
Money laundering only works if nobody can trace where the money came from. That single requirement shapes the whole process, and it explains why schemes that look nothing alike on the surface follow the same three steps underneath: get the money into the financial system, move it around until the trail goes cold, then bring it back out looking earned.
Those steps are placement, layering, and integration. They matter to anyone building AML controls because each one leaves a different kind of evidence, and each one calls for a different detection approach. A control tuned for placement will miss layering entirely.
Below: each stage in detail, the methods criminals actually use, and what each one looked like inside a real cartel laundering operation.
Money laundering is the process of disguising the origin of criminally obtained funds so they can be spent without attracting suspicion. The money starts out traceable to a crime. It ends up looking like income, an asset sale, or a business payment.
For obvious reasons the scale is hard to measure precisely. The UN Office on Drugs and Crime estimates that between 2% and 5% of global GDP is laundered annually.
The three stages, in order, are placement, layering, and integration.

Placement is where institutions have the best chance of catching activity. The money has not yet been distanced from the crime, so the anomaly is still visible. By layering, the transactions look like everything else on the ledger.
To show what these stages look like from the inside, we drew on the work of Robert Mazur, the former US federal agent who spent years undercover inside the Medellín and Cali cartels as a money launderer. His account appears in his book The Betrayal.
Between 1992 and 1994, Mazur ran an operation codenamed Pro-Mo, short for professional money launderers. He worked out of Sarasota, Panama City, and Bogotá under the identity of Robert Baldasare, a fabricated persona controlling a mortgage brokerage, a trade finance company, several offshore entities, and a Liechtenstein foundation. The fronts existed to attract Cali cartel associates looking for someone to wash drug proceeds.

Placement is the first stage, when illicit funds are introduced into the financial system. The goal is to get money into an account, an instrument, or an asset without triggering a report.
The most common approach is splitting a large sum into smaller amounts and funneling them through multiple accounts or deposits, each one small enough to stay under reporting thresholds. This is called structuring, or smurfing.
Two conduits fed the operation. The first was bulk non-depository checks delivered by covert partners, money that low-level couriers had already placed into the system. Most of these instruments, Moneygrams, cashier's checks, traveler's checks, and money orders, were written under $3,000 and in odd amounts, specifically to stay beneath money services business recordkeeping requirements. The second conduit was simpler: duffle bags of cash, six figures to low seven figures per drop.
Mazur has said this mechanism for moving value is still working today. The instruments have changed. The structure has not.
.png)
Layering is the second stage, when funds already inside the system are moved repeatedly to break the connection to their source. The aim is to build enough transaction history that the money's origin becomes impractical to reconstruct.
This is the hardest stage to detect, because by design it looks like normal financial activity: transfers, trades, business payments, loans.
One point worth getting right: structuring is not layering. Structuring, also called smurfing, is a placement technique. It means breaking cash into small deposits to get it into the system without triggering reporting thresholds. Layering happens afterward, once the money is already inside. A lot of study material conflates the two.
Mazur's mortgage company owned a check-cashing business, which let him take in the bulk checks, endorse the blank payee field with his own business stamp, and deposit the proceeds into the company account. He took his fee and wired the rest onward to his mortgage business.
From there, funds moved to his trade finance company, recorded as loans from outside investors. The bulk cash drops traveled a different path: into an offshore business account held at a bank with a US branch relationship, then wired onward to a second offshore account, then into the trade finance front.
Each hop had a plausible commercial explanation. That is the entire point of the stage.

Integration is the final stage, when laundered funds return to the criminal as what appears to be legitimate income. At this point the money can be spent openly.
Launderers generally accept losing a percentage of the original sum along the way. They treat it as the cost of cleaning.
For the final hop, Mazur had cover letters and trade documents prepared to satisfy both the bank and the cartel's own launderers that the money returning to Colombia was legitimate. Corrupt Colombian bankers supplied official-looking export paperwork.
Two cover stories did the work. Either Mazur's trade finance entity had collected export revenue on behalf of the Colombian exporter receiving the wire, or it was making an advance payment against that exporter's projected US sales. Funds moved through a payable-through account at a Colombian bank's Miami branch, an arrangement where a local institution processes transactions for a foreign bank with no presence in the country. The Colombian recipient held no US account at all.
To a compliant-looking bank officer, none of this was unusual. Finance companies manage export revenue for exporters as a matter of course. Once the money landed, it was wired on to trafficker-controlled accounts as repatriated trade proceeds.
The model was built when money moved slowly, and that assumption no longer applies.
The stages compress. Instant payment rails collapse what used to take days into minutes. All three stages can complete inside a single session, which means detection built around overnight batch review is examining activity that already finished.
Placement distributes. Rather than one launderer structuring deposits across their own accounts, mule networks spread placement across hundreds of real accounts belonging to real people, many recruited online and unaware of what they are part of. There is no single anomalous account to flag. The pattern only exists across accounts, and often across institutions.
Layering moves off the ledger. Funds converted to stablecoins and moved across chains leave the visibility of any one institution. When they return, they arrive as an ordinary inbound transfer with no history attached.
What has not changed is that cash, precious metals, and real estate remain heavily used. New channels were added, not substituted.
The practical consequence: the model tells you what to look for, but increasingly not where. The signal that matters often sits between institutions rather than inside any one of them.
A practical way to check coverage: map your rules against the three stages and see where you are thin.
Most programs are strongest at placement and weakest at layering, which is unfortunate, because layering is where the money actually gets clean. The reason is structural. A layering signal in one account only means something when connected to a signal in another, and connecting them is analyst work most teams do not have the hours for.
Catching activity across all three stages comes down to two things.
Detection logic your team controls. Teams write and tune their own transaction monitoring rules directly, with no engineering ticket in the way. When a typology shifts, whoever understands the typology changes the rule that catches it the same day. Because the logic is explicit rather than a score, an examiner can be shown exactly why an alert fired.
Investigation that runs itself. Unit21's AI Agents work the alert rather than summarizing it: gathering evidence, assembling the transaction picture across accounts, drafting the narrative, and preparing the filing, with each step recorded. Teams can also build their own agents for specific workflows without writing code.
That second point is aimed at the layering problem directly. Connecting activity across accounts is exactly the work a human analyst would spend hours assembling by hand, and exactly the work that most often does not get done. Case management holds it through to regulatory filing.
A human still decides. The agent does the assembly. Detection is one piece of a wider program. For the surrounding context, see how to build an AML compliance program, what AML penalties and fines look like when a program fails, and where money laundering sits within financial crime more broadly.
For how detection actually gets built, see our complete guide to AML transaction monitoring. For the wider program context, start with our AML compliance guide.
What is the correct order of the three stages of money laundering?
Placement, then layering, then integration. Placement introduces illicit funds into the financial system, layering obscures their origin through repeated movement, and integration returns them to the criminal as apparent legitimate income.
Is structuring the same as layering?
No. Structuring, also called smurfing, is a placement technique: breaking a large sum into small deposits to get it into the financial system without triggering reporting thresholds. Layering happens afterward, once the funds are already inside. Many study guides conflate the two.
Which stage of money laundering is easiest to detect?
Placement. The funds are still close to their criminal source, and the activity, usually unusual cash volumes or deposits sitting just under reporting thresholds, stands out against normal behavior.
Which stage is hardest to detect, and why?
Layering. Each individual transaction looks unremarkable, and the pattern only emerges across multiple accounts, frequently across multiple institutions. Detecting it depends less on any single rule than on how much context is available when the alert is reviewed.
Can money laundering be detected in real time?
Placement and integration signals often can be, since both tend to produce activity that is anomalous against a customer's own history. Layering is harder for the reasons above, and real-time detection at that stage depends more on available context than on processing speed.
What are the most common red flags across the three stages?
Cash deposits structured just below reporting thresholds, transfers involving high-risk jurisdictions, transactions with no apparent business purpose, funds moving rapidly between accounts without accumulating, and asset purchases inconsistent with declared income.
Do all three stages always happen?
Not always in a clean sequence. Simple schemes can collapse placement and integration into almost one step, and instant payment rails can compress all three into a single session. The model describes what has to happen for money to be laundered, not how long each part takes.
How does trade-based money laundering map to the three stages?
Placement happens through false invoicing, layering through chains of trade transactions across jurisdictions, and integration through trade proceeds returning to the criminal as legitimate revenue. Operation Pro-Mo, described above, is a trade-based scheme end to end.
Next chapter: How to combat money laundering, with real-life examples
Previous chapter: The main types of money laundering and what they involve

Gal Perelman is the Product Marketing Lead at Unit21, where she spearheads go-to-market strategies for AI-driven risk and compliance solutions. With over a decade of experience in the fintech and fraud sectors, she has led high-impact launches for products like Watchlist Screening and AI Rule Recommendations.
Previously, Gal held marketing leadership roles at Design Pickle, Sightfull, and Lusha. She holds a Master’s degree from American University and a Bachelor’s from UCLA, and is dedicated to helping banks and fintechs navigate complex regulatory landscapes through innovative technology.