Unit21 for AML

The 3 Stages of Money Laundering: Placement, Layering, & Integration

Published
January 5, 2024
Read Time
10
mins
Gal Perelman
Gal Perelman
Product Marketing Lead, Unit21
Subscribe to stay informed
Table of contents

Money laundering only works if nobody can trace where the money came from. That single requirement shapes the whole process, and it explains why schemes that look nothing alike on the surface follow the same three steps underneath: get the money into the financial system, move it around until the trail goes cold, then bring it back out looking earned.

Those steps are placement, layering, and integration. They matter to anyone building AML controls because each one leaves a different kind of evidence, and each one calls for a different detection approach. A control tuned for placement will miss layering entirely.

Below: each stage in detail, the methods criminals actually use, and what each one looked like inside a real cartel laundering operation.

What is money laundering?

Money laundering is the process of disguising the origin of criminally obtained funds so they can be spent without attracting suspicion. The money starts out traceable to a crime. It ends up looking like income, an asset sale, or a business payment.

For obvious reasons the scale is hard to measure precisely. The UN Office on Drugs and Crime estimates that between 2% and 5% of global GDP is laundered annually.

What are the 3 stages of money laundering?

The three stages, in order, are placement, layering, and integration.

Stage What happens How detectable
1. Placement Illicit funds enter the financial system through deposits, purchases, or cash-intensive businesses Easiest. The money is still close to its criminal source
2. Layering Funds move through transactions, accounts, and jurisdictions until the trail is obscured Hardest. Activity looks like ordinary financial behavior
3. Integration Funds return to the criminal as apparent legitimate income or asset proceeds Hard alone, easier when tied back to earlier stages

The three stages of money laundering

Placement is where institutions have the best chance of catching activity. The money has not yet been distanced from the crime, so the anomaly is still visible. By layering, the transactions look like everything else on the ledger.

To show what these stages look like from the inside, we drew on the work of Robert Mazur, the former US federal agent who spent years undercover inside the Medellín and Cali cartels as a money launderer. His account appears in his book The Betrayal.

Between 1992 and 1994, Mazur ran an operation codenamed Pro-Mo, short for professional money launderers. He worked out of Sarasota, Panama City, and Bogotá under the identity of Robert Baldasare, a fabricated persona controlling a mortgage brokerage, a trade finance company, several offshore entities, and a Liechtenstein foundation. The fronts existed to attract Cali cartel associates looking for someone to wash drug proceeds.

Stage 1: Placement

Placement: the first layer of money laundering

Placement is the first stage, when illicit funds are introduced into the financial system. The goal is to get money into an account, an instrument, or an asset without triggering a report.

The most common approach is splitting a large sum into smaller amounts and funneling them through multiple accounts or deposits, each one small enough to stay under reporting thresholds. This is called structuring, or smurfing.

Common placement methods

  • Disguised deposits. Large sums broken into smaller amounts and deposited across several accounts over time, then consolidated later.
  • Blending of funds. Illicit cash mixed with legitimate revenue, usually through a cash-intensive business where the two are hard to separate.
  • Cash smuggling. Currency physically carried across borders, deposited abroad, then wired back.
  • Foreign exchange. Illicit funds converted into foreign currency in jurisdictions with looser controls.
  • Financial instruments. Money orders, cashier's checks, traveler's checks, and postal orders bought with cash, then deposited elsewhere to add a layer of apparent history.
  • Asset purchases. Real estate, vehicles, artwork, or precious metals bought with cash and resold later for clean funds.

How placement worked in Operation Pro-Mo

Two conduits fed the operation. The first was bulk non-depository checks delivered by covert partners, money that low-level couriers had already placed into the system. Most of these instruments, Moneygrams, cashier's checks, traveler's checks, and money orders, were written under $3,000 and in odd amounts, specifically to stay beneath money services business recordkeeping requirements. The second conduit was simpler: duffle bags of cash, six figures to low seven figures per drop.

Mazur has said this mechanism for moving value is still working today. The instruments have changed. The structure has not.

Stage 2: Layering

Layering: The second stage of money laundering
Layering: The second stage of money laundering

Layering is the second stage, when funds already inside the system are moved repeatedly to break the connection to their source. The aim is to build enough transaction history that the money's origin becomes impractical to reconstruct.

This is the hardest stage to detect, because by design it looks like normal financial activity: transfers, trades, business payments, loans.

One point worth getting right: structuring is not layering. Structuring, also called smurfing, is a placement technique. It means breaking cash into small deposits to get it into the system without triggering reporting thresholds. Layering happens afterward, once the money is already inside. A lot of study material conflates the two.

Common layering methods

  • Electronic transfers. Funds moved through a chain of personal and business accounts, each hop adding distance from the source.
  • Purchasing financial instruments. Stocks, bonds, insurance products, and money orders bought and later liquidated.
  • Buying and selling assets. Property or investments acquired and resold, so the proceeds arrive as a clean sale.
  • International transactions. Funds routed through multiple jurisdictions to exploit gaps between regulators.
  • Business transactions. Payments for goods or services that were never delivered, or private loans between related entities.
  • Cryptocurrency and virtual asset trading. Funds moved across platforms and chains for the perceived anonymity.

How layering worked in Operation Pro-Mo

Mazur's mortgage company owned a check-cashing business, which let him take in the bulk checks, endorse the blank payee field with his own business stamp, and deposit the proceeds into the company account. He took his fee and wired the rest onward to his mortgage business.

From there, funds moved to his trade finance company, recorded as loans from outside investors. The bulk cash drops traveled a different path: into an offshore business account held at a bank with a US branch relationship, then wired onward to a second offshore account, then into the trade finance front.

Each hop had a plausible commercial explanation. That is the entire point of the stage.

Stage 3: Integration

Integration: The third stage of money laundering

Integration is the final stage, when laundered funds return to the criminal as what appears to be legitimate income. At this point the money can be spent openly.

Launderers generally accept losing a percentage of the original sum along the way. They treat it as the cost of cleaning.

Common integration methods

  • Transfers back to legitimate accounts. Bank transfers, shareholder dividends, or loans that will never be repaid.
  • Selling assets. Property or investments acquired during layering, sold so the proceeds arrive through an apparently ordinary transaction.
  • Fake salaries. Payroll systems paying employees who do not exist, with the criminal collecting the wages.
  • Business investment. Capital injected into real or fabricated companies, returning as dividends or profits.

How integration worked in Operation Pro-Mo

For the final hop, Mazur had cover letters and trade documents prepared to satisfy both the bank and the cartel's own launderers that the money returning to Colombia was legitimate. Corrupt Colombian bankers supplied official-looking export paperwork.

Two cover stories did the work. Either Mazur's trade finance entity had collected export revenue on behalf of the Colombian exporter receiving the wire, or it was making an advance payment against that exporter's projected US sales. Funds moved through a payable-through account at a Colombian bank's Miami branch, an arrangement where a local institution processes transactions for a foreign bank with no presence in the country. The Colombian recipient held no US account at all.

To a compliant-looking bank officer, none of this was unusual. Finance companies manage export revenue for exporters as a matter of course. Once the money landed, it was wired on to trafficker-controlled accounts as repatriated trade proceeds.

The three stages of money laundering - explained

Why the three-stage model still holds, and where it strains

The model was built when money moved slowly, and that assumption no longer applies.

The stages compress. Instant payment rails collapse what used to take days into minutes. All three stages can complete inside a single session, which means detection built around overnight batch review is examining activity that already finished.

Placement distributes. Rather than one launderer structuring deposits across their own accounts, mule networks spread placement across hundreds of real accounts belonging to real people, many recruited online and unaware of what they are part of. There is no single anomalous account to flag. The pattern only exists across accounts, and often across institutions.

Layering moves off the ledger. Funds converted to stablecoins and moved across chains leave the visibility of any one institution. When they return, they arrive as an ordinary inbound transfer with no history attached.

What has not changed is that cash, precious metals, and real estate remain heavily used. New channels were added, not substituted.

The practical consequence: the model tells you what to look for, but increasingly not where. The signal that matters often sits between institutions rather than inside any one of them.

Red flags at each stage

A practical way to check coverage: map your rules against the three stages and see where you are thin.

Stage What to watch for
Placement Deposits clustered just below reporting thresholds, cash volumes inconsistent with a stated business type, new accounts receiving rapid inbound cash, the same funding source appearing across unrelated accounts
Layering Rapid in-and-out transfers leaving little balance, round-number transfers between related parties, payments with no clear commercial rationale, activity spanning high-risk jurisdictions, funds cycling through virtual asset platforms
Integration Asset sales inconsistent with declared income, loan repayments from unexplained sources, payroll to employees with no verifiable identity, dividends from entities with no discernible operations

Most programs are strongest at placement and weakest at layering, which is unfortunate, because layering is where the money actually gets clean. The reason is structural. A layering signal in one account only means something when connected to a signal in another, and connecting them is analyst work most teams do not have the hours for.

Working these stages with Unit21

Catching activity across all three stages comes down to two things.

Detection logic your team controls. Teams write and tune their own transaction monitoring rules directly, with no engineering ticket in the way. When a typology shifts, whoever understands the typology changes the rule that catches it the same day. Because the logic is explicit rather than a score, an examiner can be shown exactly why an alert fired.

Investigation that runs itself. Unit21's AI Agents work the alert rather than summarizing it: gathering evidence, assembling the transaction picture across accounts, drafting the narrative, and preparing the filing, with each step recorded. Teams can also build their own agents for specific workflows without writing code.

That second point is aimed at the layering problem directly. Connecting activity across accounts is exactly the work a human analyst would spend hours assembling by hand, and exactly the work that most often does not get done. Case management holds it through to regulatory filing.

A human still decides. The agent does the assembly. Detection is one piece of a wider program. For the surrounding context, see how to build an AML compliance program, what AML penalties and fines look like when a program fails, and where money laundering sits within financial crime more broadly.

For how detection actually gets built, see our complete guide to AML transaction monitoring. For the wider program context, start with our AML compliance guide.

Frequently asked questions

What is the correct order of the three stages of money laundering?

Placement, then layering, then integration. Placement introduces illicit funds into the financial system, layering obscures their origin through repeated movement, and integration returns them to the criminal as apparent legitimate income.

Is structuring the same as layering?

No. Structuring, also called smurfing, is a placement technique: breaking a large sum into small deposits to get it into the financial system without triggering reporting thresholds. Layering happens afterward, once the funds are already inside. Many study guides conflate the two.

Which stage of money laundering is easiest to detect?

Placement. The funds are still close to their criminal source, and the activity, usually unusual cash volumes or deposits sitting just under reporting thresholds, stands out against normal behavior.

Which stage is hardest to detect, and why?

Layering. Each individual transaction looks unremarkable, and the pattern only emerges across multiple accounts, frequently across multiple institutions. Detecting it depends less on any single rule than on how much context is available when the alert is reviewed.

Can money laundering be detected in real time?

Placement and integration signals often can be, since both tend to produce activity that is anomalous against a customer's own history. Layering is harder for the reasons above, and real-time detection at that stage depends more on available context than on processing speed.

What are the most common red flags across the three stages?

Cash deposits structured just below reporting thresholds, transfers involving high-risk jurisdictions, transactions with no apparent business purpose, funds moving rapidly between accounts without accumulating, and asset purchases inconsistent with declared income.

Do all three stages always happen?

Not always in a clean sequence. Simple schemes can collapse placement and integration into almost one step, and instant payment rails can compress all three into a single session. The model describes what has to happen for money to be laundered, not how long each part takes.

How does trade-based money laundering map to the three stages?

Placement happens through false invoicing, layering through chains of trade transactions across jurisdictions, and integration through trade proceeds returning to the criminal as legitimate revenue. Operation Pro-Mo, described above, is a trade-based scheme end to end.

Next chapter: How to combat money laundering, with real-life examples

Previous chapter: The main types of money laundering and what they involve

Gal Perelman
Gal Perelman
Product Marketing Lead, Unit21

Gal Perelman is the Product Marketing Lead at Unit21, where she spearheads go-to-market strategies for AI-driven risk and compliance solutions. With over a decade of experience in the fintech and fraud sectors, she has led high-impact launches for products like Watchlist Screening and AI Rule Recommendations.

Previously, Gal held marketing leadership roles at Design Pickle, Sightfull, and Lusha. She holds a Master’s degree from American University and a Bachelor’s from UCLA, and is dedicated to helping banks and fintechs navigate complex regulatory landscapes through innovative technology.

Learn more about Unit21
Unit21 is the leader in AI Risk Infrastructure, trusted by over 200 customers across 90 countries, including Sallie Mae, Chime, Intuit, and Green Dot. Our platform unifies fraud and AML with agentic AI that executes investigations end-to-end—gathering evidence, drafting narratives, and filing reports—so teams can scale safely without expanding headcount.
AI Tasks
|
7
min

AI Task Spotlight | Edition No. 08: Account Takeover — Before vs. After Access Change

Gal Perelman
Gal Perelman
Product Marketing Lead, Unit21
This is some text inside of a div block.
Risk and Compliance Operations
|
5
min

Progressive autonomy: the trust ladder for AI in compliance

Gal Perelman
Gal Perelman
Product Marketing Lead, Unit21
This is some text inside of a div block.
Unit21 for Crypto
|
5
min

Gate US leads in one of the fastest-growing corners of crypto, with Unit21’s flexibility and real-time detection by its side

Cassie Pallesen
Cassie Pallesen
VP, Marketing
This is some text inside of a div block.
See Us In Action

Boost fraud prevention & AML compliance

Fraud can’t be guesswork. Invest in a platform that puts you back in control.
Get a Demo