L-03 · Integration

Trade-Based Money Laundering (TBML)

The largest, least-detected laundering channel: moving value under cover of legitimate trade flows.

Module lecturer: Dr. Collen Lediga, Ruhr-Universität Bochum

Module progress
0 / 4 lessons140 min remaining

Visual overview

Interactive figure

Trade-based money laundering · four core techniques

Click any node · hover for tooltip

Value gapoff-book transferOver-invoiceUnder-invoicePhantom shipmentHS mis-class.

Lessons

LESSON 0140 min read

TBML typologies: over-, under-, phantom, multiple invoicing

Figure 4.1 · Trade mispricing

A widening gap between declared and market price

Copper concentrate exports from a single exporter-importer pair. Every dollar of daylight is a dollar re-routed abroad.

$1.00$2.00$3.00$4.00$5.00JANFEBMARAPRMAYJUNMarketDeclared$3.30 / lb re-routed in June

Source · Simulated dataset; benchmark: LME cash settlement

This is the module where the estimates and the enforcement statistics diverge most violently, and I want you to hold both figures in mind with some scepticism as you read. Trade-Based Money Laundering (TBMLTBMLTrade-Based Money Laundering, moving illicit value under cover of trade transactions.) is the process of disguising the proceeds of crime and moving value through the use of trade transactions to legitimise their illicit origins. It is, on almost every credible estimate, the LARGEST laundering channel globally by value, and the LEAST DETECTED in enforcement statistics. Global Financial Integrity's cumulative country-level estimates place trade mis-invoicing in the hundreds of billions of dollars per year; FATF's 2020 TBMLTBMLTrade-Based Money Laundering, moving illicit value under cover of trade transactions. update quantifies the same phenomenon; UNCTAD's IFF estimates for Africa attribute the largest share to commercial IFF, of which TBMLTBMLTrade-Based Money Laundering, moving illicit value under cover of trade transactions. is the principal vehicle. The mismatch between TBMLTBMLTrade-Based Money Laundering, moving illicit value under cover of trade transactions.'s estimated scale and its enforcement footprint reflects both the technical difficulty of proving mis-pricing beyond reasonable doubt and the institutional distribution of the problem — customs administrations, tax administrations, banks and FIUs each see only fragments, and few jurisdictions have integrated the fragments into a single investigative view.

FATF, the Egmont Group and the World Customs Organization together identify four dominant typologies.

OVER-INVOICING

The exporter invoices the importer at a price above the fair market value. The excess payment is a transfer of value from the importer's jurisdiction to the exporter's jurisdiction, laundered under cover of an apparently ordinary trade payment. The classic use case is corruption: a state-owned buyer in country A overpays a private supplier in country B; the excess accumulates in country B, controlled by the bribe recipient's offshore structure. A second use case is capital flight: a resident of country A wishes to move wealth abroad against exchange-control rules and does so by over-paying an offshore counterparty controlled by the same beneficial owner.

UNDER-INVOICING

Mirror image. The exporter under-declares the price to customs; the importer pays the declared amount through the banking system and the balance "off-book" through a settlement mechanism (an offshore account, a hawala arrangement, a physical cash payment, or a corresponding under-invoicing in a reverse trade). This is the workhorse of capital flight from developing countries: an exporter of natural resources declares a below-market price to the domestic customs and tax authorities, retains the price differential in an offshore vehicle, and thereby strips both foreign exchange and tax base from the exporting country. UNCTAD's mineral-export analyses have documented systematic under-invoicing for gold and diamonds; academic literature has quantified crude-oil under-invoicing at material fractions of headline export values.

PHANTOM SHIPMENTS

No goods physically move at all; only invoices and payments. Bills of lading, inspection certificates, and packing lists are fabricated or bought from complicit freight forwarders. Container-level tracking, port-authority data, and satellite AIS shipping data can be used to test whether declared shipments actually occurred, but such cross-checks require infrastructure many customs administrations do not routinely deploy. Phantom shipments are usually detected downstream, through banking-side anomaly detection when payment patterns are inconsistent with any physical trade; rather than at the port.

MULTIPLE INVOICING

The same shipment is invoiced repeatedly through different intermediaries in a chain of related parties, each with a plausible mark-up. Each hop launders a further tranche of value while producing an audit trail of "commercial" documentation. Multiple invoicing is often combined with routing through Free Trade Zones (where customs oversight is deliberately light) and with the use of third-country freight forwarders whose escrow arrangements sever the payment audit trail from the physical goods flow.

Beyond the four canonical typologies, three variants deserve attention. MIS-CLASSIFICATION: the goods are declared under a different HS (Harmonized System) code from the actual product, exploiting differences in tariff and reporting thresholds. FALSIFIED DESCRIPTION OF GOODS: the declared category and quality are inflated (industrial-grade metal declared as jewellery-grade) or deflated. SERVICE MIS-PRICING: intra-group service fees, management, IT, brand licensing — are set at rates for which fair-market comparators barely exist, and are among the most powerful vehicles for base erosion by multinationals; while this shades into transfer-pricing rather than TBMLTBMLTrade-Based Money Laundering, moving illicit value under cover of trade transactions. in the classical sense, it uses the same instrument (an over- or under-priced invoice) and defeats detection through similar methods.

DETECTION relies principally on PRICE FILTER ANALYSIS: comparing declared unit values (from customs declarations, at HS-code granularity) against fair-market benchmarks. The benchmarks are derived from commodity indices where available (LME for base metals, ICE for coffee, S&P Platts for oil, Kimberley Process for rough diamonds); from prior-period medians of the same trade flow; from cross-country comparables (unit values declared for the same HS codeHS codeHarmonized System code — the international commodity classification used in customs declarations. from country A to country C versus A to B in the same month); or from the BERGER-NITSCH bilateral-trade-gap methodology, which compares reported exports from country A to country B with reported imports into country B from country A, at HS-code granularity, in the same period. Systematic and persistent gaps beyond transport costs and insurance/freight adjustments are the primary TBMLTBMLTrade-Based Money Laundering, moving illicit value under cover of trade transactions. signal. Global Financial Integrity has published country-level estimates using this method for over a decade; the OECD's "Illicit Financial Flows: The Economy of Illicit Trade in West Africa" (2018) applied related techniques to specific commodities. Statistical outliers identified by these techniques become priority audit targets — but the method identifies pattern, not proof: individual transactions still require transactional review to convert the statistical signal into evidential fact.

ADDITIONAL SIGNALS include: HS-code mismatch between origin and destination declarations for the same physical shipment; unusually round declared quantities and prices (round numbers appear more often in fabricated data than in genuine commercial pricing); use of Free Trade Zones as pass-through with no value-added activity; payments routed through jurisdictions unrelated to the commercial parties; concentration of a large number of exporter entities on a small number of shared corporate service providers, addresses, or bank accounts, and mismatches between the shipping documentation and the payment documentation on identity of counterparty, currency, or delivery terms (Incoterms 2020 assignments that are commercially implausible).

SECTORAL CONCENTRATIONS

TBMLTBMLTrade-Based Money Laundering, moving illicit value under cover of trade transactions. is not evenly distributed. It concentrates in: extractive commodities (oil, gold, gemstones, base metals); high-value low-mass goods where over-invoicing is easy and shipping is cheap (electronics, luxury goods, textiles at the higher price points); intermediate goods with fragmented HS classification (plastics, chemicals), and services (management fees, royalties, IT services) where fair-market comparability is weakest. A jurisdiction's TBMLTBMLTrade-Based Money Laundering, moving illicit value under cover of trade transactions. exposure can be roughly estimated by aggregating its trade exposure to these categories against a Berger-Nitsch mirror-trade analysis.

INVESTIGATIVE POWERS

Effective TBMLTBMLTrade-Based Money Laundering, moving illicit value under cover of trade transactions. enforcement typically requires access to at least four data-sets held by different agencies: customs declarations (customs authority); banking payment records (FIU and banking supervisor); tax returns and transfer-pricing documentation (tax administration), and beneficial-ownership registries of the counterparties (corporate registry). Bringing these into a single case file usually requires either formal inter-agency memoranda, secondment arrangements, or, increasingly; a specialised TBMLTBMLTrade-Based Money Laundering, moving illicit value under cover of trade transactions. unit with statutory access. Jurisdictions that have created such units (US CBP-ICE HSI TTUs, Argentina's UIF trade-analytics team, the UK NCA's specialist TBMLTBMLTrade-Based Money Laundering, moving illicit value under cover of trade transactions. capability, Pakistan's Directorate General of Customs Intelligence) show materially higher case throughput than jurisdictions where the data remain siloed.

PROSECUTORIAL CHALLENGE

Even where the statistical case is compelling, converting mis-pricing into a criminal conviction is hard. The defence is universally the same: pricing is a commercial judgment; there are permissible reasons for above- or below-median unit values (quality differentials, relationship pricing, forward-contract lock-in, market-entry discounting), and the prosecution must exclude every plausible innocent explanation beyond reasonable doubt. The response is either to run the case civilly (asset-recovery, unexplained-wealth) at the lower balance-of-probabilities standard, or to combine the TBMLTBMLTrade-Based Money Laundering, moving illicit value under cover of trade transactions. count with evidence of concurrent laundering red flags (undisclosed common ownership between counterparties, off-book payments, forged supporting documents) so that the transaction cannot credibly be described as arm's-length commerce. Modern TBMLTBMLTrade-Based Money Laundering, moving illicit value under cover of trade transactions. prosecutions almost always run this "combined-count" strategy rather than relying on price evidence alone.

Four-part typologyVERITAS · Dr. Lediga
1CATEGORY 01Over-invoicing
Declared price above market. Moves value from importer to exporter jurisdiction.
2CATEGORY 02Under-invoicing
Declared price below market. Reverse direction; often paired with under-declaration for duty.
3CATEGORY 03Multiple invoicing
Same shipment invoiced repeatedly. Each invoice used as documentary basis for a separate payment.
4CATEGORY 04Phantom shipments
Documentary trade without physical movement. Detected via port throughput and container tracking.

The four canonical trade-based laundering techniques.

All rely on the difficulty of independently verifying price, quantity and description at scale.

Key terms

TBML
Trade-Based Money Laundering, moving illicit value under cover of trade transactions.
HS code
Harmonized System code — the international commodity classification used in customs declarations.
Berger-Nitsch method
Detection method based on gaps between reported exports from country A and reported imports into country B for the same trade flow.

Exercise

Given a table of ten export invoices for textiles at USD 42–48 per kg, and one at USD 210 per kg to the same destination in the same month, calculate the median-multiple and flag the outlier. What next steps would you take?

Mark complete (sign-in) →

Sources

Last reviewed 2026-08-01

  1. 01FATF/Egmont, Trade-Based Money Laundering: Trends and DevelopmentsFATF / Egmont Group, 2020.
  2. 02FATF/Egmont, Trade-Based Money Laundering: Risk IndicatorsFATF / Egmont Group, 2021.
  3. 03World Customs Organization, Illicit Trade ReportWCO, 2024.
Full bibliography →
LESSON 0235 min read

Free trade zones, transit trade and mirror-trade schemes

Figure 4.1 · Trade mispricing

A widening gap between declared and market price

Copper concentrate exports from a single exporter-importer pair. Every dollar of daylight is a dollar re-routed abroad.

$1.00$2.00$3.00$4.00$5.00JANFEBMARAPRMAYJUNMarketDeclared$3.30 / lb re-routed in June

Source · Simulated dataset; benchmark: LME cash settlement

Every mechanism in this lesson was invented by someone with entirely legitimate intentions. That is worth remembering before you assume bad faith in a zone operator. Free Trade Zones (FTZs), transit-trade corridors, and mirror-trade schemes are three of the most systematically abused layering channels in modern trade finance. Each was designed for a legitimate commercial purpose; each has, over time, been colonised by launderers who exploit the ambiguities the design created.

FREE TRADE ZONES provide legitimate benefits: customs duty deferral, warehousing, light-touch processing, re-export facilitation, and reduced regulatory friction for firms whose supply chains genuinely require multi-country assembly and reshipment. There are more than 5,400 FTZs across roughly 150 economies, ranging from single-warehouse enterprise zones to city-scale complexes (Jebel Ali Free Zone in the UAE, Colon Free Zone in Panama, Waigaoqiao in Shanghai) that host tens of thousands of licensed entities and process hundreds of billions of dollars in throughput annually. FATF's 2010 study Money Laundering Vulnerabilities of Free Trade Zones remains the definitive taxonomy of the abuse patterns. FATF's 2020 update reaffirmed the findings and added the observation that FTZFTZFree Trade Zone; customs-privileged area typically outside standard customs oversight. oversight in most jurisdictions had not materially improved in the intervening decade.

The vulnerabilities cluster in five overlapping categories.

OPACITY OF OWNERSHIP

Many FTZFTZFree Trade Zone; customs-privileged area typically outside standard customs oversight. licensing regimes require less beneficial-ownership disclosure than mainland incorporation regimes in the same jurisdiction. Zones marketed to international operators frequently permit corporate directorships, nominee arrangements, and holding structures whose UBO is not on public record.

MINIMAL CUSTOMS OVERSIGHT WITHIN THE ZONE

Because the goods are considered not to have entered the domestic customs territory, movements within the zone are treated as extra-territorial for customs purposes. A container can enter the zone, be relabelled, repackaged, or divided into multiple consignments, and be re-exported under a new description without a full re-verification of contents. The audit trail on the physical goods can be legitimately severed inside the zone.

HIGH-VOLUME REPACKAGING AND RELABELLING

The commercial rationale is genuine (localisation for onward markets, kitting for regional distribution). The abuse pattern is that the description of goods declared on the entering shipment may bear no relation to the description on the departing shipment; if the destination customs authority does not cross-reference to origin data, the mismatch is invisible.

RE-EXPORT DOCUMENTATION THAT SEVERS THE AUDIT TRAIL FROM ULTIMATE DESTINATION. FTZFTZFree Trade Zone; customs-privileged area typically outside standard customs oversight. certificates of origin can be issued for goods that were merely warehoused; downstream buyers may believe they are dealing with goods produced in the FTZFTZFree Trade Zone; customs-privileged area typically outside standard customs oversight. jurisdiction when in fact the goods originated elsewhere and were re-labelled.

CO-LOCATION OF FINANCIAL AND CORPORATE SERVICES. Many FTZs host, on the same premises, licensed banks, corporate service providers, freight forwarders, warehousing operators, and inspection companies. The result is a self-contained transactional environment in which every step of a laundering scheme — incorporation, invoicing, physical goods handling, and payment settlement, can occur under the roof of intermediaries with strong commercial incentives to complete the transaction rather than to raise questions.

RESPONSE

The FATF 2010 study recommended, and the 2020 update reaffirmed, five reforms: extension of AML/CFT obliged-entity coverage to CSPs, freight forwarders, and inspection companies operating in FTZs; risk-based physical inspection of a defined proportion of intra-zone movements; mandatory beneficial-ownership disclosure equivalent to mainland regimes; integration of FTZFTZFree Trade Zone; customs-privileged area typically outside standard customs oversight. data flows into national customs intelligence systems, and a competent authority with statutory jurisdiction over the zone that is not the zone's own operator (a common structural conflict in publicly-listed zone operators). Implementation remains uneven; investigators dealing with FTZFTZFree Trade Zone; customs-privileged area typically outside standard customs oversight. evidence should assume opacity as the default and design their evidentiary approach accordingly.

MIRROR TRADE

A brokerage; usually the local branch of a global bank or securities dealer, buys a security in one currency for one client and simultaneously sells the identical security in a different currency for a related client. The two trades are matched, the net position is zero, and no fee-relevant risk is transferred, but the effect is that value has crossed jurisdictions and currencies without a conventional wire transfer touching a correspondent bank. The mechanism was exposed in the 2017 Deutsche Bank Moscow investigations: USD 10 billion in mirror trades over four years, resulting in USD 630 million in penalties from the NYDFS, the FCA, and the Fed. Detection depends on identifying same-day matched buy/sell pairs across related account holders and on cross-referencing beneficial ownership of the two clients. Modern securities-firm surveillance systems flag these as "cross-account risk" but human-judgement escalation is essential because the transactional patterns are legitimate on their face.

TRANSIT TRADE

Goods pass through a third country without economic substance there. The transit party may take title, invoice, and re-invoice, but adds no manufacturing, transformation or value in a commercial sense. Legitimate transit trade is common (goods routed through hub ports for onward distribution), so the abuse pattern requires additional signals: absence of matching physical presence (warehouse, staff, inspection records), price mark-up disproportionate to any credible service, and payment flows that route through jurisdictions unrelated to any party in the trade. Investigators should routinely check whether the transit party added any value, held stock, took title in a commercial sense, or is merely a paper interposition. In many recent trade-based schemes the transit party is a shell whose sole function is to sever the direct commercial link between the true seller and the true buyer.

MULTI-JURISDICTIONAL DOCUMENT FRAUD

A characteristic of all three schemes is that they generate a lot of paper — bills of lading, packing lists, inspection certificates, insurance certificates, freight-forwarder receipts, warehouse receipts, letters of credit, banking payment records — which taken singly appears commercially plausible and taken collectively rarely reconciles. The investigator's technique is to cross-index the documents against each other and against independent physical evidence: container-level AIS satellite tracking (MarineTraffic, VesselFinder), port-authority throughput data, warehouse capacity constraints, and known freight-forwarder relationships. Discrepancies exceeding those explicable by ordinary commercial error are grounds to escalate.

INVESTIGATOR'S RULE OF THUMB. If a shipment's paperwork routes through three or more jurisdictions with no plausible commercial reason, or if a security trade produces a matched buy/sell pattern for related clients in different currencies, or if an FTZFTZFree Trade Zone; customs-privileged area typically outside standard customs oversight.-processed shipment presents a materially different description in departing vs entering documentation, the transaction is a layering candidate until proven otherwise. The evidential response is to preserve every document instance across every jurisdiction, to cross-index them contemporaneously, and to formulate the request-for-information that would obtain the missing link before the trail cools.

POLICY IMPLICATIONS

Reforming FTZFTZFree Trade Zone; customs-privileged area typically outside standard customs oversight. regimes, extending obliged-entity coverage to zone operators, and integrating trade data flows across customs, tax and FIU systems are the three highest-leverage reforms for a developing-country jurisdiction whose IFF exposure is dominated by commercial channels. The reforms are legally straightforward and often already recommended by the country's FATF Mutual Evaluation; the obstacles are political (zone operators are usually politically connected) and administrative (integration requires IT investment and inter-agency memoranda that take years to mature). The forensic-investigator's role in these reforms is to document the case for reform through concrete case files that show, incident by incident, how the current design permits abuse, and to place those case files where the reforming policy-maker can use them.

Structural pillarsVERITAS · Dr. Lediga
PILLAR 1
Ownership opacity
Lighter BO disclosure than mainland incorporation.
PILLAR 2
Minimal customs oversight
Extra-territorial for customs; contents can be relabelled inside the zone.
PILLAR 3
Repackaging + relabelling
Entering description may differ from departing description.
PILLAR 4
Re-export documentation
Certificates of origin issued for merely warehoused goods.
PILLAR 5
Co-located services
Banks, CSPs, forwarders, warehousing on-site; self-contained transactional environment.

The five vulnerabilities of Free Trade Zones (FATF 2010, reaffirmed 2020).

Each vulnerability was created by a legitimate design feature.

Key terms

FTZ
Free Trade Zone; customs-privileged area typically outside standard customs oversight.
Mirror trade
Simultaneous matched buy/sell across jurisdictions and currencies enabling opaque cross-border value transfer.

Exercise

Draft a two-page memo to your customs commissioner recommending three enhanced-oversight measures for FTZs operating in your country, benchmarked to FATF 2010 and 2020 reports.

Mark complete (sign-in) →

Sources

Last reviewed 2026-08-01

  1. 01FATF, Money Laundering Vulnerabilities of Free Trade ZonesFATF, 2010.
  2. 02FATF/Egmont TBML Risk IndicatorsFATF / Egmont Group, 2021.
  3. 03UNCTAD, Economic Development in Africa Report 2020UNCTAD, 2020.Commodity mis-invoicing estimates and their methodological limits.
Full bibliography →
LESSON 0330 min read

Real estate as an integration channel

Figure 4.1 · Trade mispricing

A widening gap between declared and market price

Copper concentrate exports from a single exporter-importer pair. Every dollar of daylight is a dollar re-routed abroad.

$1.00$2.00$3.00$4.00$5.00JANFEBMARAPRMAYJUNMarketDeclared$3.30 / lb re-routed in June

Source · Simulated dataset; benchmark: LME cash settlement

Real estate is the integration channel par excellence. It absorbs large sums in a single transaction, requires almost no financial expertise to purchase, appreciates in most markets, generates rental income that further legitimises the holding, and, because title is public; presents as unimpeachably 'clean' wealth to any downstream observer. In every major post-2010 study of laundering integration channels (Transparency International's Doors Wide Open, FATF's real-estate typologies, EU Parliament studies, the FinCEN GTOGTOGeographic Targeting Order — a U.S. FinCEN instrument requiring UBO identification for high-value cash real-estate purchases in specified markets. expansions in the United States) real-estate has ranked first or second by value.

The abuse patterns cluster around six recurrent techniques. First, purchase through an anonymous corporate vehicle registered in a secrecy jurisdiction, so that title records reveal only the shell. Second, all-cash purchases that bypass mortgage underwriting and the AML scrutiny it entails. Third, deliberate over- or under-valuation of the purchase relative to market, either to move value into the sale or to under-declare for transfer tax while paying the balance off-record. Fourth, rapid re-mortgaging after acquisition, converting the property into a source of laundered liquid funds. Fifth, use of a chain of small purchases below a jurisdictional reporting threshold. Sixth, use of luxury developments in which the developer's own compliance is thin and the transaction is structured through the developer's escrow.

Reform responses have converged on four measures. Beneficial-ownership registers accessible to law enforcement (and, where the CJEU permits, to journalists and the public). Extension of AML obliged-entity status to real-estate agents, notaries, and conveyancing lawyers, where not already covered. Geographic Targeting Orders that require identification of the UBO of cash purchases above a threshold in high-risk markets (the FinCEN GTOGTOGeographic Targeting Order — a U.S. FinCEN instrument requiring UBO identification for high-value cash real-estate purchases in specified markets. program, expanded nationwide in 2024). And direct scrutiny of luxury developers whose sales patterns show concentration on shell buyers. The reforming jurisdiction's practical starting point is title-register interoperability: cross-referencing the land registryLand registryThe public record of real-estate title, mortgages and encumbrances. with the corporate BO register and the tax administration's property records surfaces the vast majority of abuse patterns at zero marginal cost, provided the political will to act exists.

Enumerated setVERITAS · Dr. Lediga
1
Anonymous corporate buyer
Shell in secrecy jurisdiction; title records reveal only the entity.
2
All-cash purchase
Bypasses mortgage underwriting and its AML scrutiny.
3
Over- or under-valuation
Move value into the sale, or under-declare for transfer tax.
4
Rapid re-mortgaging
Convert the property into laundered liquid funds.
5
Sub-threshold chain
Multiple small purchases beneath the jurisdictional reporting threshold.
6
Developer escrow
Structured through a luxury developer's own escrow, thin AML.

Six recurrent techniques for laundering through real estate.

Combinations of any three of these should trigger enhanced scrutiny.

Key terms

GTO
Geographic Targeting Order — a U.S. FinCEN instrument requiring UBO identification for high-value cash real-estate purchases in specified markets.
Land registry
The public record of real-estate title, mortgages and encumbrances.

Exercise

Take a recent high-value real-estate purchase in your city that was made by a corporate buyer. Trace the corporate chain as far as public sources allow.

Mark complete (sign-in) →

Sources

Last reviewed 2026-08-01

  1. 01FATF, Money Laundering and Terrorist Financing Through the Real Estate SectorFATF, 2022.
  2. 02Regulation (EU) 2024/1624 (AMLR), high-value goods dealers and the EUR 10,000 cash ceilingEuropean Union, 2024.
  3. 03Economic Crime (Transparency and Enforcement) Act 2022 (UK), Register of Overseas EntitiesUnited Kingdom, 2022.
Full bibliography →
LESSON 0435 min read

Crypto integration, mixers and cross-chain hops

Figure 3.1 · Geography

One kickback, five jurisdictions

Each hop is a deliberate secrecy choice — a doctrine, a treaty, a professional silence. The final step is always a legitimate-looking asset.

HOP 1HOP 2HOP 3HOP 4LusakaSOURCENicosiaLAYER 1 · TRUSTLuxembourgLAYER 2 · HOLDCOJerseyLAYER 3 · SPVLondonINTEGRATION

Source · Schematic based on ICIJ Panama/Pandora Papers narratives

Virtual assets sit uneasily across all three laundering stages. Placement is often skipped entirely; proceeds arrive in crypto directly (ransomware, darknet market receipts, cyber-enabled fraud). Layering exploits the pseudonymous, cross-jurisdictional, always-on nature of blockchains and the availability of privacy-preserving instruments (mixers, coinjoins, privacy coins, cross-chain bridges). Integration converts crypto back to fiat through exchanges, regulated or otherwise — or spends it directly in a growing merchant ecosystem.

The layering toolkit has matured rapidly. Custodial mixers (Tornado Cash, Blender, Sinbad) pooled deposits from many users and issued withdrawal notes whose linkage to the deposit was cryptographically obscured. Coinjoins (Wasabi, Samourai) combined many users' transactions into a single on-chain transaction with many inputs and many outputs, breaking one-to-one traceability. Privacy coins (Monero, Zcash) built confidentiality into the base protocol. Cross-chain bridges permit an asset held on one blockchain to be locked and a wrapped equivalent minted on another, severing the on-chain audit trail for any investigator working from a single chain.

The investigative response has developed in parallel. On-chain analytics firms (Chainalysis, TRM Labs, Elliptic) cluster addresses using heuristics (co-spend, address reuse, service tagging), attach real-world identity to clusters where possible (KYC data from exchange breaches, subpoenas, undercover purchases), and offer risk-scoring on transaction flows. FATF's Recommendation 15 and its 2019 guidance extend the obliged-entity regime to Virtual Asset Service Providers (VASPs), imposing CDD, transaction monitoring, and — critically, the Travel RuleTravel RuleFATF requirement to transmit originator and beneficiary identity with virtual-asset transfers above a threshold. (transmission of originator and beneficiary information with transfers above a threshold, typically USD 1,000). Sanctions have been imposed on mixer smart-contracts themselves (OFAC's 2022 designation of Tornado Cash), a novel legal move whose ramifications continue to unfold.

For the developing-country investigator with no in-house analytics capability, three practical rules. Preserve the on-chain trail early; public blockchains are immutable but private-chain data can vanish. Focus effort at the off-ramp, where crypto converts to fiat through an exchange, the exchange is an obliged entity and can be compelled to disclose. And triangulate on-chain evidence with off-chain corroboration (device seizures, exchange KYC records, communications) — on-chain data alone rarely sustains prosecution.

Four-part typologyVERITAS · Dr. Lediga
1CATEGORY 01Custodial mixers
Tornado Cash, Blender, Sinbad. Pool deposits, issue delinked withdrawals.
2CATEGORY 02Coinjoins
Wasabi, Samourai. Combine many users' transactions on-chain.
3CATEGORY 03Privacy coins
Monero, Zcash. Confidentiality built into the base protocol.
4CATEGORY 04Cross-chain bridges
Lock on chain A, mint wrapped on chain B; severs single-chain trail.

The four categories of crypto layering technique.

Combinations are common; investigators should expect chain-hopping across categories.

Key terms

VASP
Virtual Asset Service Provider — exchange, custodian, or other regulated crypto business subject to FATF Recommendation 15.
Travel Rule
FATF requirement to transmit originator and beneficiary identity with virtual-asset transfers above a threshold.
Mixer / tumbler
Service that pools crypto deposits and issues withdrawals whose linkage to the deposit is obscured.
Cross-chain bridge
Protocol allowing an asset on one blockchain to be locked and a wrapped equivalent minted on another.

Exercise

Given a Bitcoin transaction hash (fictional), sketch the ordered investigative steps to move from on-chain pattern to a subpoenable exchange record.

Mark complete (sign-in) →

Sources

Last reviewed 2026-08-01

  1. 01FATF Recommendation 15 and its Interpretive NoteFATF, 2025.The virtual-asset travel rule.
  2. 02Regulation (EU) 2023/1114 (MiCA) and Regulation (EU) 2023/1113European Union, 2023.
  3. 03OECD, Crypto-Asset Reporting Framework (CARF)OECD, 2023.First exchanges from 2027; Council Directive (EU) 2023/2226 (DAC8) implements it in the EU.
Full bibliography →

Case study

The Aden textile corridor

Jurisdiction: Composite, drawn from public FATF and GAFILAT studies

Between 2017–2020, textile exports declared from Country A to Country B totalled USD 340M. Import declarations in Country B for the identical HS codes and shipments totalled USD 118M. The USD 222M gap is unexplained by transport costs.

Facts

  • Twelve exporter entities in Country A are all traceable to two CSPs.
  • Nine importer entities in Country B share a single accountant.
  • Payments settled through a third-country freight-forwarder's escrow, not the exporters' bank accounts.

Investigative questions

  1. What information-sharing instrument would you deploy first, and to which counterpart?
  2. How would you value the fair-market benchmark against which to test the invoice prices?
  3. Which participants in the chain would you interview first and why?

Learning points

  • Bilateral trade-gap analysis is the fastest first-pass TBML detector.
  • Freight-forwarder escrow structures are increasingly used to sever the payment audit trail.
  • Concentration on shared professional intermediaries (accountants, CSPs) is a strong secondary signal.

Where the field disagrees

How much trade mispricing is actually laundering?

Global Financial Integrity's mirror-statistics estimates put trade-based flows in the hundreds of billions annually. Volker Nitsch and others have shown that the same gaps are produced by freight and insurance treatment, re-exports and recording lags, and that the method cannot separate fraud from bookkeeping. The typologies in this module are sound; the aggregate numbers built on them are not. Never quote a mirror-statistics figure in court.

Lecturer's note · not examinable, but argue it in your essay

Assessment

Module quiz

9 multiple-choice questions. Pass at 70%. Scores are saved to your dashboard.

Begin quiz →

Written work

Essay prompts

  • Q1Discuss why TBML is estimated to be the largest laundering channel by value yet the least detected in enforcement statistics.
  • Q2Evaluate the role of Free Trade Zones as both economic-development instruments and AML vulnerabilities.
Submit essay →

Assignment

"Using public UN Comtrade data, compute the bilateral trade gap for one commodity between two countries of your choice over three years. Present findings and hypothesised explanations."