TL;DR: The three stages of money laundering are placement (getting illicit funds into the financial system), layering (moving them through transactions that break the trail back to the crime), and integration (spending or investing them as apparently legitimate wealth). The model maps controls well, but real schemes overlap and compress stages. Nasdaq Verafin's 2026 Global Financial Crime Report estimates $4.4 trillion in illicit funds moved through the global financial system in 2025, and 63 percent of surveyed professionals named professional laundering networks as their top concern.
One Process, Three Functions
Money laundering is the process of making criminal proceeds appear legal. FinCEN describes it as typically involving three steps: placement, where illegitimate funds are introduced into the financial system; layering, where the money is moved around to create confusion; and integration, where additional transactions make the money appear clean. The thread connecting all three is the paper trail. Every BSA reporting requirement exists to generate that trail, and every laundering technique exists to avoid, fragment, or falsify it.
Each stage leaves a different signature in transaction data and is exposed to a different control.
Placement: Getting Value Into the System
Placement is the point at which criminal proceeds first touch a regulated institution. When the proceeds are physical cash, this is the launderer's most exposed moment: a deposit requires an account, an account requires an identity, and currency above $10,000 in a business day requires a CTR.
Structuring is the most familiar: splitting cash into deposits under the CTR threshold. Smurfing is structuring with a workforce, where several individuals make sub-threshold deposits across branches and days. Funnel accounts add geography. FinCEN's funnel account advisory defines one as an account in one geographic area that receives multiple cash deposits, often below the reporting threshold, from which funds are withdrawn in a different geographic area shortly afterward. A Southern California produce company whose account takes small cash deposits at branches in Chicago, Indianapolis, and Minneapolis is FinCEN's own example.
Cash-intensive businesses offer a route where the explanation is built in: a restaurant or car wash absorbs illicit cash into daily receipts and the deposit looks ordinary. Crypto kiosks are a newer channel; FinCEN's August 2025 notice describes operators structuring transactions and scam victims coached to split cash across multiple kiosks.
Increasingly, placement is not a cash event at all. A mule account opened on a fintech app with a real or synthetic identity is the placement vehicle for fraud proceeds that already exist as electronic value. FinCEN's August 2025 analysis of Chinese money laundering networks noted mules who listed occupations such as student or retired at onboarding and then ran volumes those occupations cannot explain.
In transaction data, placement looks like cash clustered just below $10,000, deposits far from where the account is domiciled, volume inconsistent with stated occupation or business, rapid outbound movement of fresh deposits, and accounts that turn high-velocity within days of opening.
Layering: Breaking the Trail
Layering separates the money from its source by running it through enough transactions, entities, and jurisdictions that no single institution can see the whole path. Placement is a bottleneck. Layering is a maze, and the stage most likely to pass through a compliant institution that was never the entry point.
Shell companies are the primary tool. An entity with no operations, nominee directors, and a registered agent's address can hold an account, receive wires, and send them onward, and a chain of such entities across several jurisdictions turns a two-hop transfer into a ten-hop one. The red flags for shell companies are the same mid-flow as at onboarding: opaque ownership, no footprint, revenue with no visible activity behind it.
Trade-based money laundering moves value through commerce instead. Over-invoicing, under-invoicing, phantom shipments, and misdescribed goods let a payment for imports carry illicit value across a border with commercial paperwork attached. FinCEN's August 2025 Financial Trend Analysis on Chinese money laundering networks identified trade-based laundering, money mules, and mirror transactions as those networks' core methods, across 137,153 BSA reports totaling approximately $312 billion in suspicious transactions between January 2020 and December 2024. In a mirror transaction, dollars change hands in the United States and equivalent value changes hands abroad; nothing crosses the border.
On-chain layering uses mixers, which pool and redistribute funds to sever the link between input and output addresses, and chain-hopping, which FinCEN describes as swapping proceeds into a stablecoin through cross-chain bridges so that tracing must cross ledgers. The FATF's June 2025 targeted update reported that most on-chain illicit activity now involves stablecoins.
Layering shows up in data as velocity and incoherence rather than size. Funds arrive and leave within hours with little balance retained. Counterparty counts spike. Round-dollar amounts repeat. Wires route through jurisdictions with no link to the customer's stated business, and invoice values diverge from shipping documents or market prices. Each institution along the route sees one wire at a time.
Integration: Spending It Like Income
Integration is the stage where laundered funds re-enter the economy as assets or income the criminal can use openly. The money now has a history; the goal is to give it a story. Because integration transactions are built to look like ordinary commerce, they are the hardest to catch on transaction data alone.
Real estate is the dominant vehicle. A property bought through an LLC or trust, paid for without a mortgage, becomes a store of value with a clean title. FinCEN's Chinese money laundering network analysis found 17,389 BSA reports tied to more than $53.7 billion in suspicious real estate activity, much of it purchased through mules or shell companies. FinCEN's Residential Real Estate Rule, which required reports on non-financed transfers to legal entities and trusts closing on or after March 1, 2026, was vacated by a federal court on March 19, 2026, so that gap is open again as of this writing.
Other routes include booking illicit funds as revenue or capital in a legitimate business, loan-back schemes in which the launderer borrows their own money from a controlled offshore entity, and purchases of art, vehicles, and jewelry.
Integration looks like a newly formed entity funding a large purchase, assets that outrun documented income, related-party loans with no commercial rationale, and revenue that is smooth, round, and detached from payroll or supplier payments.
Why the Three-Stage Model Is a Simplification
Real schemes rarely run through the stages in order. Trade-based laundering can perform all three in a single over-invoiced shipment: the payment places value, the trade documents layer it, and the goods sold at destination integrate it. Ransomware, investment scams, and business email compromise generate proceeds that already exist as electronic value, so the money starts in layering with no cash placement at all. Integrated funds fund the next predicate offense, so the process is a cycle, not a line.
The biggest shift is that placement has moved from the teller window to the onboarding flow. When a launderer's first regulated touchpoint is a mobile account opening with an uploaded ID and a selfie, placement is a KYC event, not a cash event. Synthetic identities, recruited mules, and forged documents do at digital onboarding what smurfs used to do at branches, and currency reporting rules catch a shrinking share of it.
Laundering networks sell placement, layering, and integration as separate services, so the actor an institution sees in one stage may have no connection to the actor in the next. The labels also carry no legal weight: no regulation requires classifying activity by stage, and the SAR standard asks only whether a transaction has no business or apparent lawful purpose or is not the sort the customer would normally conduct. The model helps a team decide where to look. It does not decide whether to file.
Mapping Controls to Stages
Each stage exposes a different control surface. A program that concentrates on one leaves the others open.
Placement controls are rule-based and threshold-driven, so launderers know exactly where the lines sit. Layering controls depend on transaction monitoring that builds a behavioral baseline per customer and flags departures from it, paired with network analysis that connects accounts sharing devices, addresses, counterparties, or beneficial owners. Integration controls live in due diligence rather than the monitoring engine: who owns the buying entity, and whether the stated source of wealth can fund the purchase.
A single alert rarely announces its stage. That takes the account history, the counterparties, and the KYC file pulled together, which is where most of an investigator's day goes.
Where Sphinx Fits
Sphinx deploys AI agents inside the case management and monitoring systems analysts already use. When an alert fires, an agent gathers account history, counterparty profiles, onboarding documents, and prior alerts, then writes up what the activity looks like across the three stages: cash patterns that indicate placement, pass-through behavior and counterparty structure that indicate layering, or a purchase or loan that indicates integration against the customer's documented wealth. Every step is logged and every conclusion cites its data, so the analyst reviews a reasoned narrative rather than a raw alert and an examiner can trace the disposition. The agent does not decide whether to file; it gets the analyst to that decision with the evidence already assembled.
Frequently Asked Questions
What are the three stages of money laundering?
The three stages are placement, layering, and integration. Placement introduces criminal proceeds into the financial system, layering moves them through transactions and entities to obscure their origin, and integration returns them to the criminal as apparently legitimate assets or income.
Which stage of money laundering is easiest to detect?
Placement, when it involves physical cash, because currency has to enter an account at a regulated institution and cash above $10,000 in a business day triggers a CTR. Digital placement through mule accounts and synthetic identities is harder to catch, so onboarding controls now matter as much as cash controls.
Is structuring the same as placement?
No. Structuring is one placement technique: splitting cash into deposits below the CTR threshold to avoid a report, and it is a separate federal crime under 31 U.S.C. 5324 regardless of where the money came from. Placement also includes smurfing, funnel accounts, cash-intensive fronts, bulk cash smuggling, and fraud proceeds deposited into mule accounts.
Do all money laundering schemes go through all three stages?
No. Trade-based laundering can perform all three functions in a single transaction, and cyber-enabled crimes such as ransomware or investment scams generate electronic proceeds that skip cash placement entirely. The stages are analytical functions, not a required sequence, and they can overlap, repeat, or run out of order.
Which stage is most dangerous for a financial institution?
Layering, because it is the stage most likely to pass through an institution that was not the entry point for the funds. Correspondent banking, wire chains, and shell company accounts route illicit money through compliant banks whose monitoring sees only one hop of a longer path.
.png)
