Typology Catalogue

Small-value transfers sent frequently to jurisdictions with known TF exposure. Individually unremarkable but collectively indicative of financing activity directed at conflict zones or sanctioned regions.

Funds received and immediately transferred onward with minimal dwell time, suggesting the account is being used as a pass-through to layer illicit proceeds and obscure audit trails.

Deliberate splitting of transactions to remain below reporting thresholds or monitoring triggers. Commonly associated with layering proceeds of crime or avoiding CTR filings.

Sudden or unexplained changes in a customer's transaction behaviour relative to their established profile, such as new geographies, increased volumes, or different payment types, potentially indicating account takeover or use for laundering.

Regular or significant transfers to jurisdictions known for banking secrecy and low tax transparency, particularly where the customer's business model does not justify international financial relationships in those locations.

Accounts used to receive and rapidly disburse funds on behalf of criminal networks. Mule accounts are often opened by individuals who are recruited, coerced, or deceived into facilitating the movement of illicit proceeds.

Use of corporate entities with no genuine commercial activity to obscure beneficial ownership, layer funds, or create false invoicing chains. Shell companies are commonly used in trade-based money laundering and corruption schemes.

Use of intermediary entities, agents, or correspondent chains to circumvent sanctions on designated individuals, entities, or jurisdictions. Includes trade diversion, front companies, and complex payment routing.

Concentration of remittance flows through high-risk corridors where informal value transfer, hawala networks, and limited transparency create elevated ML/TF risks. Particularly relevant for MSBs and EMIs serving diaspora communities.

Transaction activity that is materially inconsistent with the customer's declared business profile, sector, or expected turnover, potentially indicating front company activity, invoice fraud, or undisclosed business changes.

Social engineering schemes where victims are manipulated into authorising real-time payments to accounts controlled by fraudsters. Includes impersonation of banks, HMRC, solicitors, and romance scams, with losses often irrecoverable once funds are moved through mule networks.

Exploitation of international trade transactions to transfer value across borders and obscure the origins of criminal proceeds. Methods include over/under-invoicing, multiple invoicing for the same goods, phantom shipments, and misrepresentation of goods or services.

The provision of funds, financial services, or economic resources to individuals or entities involved in the proliferation of weapons of mass destruction (WMD), including nuclear, chemical, and biological weapons programmes. Often concealed through front companies, dual-use goods trade, and complex multi-jurisdictional payment chains.

Use of cryptocurrency and virtual asset services to layer and integrate illicit funds. Techniques include mixing/tumbling services, chain-hopping between blockchains, privacy coin conversion, and use of unhosted wallets to obscure transaction trails before converting to fiat currency.

Risk arising when a licensed money service business (MSB) or payment institution allows unlicensed or poorly supervised sub-agents to operate through its accounts and regulatory permissions. Creates opaque transaction chains where end-customer identity and source of funds are obscured behind pooled settlement accounts.

Laundering the proceeds of grand corruption through or on behalf of politically exposed persons. Funds typically move through shell company layers, nominee arrangements, family members and close associates, and are placed into high-value assets such as real estate, luxury goods, and investment portfolios to obscure illicit origin.

Corporate bribery and facilitation payments disguised as legitimate business spend. Common forms include inflated or fictitious consultancy and intermediary fees, round-sum payments to agents in high-risk jurisdictions, and success fees that lack commercial substance and are used to channel improper payments to officials or counterparties.

Fraudulent insurance claims including staged or fabricated losses, inflated or exaggerated claim values, duplicate claims across insurers, and organised claims rings operating across multiple policyholders. Proceeds are extracted as claim settlements and may be laundered through linked bank accounts.

Laundering through life and investment insurance products. Illicit funds are placed via large single-premium policies or overpayments, then withdrawn as clean funds through early surrender, partial withdrawals, or refunds of overpaid premiums, often shortly after inception and at the cost of surrender penalties.

Business email compromise and mandate or invoice redirection fraud. Attackers impersonate suppliers, executives, or counterparties to redirect legitimate payments to fraudster-controlled accounts using altered bank details, often followed by rapid layering through mule accounts to extract funds.

Romance and investment scams, including pig-butchering, where victims are manipulated over time into sending payments to scam-controlled bank accounts or crypto wallets. Payments are often escalating, made to fake investment platforms, and rapidly layered or converted to crypto by the receiving network.

Illicit value is settled by injecting structured cash or third-party deposits into the accounts of unwitting beneficiaries who are expecting a legitimate inbound payment (often an overseas remittance or invoice settlement). The expected funds are diverted abroad while the beneficiary receives dirty cash domestically, breaking the audit trail between the criminal source and the funds.

Funds are moved out of an entity to related parties, intermediaries or offshore vehicles and then cycled back, often disguised as loans, capital injections, invoice settlements or consultancy fees. The circular flow manufactures an appearance of legitimate revenue or financing while obscuring the original source and ownership of the funds.

Illicit cash is commingled with the legitimate takings of cash-intensive businesses such as restaurants, takeaways, retail outlets, car washes and barbers. Inflated banked cash is presented as trading revenue, integrating criminal proceeds into the financial system under the cover of an ostensibly genuine business.

Criminal proceeds are integrated by acquiring property, art, jewellery, watches, vehicles and other high-value goods, frequently through third parties, nominees or corporate vehicles. Rapid resale, undervaluation and quick refinancing convert and clean value while distancing it from its illicit origin.

Gambling accounts and casino activity are used to clean funds by depositing, placing minimal or offsetting bets, and withdrawing the balance as apparent winnings. Techniques include chip dumping between colluding players, deposit-then-cash-out with little genuine play, and using betting accounts as pass-through wallets to break the audit trail.

Networks recruit individuals, often students, job-seekers and the financially vulnerable, to open or hand over accounts that receive and forward illicit funds. A controlling herder coordinates many newly-opened accounts that share common funders or beneficiaries, rapidly moving proceeds of fraud and other crime while distancing the controllers from the money.

Funds raised or held by a non-profit or charity are diverted to conflict zones, proscribed groups, or unintended high-risk parties. Indicators include donation washing through legitimate-looking causes and a mismatch between the charity's stated purpose and the geography or nature of its outbound transfers.

Small-value online fundraising and crypto donations solicited via social media or crowdfunding pages, where many micro-transfers aggregate to a high-risk recipient or onward conduit. Individual amounts stay low to avoid scrutiny while the aggregate funds proscribed activity.

Layered shell or front companies and nominee directors used to conceal a sanctioned or designated person in control of an account or flow. Jurisdiction hopping and opaque ownership chains break the link between the visible customer and the true beneficial owner to evade sanctions screening.

Use of mixers and tumblers, peel chains, chain-hopping across assets, and privacy coins to break the on-chain link between illicit proceeds and the eventual fiat off-ramp. Layering obscures provenance before value re-enters the regulated financial system.

A fraudster gains control of a genuine customer's account through credential theft, phishing, or SIM-swap, then changes device, contact, or beneficiary details before rapidly draining funds to mule accounts. Speed and post-compromise profile changes distinguish takeover from normal customer behaviour.

First-party loan fraud, loan stacking across lenders, synthetic-identity applications, and advance-fee scams where a borrower pays an upfront fee for a loan that never materialises. Indicators include fabricated or inflated income, rapid multi-lender applications, and identity inconsistencies.

Procurement of dual-use or export-controlled goods routed through intermediaries and transhipment hubs to evade export controls and proliferation sanctions. Front buyers, mismatched end-users, and circuitous shipping routes disguise the true destination of sensitive items.

Wealthy individuals use networks of professional enablers including lawyers, accountants and trust administrators to establish multi-jurisdictional trust and corporate structures that conceal beneficial ownership of income-generating assets, disguise the true origin of wealth, and facilitate the evasion of tax obligations. Funds move through nominee trustees, opaque holding vehicles and secrecy-jurisdiction accounts before distribution to the ultimate beneficiary.

Entities controlled by or acting on behalf of weapons of mass destruction programmes exploit gaps in correspondent and cross-border payment screening by routing funds and procurement payments through third-country banking intermediaries, obscuring the true originator, beneficiary and purpose. Shell companies, misclassified goods descriptions, and layered correspondent relationships are used to access the international financial system.

Politically connected individuals and their associates extract bribes and kickbacks from construction and infrastructure contracts awarded by state or quasi-state entities. Proceeds flow through intermediary consultants, inflated invoices and nominee corporate structures before being layered into the financial system, often passing through private banking accounts and cross-border transfers before integration into apparently legitimate assets.