Table of contents
Layering is the second stage of money laundering, in which illicit funds already placed in the financial system are moved through a series of transactions, accounts, entities and jurisdictions to break the audit trail between the money and the crime. Typical layers include wire transfers between shell companies, conversions between currencies and assets, and loans a launderer makes to themselves.
Layering sits between placement, when cash first enters the system, and integration, when the cleaned money re-emerges as apparently legitimate wealth. It is the stage where transaction monitoring does most of its work, because the money is already inside regulated institutions and every hop leaves a record.
How layering works
- Chains of transfers: funds move between accounts at several banks, often in different countries, in amounts and timings that look like ordinary commerce.
- Shell and front companies: entities with no real business receive and forward payments under invoices for goods or services that never existed.
- Conversions: cash becomes cheques, cheques become securities, securities become property or crypto-assets, each conversion breaking the previous trail.
- Loan-back schemes: the launderer lends dirty money to a company they control and receives it back as legitimate loan repayments.
- Trade-based laundering: over- or under-invoiced shipments move value across borders inside the documentation of real trade.
Why layering is the stage detection targets
Placement is the launderer’s riskiest moment, but it often happens in cash and outside a single institution’s view. Layering is different: every transfer passes through a regulated firm that records amount, counterparty, country and timing. Rules built on velocity (sums and counts over hours and days), rapid pass-through (funds in and out within a short window), round-tripping and counterparties shared across unrelated customers are all aimed at this stage.
Red flags for layering
- Funds that arrive and leave an account within hours, leaving a near-zero balance.
- Transfers to or from jurisdictions with no connection to the customer’s stated business.
- Payments between companies with common directors, addresses or registration agents.
- Invoices whose amounts, goods or counterparties do not match the customer’s profile.
- The same counterparty appearing across several apparently unrelated customers.
How Zyphe detects layering
Zyphe’s transaction monitoring evaluates every payment synchronously against a deterministic rule set and returns Allow, Review or Block before funds move, with the rules that fired attached. Velocity fields over 1 hour, 24 hours, 7 days and 30 days, 24-hour net flow and counterparties shared across identities are the fields layering rules are built on, and any rule can be backtested on stored transactions before it goes live. The transaction monitoring alert triage desk works the alerts that result.
Written by Michelangelo Frigo (Co-Founder at Zyphe) Reviewed September 18, 2026 Michelangelo Frigo is a privacy and identity infrastructure expert and co-founder of Zyphe.