Detecting money laundering: how it works
How is money laundering detected?
Money laundering is detected through layered controls: banks identify customers (KYC), file automatic currency reports above fixed thresholds, monitor transactions for suspicious patterns, and send suspicious activity reports to national financial intelligence units, which develop them into cases. Leaks, whistleblowers, and blockchain analytics increasingly do the rest.
The four layers
Anti-money-laundering detection is not one system but four stacked ones, each catching what the previous layer missed.
1. Knowing the customer. Before any transaction happens, banks must establish who a customer is, who owns them, and what their activity should look like. This is KYC and customer due diligence. It exists so that “unusual” has a baseline; monitoring only means something if the bank knows whose behaviour it is watching.
2. Automatic reports. Above fixed thresholds, reporting is mechanical: currency transaction reports in the US, large cash transaction reports in Canada, threshold transaction reports in Australia. No suspicion required. The full table, by country, is on the thresholds page.
3. Suspicion. When patterns look wrong (structured deposits, funnel-account velocity, activity inconsistent with the customer) institutions file suspicious activity reports with their national financial intelligence unit, confidentially. This is where human judgment and monitoring software meet, and where the false-positive problem lives.
4. Investigation. FIUs match reports across institutions and borders, and hand packages to investigators. Around this formal machinery sit the irregulars that drive modern enforcement: whistleblowers, leak-based journalism (the Panama Papers, the FinCEN Files), and, for crypto, blockchain analytics firms whose clustering work turns public ledgers into evidence.
What the system is bad at
Measured honestly, the numbers are grim: about 1% of criminal proceeds confiscated in the EU, alert queues dominated by false positives, and compliance that can shade into box-ticking, filing reports to be safe rather than to be useful. De-risking makes it worse: banks that dump whole customer categories push those flows into channels with less oversight, not more.
The system’s real strength is different from its advertising. It rarely stops laundering in real time. What it does is preserve evidence: reports, records, and trails that turn into prosecutions years later, when an investigation finally asks the right question. Nearly every case in the case files was built on records some institution was once required to keep.
Where detection is heading
Three shifts define the 2020s. Ownership transparency: registers in the UK, Canada, and the EU now name the people behind companies, though the US narrowed its own register to foreign-registered companies in 2025–26. Asset-side rules: real-estate reporting and unexplained wealth orders interrogate what the money bought rather than how it moved. And chain analytics: for crypto, the ledger is public, so detection has become a data problem, one that firms and agencies keep getting better at, as several cases show.
Frequently asked questions
Who actually reads suspicious activity reports?
National financial intelligence units: FinCEN in the US, FINTRAC in Canada, AUSTRAC in Australia, the NCA’s UKFIU in Britain. They triage millions of filings into intelligence packages for police and prosecutors. Most reports never become cases; they become database entries that later investigations query.
Why do banks file so many reports?
Incentives. A bank that under-files risks enforcement (TD Bank’s US$3 billion resolution in 2024 followed systematic monitoring failures) while over-filing costs only staff time. The result is defensive filing, and a signal-to-noise problem the whole system struggles with.
Does detection actually work?
Partially, and unevenly. The controls deter casual abuse and generate the evidence that powers big cases, but measured by money recovered (around 1% of criminal proceeds in the EU) the system loses most of the time. The honest description is: detection works well against sloppy launderers and slowly against good ones.
Detection, in depth
- Blockchain analytics · How investigators follow crypto across public ledgers: clustering, attribution, exchange chokepoints and the travel rule, and where the tools fall short.
- Canada's AML System: FINTRAC and Cullen · How Canada's anti-money laundering system works: FINTRAC and the PCMLTFA, the Cullen Commission's findings, ownership registries, the lawyer exemption, and 2026's new laws.
- Detecting trade based money laundering · How investigators and banks catch value moved through trade paperwork: customs data, price checks, trade transparency units, and trade-finance controls, plus the gaps.
- FATF: Grey Lists and 40 Recommendations · The global standard-setter behind national AML laws: what the 40 Recommendations are, how countries are peer reviewed, and how grey and black lists work.
- Financial intelligence units (FIUs) · The national agencies that receive suspicious-activity reports, analyze them, and pass intelligence to police, and the Egmont network that links them across borders.
- Forfeiture and Unexplained Wealth Orders · How states take criminal money back: criminal forfeiture after a conviction, civil forfeiture against the asset itself, and unexplained wealth orders that make owners explain.
- KYC, CDD and EDD: What Banks Ask · How banks identify customers, look through companies to the people who own them, and treat politically exposed persons, plus where the checks stop.
- Reporting: CTRs, SARs, and STRs · The reports that feed the AML system (automatic currency reports, confidential suspicion reports, and border declarations) and what happens after filing.
- Transaction Monitoring: Rules and Alerts · How banks scan account activity for suspicious patterns, how rules differ from machine-learning models, and why most alerts lead nowhere.
- Whistleblowers and journalists · How insider tips and cross-border investigative reporting expose laundering that routine reports missed, and what the US whistleblower reward program does and does not yet do.
- Why Detection Still Mostly Fails · Why a vast AML system still recovers only a sliver of criminal money: recovery figures, report overload, de-risking, box-ticking compliance, and weak enforcement incentives.
Sources
- FinCEN releases figures on BSA filings (FY2024) (ABA Banking Journal, June 2025).
- Does crime still pay? Criminal asset recovery in the EU (Europol, February 2016).
- Are you too negative about false positives? (Datos Insights, 2023).
- Black and grey lists (Financial Action Task Force, accessed August 2026).
- TD Bank Pleads Guilty to Bank Secrecy Act and Money Laundering Conspiracy Violations (US Department of Justice, October 2024).