to authorised personnel only. | ||
Related resources from NHI Mgmt Group
- How should financial institutions design AML controls to catch money laundering across placement, layering, and integration stages?
- Why do digital asset exchanges create sanctions and money laundering risk when they sit between high-volume wallets and cross-border flows?
- What breaks when investigators rely only on traditional financial records in crypto-money-laundering cases?
- Why do pseudonymous crypto networks still create accountability risk for money laundering investigations?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 23, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org