IFF501 · Foundations · Hypothetical, based on multiple public cases
The Wolfsberg Bakery: a placement primer
A small bakery chain in a coastal city quadruples reported cash revenue in eighteen months with no visible increase in customers or square footage. Local bank staff notice, tellers file internal alerts, but no STR is raised for eleven months.
PlacementCash-intensive businessRetail businessBankingCategory triageDeposit-pattern analysis
IFF502 · Foundations · Common-law jurisdiction, based on public FATF typology
The lawyer's client account
A solicitor's pooled client account receives USD 4.1 million from a client described only as 'a family trust based in Liechtenstein'. Funds are used to buy three residential properties over four months. No CDD file exists for the beneficial owner.
Client-account misuseProfessional enablingLegal professionBankingCDD file reviewRed-flag identification
IFF503 · Foundations · Composite; Southern African corridor
Tracing an evaluation finding to a national remediation commitment
A composite ESAAMLG member state receives a mutual evaluation with low effectiveness ratings on beneficial ownership and asset confiscation, is subsequently grey-listed, and must design a credible action-plan response distinguishing genuine institutional reform from cosmetic legislative gesture.
Technical-compliance gapSupervisionPublic policyReading a mutual evaluationRemediation planning
IFF504 · Foundations · Composite — Southern African corridor
The consultancy-fee cascade: tracing state-capture proceeds through a tax-and-laundering lens
A composite reconstruction, built from patterns documented across several Southern African state-capture and grand-corruption matters, tracing how procurement fraud proceeds were laundered through consultancy invoices, offshore shell entities and undeclared income, and showing where tax-crime predicates and civil forfeiture powers converged with a slow-moving criminal referral.
Consultancy-fee cascadeCorruption proceedsTax evasionConsultingPublic procurementPredicate-to-proceeds chainInvoice testing
IFF605 · Layering · Hypothetical multi-jurisdictional
Reconstructing the Sierra Holdings chain
A politically exposed minister of natural resources is suspected of receiving USD 40M in kickbacks. Payments trace to a chain: Local Mining Ltd → Sierra Holdings (BVI) → Blackreef Trust (Jersey) → Nominee (Cyprus) → Ultimate account (Singapore).
Shell companiesNominee directorsLayeringCorporate servicesRegistry tracingBeneficial-ownership reconstruction
IFF606 · Layering · Regional (Southern and East Africa dollar-clearing corridor)
The nested chain that hid a sanctioned counterparty
A regional bank routed dollar payments for a mining-sector client through a second-tier correspondent that presented itself as ordering institution to the ultimate US clearer, obscuring that the underlying originator's counterparty was a sanctioned entity operating under a similarly-named shell.
Nested correspondent accountsSanctions evasionBankingWire-chain reconstructionCounterparty screening
IFF607 · Layering · Cross-border (originating African victim, downstream exchange in a non-cooperating jurisdiction)
Chain-hopping a ransomware payment through a bridge and a privacy coin
A ransomware payment made in Bitcoin by a Kenyan logistics firm was traced through a peel chain, across a cross-chain bridge, into Monero, before resurfacing at a centralised exchange as a stablecoin cash-out, testing the practical limits of on-chain tracing across every technique covered in this module.
Chain-hoppingRansomware proceedsPrivacy coinsVirtual assetsBlockchain analyticsExchange attribution
IFF608 · Layering · Multi-jurisdictional (offshore holding, EU intermediate layer, African operating entity)
The architect's ledger: a professionally-designed multi-layer structure unravels
A whistleblower-provided internal ledger from a TCSP revealed the full build sequence of a five-layer structure designed to obscure the beneficial ownership of proceeds from a public procurement kickback scheme, illustrating the architect model, build sequencing and cost-budgeting logic examined in Lesson 3.
Designed layeringProfessional enablingLegal professionAccountingCorporate servicesStructure mappingAdviser file discovery
IFF609 · Layering · Composite, Southern African corridor
The taxi-rank remittance chain
A composite investigation traces proceeds from a cross-border smuggling operation as they move through a chain of a spaza-shop front, an unregistered hawaladar, and a mobile money agent network before a courier is interdicted attempting to carry the final settlement across a land border.
Cash couriersInformal value transferMobile moneyRemittanceMobile financial servicesCash-flow reconciliationAgent-network analysis
IFF610 · Integration · Composite, drawn from public FATF and GAFILAT studies
The Aden textile corridor
Between 2017–2020, textile exports declared from Country A to Country B totalled USD 340M. Import declarations in Country B for the identical HS codes and shipments totalled USD 118M. The USD 222M gap is unexplained by transport costs.
Trade mis-invoicingOver-invoicingTBMLTradeTextilesBankingUnit-price benchmarkingDocumentary comparison
IFF611 · Integration · Composite, drawn from Zambian and DRC copper-belt audit practice
The copper concentrate marketing hub
A copper mining subsidiary sells 100% of its concentrate output to a related marketing company incorporated in a low-tax jurisdiction, at a price fixed one month before shipment and never revisited even as LME prices move sharply in the interim. The marketing company, with two employees, on-sells the same cargo within days to smelters in Asia at the prevailing spot price, retaining the full spread.
Transfer mispricingMarketing hubProfit shiftingMiningCommodity tradingComparability analysisSubstance testing
IFF612 · Integration · South Africa / Germany, exposed 2017 and 2020 respectively · documented matter
The Steinhoff-Wirecard comparative teaching file
Two of the most consequential corporate accounting collapses of the last decade, occurring within three years of each other in different regulatory environments, illustrate the two dominant manipulation archetypes: related-party circular transactions inflating real but overstated operations (Steinhoff), and wholesale fabrication of non-existent cash and revenue (Wirecard).
Financial statement manipulationRelated-party fraudRetailFintechAuditStatement analysisAudit-trail testing
IFF613 · Integration · Composite, drawing on UK Register of Overseas Entities public data and documented DRC-UAE gold-trade reporting · documented matter
The London townhouse and the DRC gold corridor
A senior official from a resource-rich developing economy is beneficially connected to a Marshall Islands entity holding a London townhouse acquired for GBP 12 million in cash, while separately, artisanal gold from the same official's home region is documented, per UN Panel of Experts reporting, moving through a smuggling corridor into a Gulf refining hub with limited provenance verification.
Real-estate integrationGold tradeLuxury assetsReal estatePrecious metalsRegister interrogationAsset attribution
IFF614 · Integration · Composite — Southern African corridor
The captured locomotive tender
A composite reconstruction, drawing on publicly documented SOE procurement patterns, of a rolling-stock supply contract at a state logistics utility in which specification steering, an inflated award, and a chain of consultancy invoices routed a substantial margin to a network of politically connected intermediaries and a related family trust.
Procurement corruptionState captureKickbacksPublic procurementTransportTender-file reviewPolitical-exposure mapping
IFF715 · Mastery · Composite, drawn from multiple African and Latin American cases
The Ministry contract kick-back reconstruction
A public-works contract of USD 180M is procured. The contractor's audited accounts show USD 12M in 'consultancy fees' to three offshore entities. Reconstruction reveals the fees fund three residential properties and a fleet of vehicles held for the minister's family.
Kick-back reconstructionCorruption proceedsPublic contractingForensic reconstructionSchedule building
IFF716 · Mastery · Composite, modelled on ESAAMLG-region corruption cases with offshore intermediary jurisdictions
The eighteen-month gap: a transnational bribery case stalled on evidence
A senior state-owned enterprise official is suspected of receiving bribes from a foreign contractor, laundered through a shell company incorporated in an intermediary offshore jurisdiction and an account at a correspondent bank abroad. Domestic prosecutors have strong circumstantial evidence of unexplained wealth but need the offshore bank records to prove the bribery predicate and the ownership of the shell.
Transnational briberyEvidence delayPublic sectorBankingMLA draftingAdmissibility planning
IFF717 · Mastery · Switzerland / Nigeria / United Kingdom / United States · documented matter
The Abacha billions: two decades from freeze to (partial) return
Following the death of General Sani Abacha in 1998, Nigeria and several asset-holding states pursued the tracing, freezing, confiscation and return of an estimated several billion dollars in embezzled state funds held across dozens of accounts and shell structures, in a process that has continued in tranches for more than two decades.
Grand corruptionAsset repatriationPublic sectorPrivate bankingConfiscation strategyReturn negotiation
IFF718 · Mastery · South Africa · documented matter
South Africa: from 2023 grey-listing to 2025 delisting
South Africa's February 2023 FATF grey-listing followed a 2021 Mutual Evaluation Report exposing Effectiveness gaps closely linked to state-capture-era institutional weakening. Its October 2025 delisting followed a structured action plan focused on demonstrable enforcement outcomes rather than legislative amendment alone.
Grey-listingEffectiveness failureSupervisionPublic policyMetric designInstitutional diagnosis
IFF719 · Mastery · Composite, Southern African corridor
The shell-hub remittance network
A composite investigation traces how a professional company-formation agent used a cluster of shelf companies, a regional remittance platform and a co-opted junior compliance analyst to launder proceeds of tax-refund fraud, illustrating how financial intelligence analytics — from STR triage through network mapping to model-flagged alerts — eventually converged on the enabler rather than the nominal account holders.
Shell-hub networkRemittance layeringRemittanceBankingNetwork analyticsTypology detection
IFF720 · Mastery · Composite — Southern African corridor
The unravelling of the 'reference-priced' concentrate schedule
A revenue authority's forensic accountant built a multi-year net-worth and tracing schedule against a mining-services executive accused of receiving kickbacks disguised as consultancy fees, only for the case to be tested hard on custody, methodology and independence at trial.
Reference pricingCommodity mispricingMiningCommodity tradingExpert testimonyCase-file construction