AML Fundamentals — Free Anti-Money Laundering Course

Money laundering is the process of making the proceeds of crime look like ordinary, explainable income. It exists because crime creates a problem: money that cannot be spent without questions. Laundering answers that question with a story the financial system will accept.

The textbook model has three stages.

Placement gets criminal funds into the financial system — cash deposited across many small transactions, taken through a cash-heavy business, loaded onto prepaid cards, or handed to a network of individuals who deposit on the criminal's behalf.

Layering breaks the link to the crime by moving the money through as many steps as possible: transfers between accounts, companies and countries; purchases and quick resales; conversion into crypto and back; invoices for services that were never delivered. Every hop makes the audit trail longer and the investigation more expensive.

Integration returns the money as apparently legitimate wealth: property, a business, a salary, a loan repaid, an investment return.

Real cases rarely follow those stages in a tidy order, and modern fraud proceeds often skip placement entirely, because the victim already sends money electronically. That is the crucial point for anyone working in fraud: when a romance or investment victim transfers money, the criminal starts at layering with clean-looking funds already inside the banking system.

The money laundered is not abstract. It is the pension of the person who was told they were buying crypto, and the deposit of the family that thought they were paying a builder.

Anti-money-laundering law is broadly consistent worldwide because it descends from a common source: the Financial Action Task Force, an intergovernmental body whose recommendations countries implement in their own statutes. That is why the same vocabulary — customer due diligence, beneficial ownership, suspicious activity reporting, risk-based approach — appears in every jurisdiction with slightly different names.

Obliged entities are the businesses required to comply. Banks and payment firms, obviously, but also crypto exchanges and wallet providers, money-transfer agents, casinos, accountants, lawyers in certain transactions, estate agents, and dealers in high-value goods. If you handle other people's money or high-value assets, some version of these rules reaches you.

Every obliged entity must have four things: a written risk assessment of the crime risk it faces; policies and controls proportionate to that risk; a named officer responsible for compliance; and training for staff.

The risk-based approach is the core idea and the most misunderstood. It does not mean everyone gets the same checks. It means you spend your effort where the risk is: light-touch checks for a low-risk salaried customer with a small local account, heavy checks for an offshore company structure with an unclear owner in a high-risk sector.

The penalties are not theoretical — the largest AML fines run into billions, and individual compliance officers have been personally sanctioned and, occasionally, prosecuted. But the reason that matters here is simpler: these rules are the main mechanism through which stolen money is spotted and, sometimes, returned.

Customer due diligence is the set of checks performed before and during a business relationship. It has four parts.

Identify the customer: name, date of birth, address, and for a company its legal name, registration number and registered office.

Verify that identity from a reliable, independent source — a government document checked against a live selfie, a registry record, a credit-reference footprint. Verification is what turns a claim into a check.

Identify beneficial owners: the real humans who ultimately own or control a company, usually anyone holding above a set percentage, plus anyone controlling it by other means. This is where laundering hides. A structure of three companies across two countries exists precisely so the answer to "who owns this" costs more to find than it is worth.

Understand the purpose and intended nature of the relationship: what this customer will use the account for, and what normal will look like. Without that baseline, monitoring has nothing to compare against.

Enhanced due diligence applies to higher-risk cases: politically exposed persons, complex or opaque ownership, high-risk jurisdictions, unusually large or unexplained wealth, and non-face-to-face onboarding with weak verification. It means more evidence, senior sign-off, and closer ongoing review — in particular, evidence of source of funds (where this specific money came from) and source of wealth (how the customer's overall wealth was built).

Ongoing monitoring is the part firms most often neglect. Customers change. A dormant personal account that suddenly receives thirty inbound transfers from strangers has changed, and the file that says "low risk, verified 2019" is now wrong.

No single red flag proves anything. Patterns do.

Structuring: repeated amounts just below a reporting or approval threshold — nine deposits of £9,000 rather than one of £81,000. Deliberate threshold avoidance is itself an offence in most jurisdictions.

Pass-through behaviour: money arriving and leaving within hours, in similar amounts, leaving a near-zero balance. Legitimate accounts hold funds; mule accounts move them.

Inconsistency with the profile: a student account receiving business-scale volumes, a landscaping firm paying overseas software invoices, a customer whose stated income cannot explain the flows.

Unexplained third parties: payments to and from people with no apparent connection to the customer, or a customer who cannot explain who is paying them.

Behavioural signals in the branch or on the call: reluctance to explain a transfer, an unusual rush, evident coaching by someone else, a customer reading from a script or being told what to say by someone on another phone. That last pattern is the clearest sign that the customer is a victim being defrauded in real time.

Trade-based laundering hides value in commerce: over- or under-invoicing goods, invoicing for goods that never move, multiple invoices for one shipment, and goods whose declared value has nothing to do with their market price. It is the hardest form to detect because it requires the analyst to know what things should cost.

What all of these share is a mismatch between the story and the flow. The analyst's job is to notice the mismatch and ask.

Screening is a separate obligation from due diligence, and firms conflate them at their peril.

Sanctions screening checks names against lists published by governments and international bodies. Sanctions are strict liability in most regimes: dealing with a listed person or entity is prohibited regardless of whether you knew. There is no risk-based discount. When a name matches, you freeze and report rather than proceed and investigate.

The practical problem is matching. Names transliterate several ways, dates of birth are approximate, and common names produce huge volumes of false positives. Good screening uses fuzzy matching to catch variants and then a documented human review to clear each hit, recording why the customer is or is not the listed person. Clearing a genuine match badly is far worse than a slow review.

Ownership matters too. A company is caught if it is owned or controlled by a listed person, even if the company itself is not named. This is why beneficial-ownership work and sanctions work cannot be separated.

Politically exposed persons are people holding prominent public functions, plus their close family and known associates. Being a PEP is not an accusation — it is a risk category, because such positions carry a higher bribery and corruption risk. PEPs require enhanced due diligence, senior approval and closer monitoring, not refusal by default.

Adverse-media screening completes the picture: a documented search for credible reporting linking the customer to financial crime. It is where fraud registries and public reporting feed directly into compliance decisions.

A money mule is a person who receives criminal money in their own account and passes it on, keeping a small cut. Mule networks are the plumbing of modern fraud: they turn a stolen transfer into cash or crypto faster than any bank can recall it.

Recruitment is rarely presented as crime. The common scripts are a job advert for a "payment processing agent" or "financial administrator" working from home; a romantic partner asking to route money through your account because theirs is being set up; a friend offering easy money for the use of your card; a fake charity or church collection; and a gaming or crypto community offering to "convert" funds. Students, new arrivals to a country, and people in financial distress are targeted hardest.

The consequences fall on the mule. Accounts are closed and the person is recorded on industry fraud databases, which can block banking for years. Prosecutions do happen. Many mules genuinely did not know — and "I did not know" is a weaker defence than people assume, because the law reaches suspicion, not just knowledge.

The detection pattern is consistent: a young or newly opened account, a sudden inbound payment from an unrelated party, immediate onward transfer or cash withdrawal, and repetition within days across several senders. Networks show up as many accounts sharing a device, an address, an IP range, or a common onward beneficiary.

The humane response matters. A first-time mule who was recruited under a false job offer is a victim and a witness as well as a link in the chain. Freeze, report, and educate — the network only survives while people believe the advert.

Crypto did not invent money laundering, but it changed the tempo and the toolkit.

What does not change: the obligations. Exchanges and custodial wallet providers are obliged entities in most major jurisdictions. They must do customer due diligence, screen against sanctions lists, monitor transactions and report suspicion. The Travel Rule requires originator and beneficiary information to accompany transfers above a threshold between providers, exactly as it does for wire transfers.

What changes in the criminal's favour: speed, borderlessness, and the ability to create unlimited addresses at no cost.

What changes in the investigator's favour, and this surprises people: most blockchains are permanently public. Every transaction is recorded, timestamped and readable by anyone, forever. Cash leaves no ledger; Bitcoin leaves the complete one. Addresses are pseudonymous, not anonymous — the analytical work is attribution, linking an address to a real controller through exchange records, reused addresses, timing patterns and off-chain evidence.

The laundering techniques to know: chain-hopping between assets and networks, cross-chain bridges, mixers and tumblers, privacy coins, peel chains that split funds through hundreds of small hops, and cash-out through peer-to-peer traders or complicit exchanges.

The red flags an analyst can act on: funds arriving directly from a mixer or a sanctioned service, an address created minutes before receiving a large transfer, immediate conversion into a stablecoin followed by dispersal, and a customer whose stated activity does not match on-chain behaviour.

Stablecoin issuers can freeze funds at specific addresses — which is why fast, accurate reporting sometimes actually recovers victim money.

The output of AML work is a report, and its quality decides whether anything happens.

The threshold is suspicion, not proof. If you know, suspect, or have reasonable grounds to suspect that funds are criminal property, you must report internally to your compliance officer, who decides whether to file with the national financial intelligence unit. You do not investigate to certainty first, and you do not need to identify the underlying crime.

Tipping off — telling the customer or a third party that a report has been made or an investigation is underway — is a criminal offence in most jurisdictions. Handle the customer normally and say nothing.

A good report contains: who the subject is and how they were identified; what specifically aroused suspicion, in plain sentences; the transactions concerned with dates, amounts, counterparties and reference fields; what the customer said when asked; what you checked and what you could not establish; and any linked accounts or parties. Write it so a stranger with no context can follow it in one pass.

A worked case. A three-month-old personal account, opened by a 22-year-old student, receives £4,800 from an unrelated individual. Within eleven minutes, £4,700 leaves in three transfers to two new payees. Two days later the same pattern repeats with a different sender. The customer, when called, says a friend is "paying rent through" the account and asks whether the transfers went through.

The flags: profile mismatch, pass-through timing, unrelated third parties, repetition, and a rehearsed-sounding explanation. The action: restrict, escalate internally, file the report, say nothing to the customer about it — and recognise that this student is probably a recruited mule who is about to lose their banking for years.