Join our Newsletter — 33% off our NHI Course
Home› Glossary› Cyber Security› Money Laundering Stages
Cyber Security

Money Laundering Stages

← Back to Glossary
By NHI Mgmt Group Updated October 23, 2026 Domain: Cyber Security

Money laundering stages are the phases criminals use to disguise the illegal origin of funds and make them appear legitimate. The classic sequence is placement, layering, and integration. Placement introduces illicit money into the financial system, layering obscures traces through complex transfers, and integration returns funds as apparently lawful assets.

How Money Laundering Works Across Its Main Stages

Money laundering is usually described as a sequence rather than a single act. Each stage solves a different problem for the offender: getting cash into the system, breaking the audit trail, and later spending or investing the proceeds without drawing attention.

Placement is the most exposed phase because illicit cash must first enter banks, businesses, payment systems, or other financial channels. That is why regulators focus so heavily on customer due diligence, cash-intensive businesses, and source-of-funds checks.

Layering is designed to make tracing harder. It often uses rapid transfers, shell entities, nominees, cross-border movement, or repeated conversion between assets so that the origin of the value becomes obscured. The more complex the path, the more difficult it becomes for investigators to reconstruct ownership and control.

Integration is the final phase, where the criminal seeks normal-looking assets, income streams, or business interests that can be held and used openly. At this point the funds no longer look illicit on the surface, which is why earlier detection is far more effective than waiting until the money has been reused.

Why the Stage Model Matters

The classic placement, layering, and integration model remains useful because it explains how laundering risk changes over time. Different controls are strongest at different points, so understanding the stage helps analysts choose where to look for suspicious behaviour and where the trail is likely to be most fragile.

The model also helps distinguish between movement that is merely unusual and movement that is strategically designed to conceal provenance. A single transfer may be legitimate, but repeated restructuring of value, ownership, or destination can indicate an attempt to defeat visibility and accountability.

In practice, the stage model is less a rigid sequence than a working heuristic. Real laundering schemes can skip, repeat, or blur stages, especially when proceeds move through digital channels, intermediaries, or cross-border networks.

Common Techniques Seen at Each Stage

At placement, common methods include smurfing, cash deposits below reporting thresholds, cash-heavy front businesses, and purchases of easily resold assets. The aim is to replace raw illicit cash with something that looks routine enough to avoid immediate scrutiny.

At layering, the techniques shift toward fragmentation and concealment. Common patterns include wire transfers across multiple accounts, trade-based movement, use of offshore structures, nominee ownership, gambling transactions, and conversion into high-value goods or digital assets.

At integration, the focus is on legitimacy. Funds may re-enter the economy through business revenue, loans, property transactions, luxury purchases, or investments that give the proceeds a lawful story and a defensible paper trail.

What Investigators and Compliance Teams Look For

Detection often depends on seeing the whole pattern rather than any single transaction. Unusual velocity, circular movement, inconsistent customer profiles, rapid account opening and closure, unexplained source of funds, and transactions that appear structured to avoid review are all warning signs.

FATF Recommendations, the AML and KYC framework are the main global reference for this work. They shape how institutions assess customer risk, identify beneficial ownership, monitor activity, and file suspicious activity reports.

For financial institutions, the practical challenge is combining transaction monitoring with entity resolution and customer context. A transfer that looks ordinary in isolation may become suspicious once linked to a new counterparty, an offshore intermediary, or an account profile that does not match the stated business purpose.

Modern AML programs also rely on escalation discipline. False positives are common, so the value lies in connecting alerts to a broader narrative of concealment rather than treating each alert as an isolated event.

Risk and Threat Considerations

Money laundering is dangerous because it converts criminal proceeds into assets that can be reused, hidden, reinvested, or spent with much lower friction. The main risk is not only financial crime proceeds becoming harder to recover, but also the way laundering infrastructure can support fraud, corruption, sanctions evasion, and organised crime.

Failure mechanism: Offenders exploit gaps in customer due diligence, transaction monitoring, beneficial ownership transparency, and cross-institution visibility. They spread activity across many accounts, entities, or jurisdictions so that no single control sees the whole sequence.

Impact: Once proceeds are integrated into apparently legitimate assets, recovery becomes harder, law enforcement timelines lengthen, and financial institutions may face regulatory scrutiny, reputational damage, and exposure to facilitating predicate crimes.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

FrameworkControl / ReferenceRelevance
NIST SP 800-53 Rev 5AC-6 — Least PrivilegeLaundering controls depend on restricting account access and limiting misuse paths.
AU-6 — Audit Record Review, Analysis, and ReportingSuspicious movement is detected through review and correlation of transaction records.
IA-2 — Identification and Authentication (Organizational Users)AML operations rely on authenticated staff access to sensitive monitoring and case systems.
Recommendation — Apply least-privilege account access to reduce abuse of financial systems and monitoring workflows. Correlate and review audit records to identify unusual transaction patterns and escalation triggers. Enforce strong authentication for staff who access AML monitoring, case management, and escalation systems.
CIS Controls v8CIS-8 — Audit Log ManagementLog retention and review are central to tracing placement, layering, and integration patterns.
Recommendation — Centralize and review logs to support tracing of suspicious financial activity across systems.
ISO/IEC 27001:2022A.5.15 — Access controlAML systems and evidence handling require controlled access to reduce misuse and tampering.
Recommendation — Restrict access to AML case data and investigation records to authorised personnel only.

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 23, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org