The three classic stages of money laundering. Placement introduces illicit funds into the financial system, layering obscures their origin through movement and complexity, and integration returns them to the economy appearing legitimate. Monitoring rules often differ by stage because each leaves distinct behavioural evidence.
How placement works
Placement is the first stage of money laundering, where illicit cash or other criminal proceeds enter the financial system in a form that can be moved, deposited, or exchanged. At this point, the money is still most vulnerable to detection because it often appears close to the source of crime and may create visible cash-intensity, structuring, or unusual deposit behaviour.
For investigators and compliance teams, the important issue is not just that placement happens, but that it creates the first documented bridge between predicate criminal activity and a regulated financial environment. That makes transaction monitoring, customer due diligence, and cash-handling controls especially relevant at this stage.
How layering obscures origin
Layering is the concealment phase. Funds are moved through transfers, conversions, intermediaries, shell entities, or complex transaction paths so that the original source becomes harder to trace. The more movement and transformation involved, the more difficult it becomes for a bank or investigator to reconstruct the audit trail from the final asset back to the predicate offence.
This stage is dangerous because it deliberately exploits complexity. The objective is to break the link between proceeds and source through speed, fragmentation, cross-border movement, and repeated financial reshaping. Rules that detect unusual velocity, circular movement, dormant-to-active account changes, and inconsistent customer behaviour are often more effective here than rules focused only on cash deposits.
How integration makes illicit value appear legitimate
Integration is the final stage, when laundered funds re-enter the wider economy as apparently lawful wealth. Criminal proceeds may appear as business revenue, investment gains, property activity, loan repayment, or other legitimate-seeming value once the earlier concealment layers have done their work.
This stage is often the hardest to spot because the money has already been normalised. The key question becomes whether the transaction pattern, counterparties, asset source, or economic story is credible when measured against the customer profile and the earlier movement of funds.
Why the three stages matter to detection and controls
The placement, layering, and integration model is useful because each stage leaves different behavioural evidence. Placement may show cash concentration or structuring, layering may show movement and obfuscation, and integration may show inconsistent wealth creation or sudden legitimacy. Monitoring that treats all suspicious activity the same can miss the stage-specific signs that make laundering detectable.
Stage-aware detection also helps investigators decide where to look first. Early-stage activity may justify immediate review of source-of-funds evidence, while late-stage activity may require tracing beneficial ownership, transaction chains, and links between customer profiles and asset accumulation.
Risk and Threat Considerations
These three stages matter because laundering risk changes as illicit value moves from obvious to hidden to seemingly legitimate. The main exposure is that controls tuned only to one stage can miss another, especially when criminals deliberately shift between cash, transfers, entities, and assets to defeat pattern-based monitoring.
Failure mechanism: Weak coverage across the full laundering lifecycle allows suspicious value to enter, disperse, and reappear without a coherent trace, which can defeat single-rule or single-stage detection strategies.
Impact: Organisations can process criminal proceeds, fail to file timely suspicious activity reports, and expose themselves to enforcement action, reputational damage, and deeper investigation after the fact.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Transaction monitoring and traceable audit trails support laundering-stage detection. |
| AC-6 — Least Privilege | Restricting approval paths reduces abuse of accounts used to move illicit funds. | |
| Recommendation — Review anomalous financial activity and escalate patterns that break normal transaction provenance. Limit payment and transfer authority to the minimum set of approved duties. | ||
| CIS Controls v8 | CIS-13 — Network Monitoring and Defense | Continuous monitoring helps surface suspicious movement patterns across systems and accounts. |
| Recommendation — Correlate unusual transfer behaviour with monitoring alerts and investigative review. | ||
| ISO/IEC 27001:2022 | A.5.7 — Threat intelligence | Threat intelligence and typology awareness improve detection of laundering patterns. |
| Recommendation — Incorporate laundering typologies into detection logic and investigative playbooks. | ||
Practitioner Guidance
Why practitioners should care: A useful monitoring programme maps controls to the laundering stage, not just to the transaction type. That means building different alert logic for placement, layering, and integration rather than expecting one threshold or one typology to catch all three.
What to watch for: Repeated small deposits, rapid pass-through movement, unexplained cross-account or cross-border transfers, and assets or revenues that do not fit the customer's known profile all deserve closer review. The strongest programmes combine rules, behavioural monitoring, and investigative context instead of relying on a single red flag.
Related resources from NHI Mgmt Group
- How should financial institutions design AML controls to catch money laundering across placement, layering, and integration stages?
- Why do placement, layering, and integration create different risks for AML teams?
- What happens when laundering moves from placement into layering and integration without strong monitoring controls?
- What is the difference between placement and layering in money laundering?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org