CAMP · Certified Anti Money Laundering Professional

AML Typology & Monitoring Rules Reference

A working reference of common money-laundering typologies (structuring, layering, trade-based ML, sanctions evasion, and more) and the transaction-monitoring red flags used to detect each one.

Part of a Live, Graded Simulation

This reference sits alongside Riskpro's CAMP (Certified Anti Money Laundering Professional) simulation — a live, graded case-management exercise where you triage and investigate realistic AML alerts exactly as an L1 analyst or L2 investigator would on a real compliance desk. Every case pulls its own customer profile, transaction ledger and red flags, and every decision you make, including how you write up your rationale, is scored against a deterministic rubric, with a Director and Investigation Lead guiding you through the programme. It's the practical counterpart to this reference: read the theory here, then apply it against real alerts inside the simulation.

Register for CAMP →

Typologies

Structuring / Smurfing
Breaking a large sum into multiple smaller transactions, often just under a reporting threshold, to avoid triggering currency transaction reporting.
Layering
Moving funds through multiple accounts, entities or jurisdictions in rapid succession to obscure the audit trail back to the original source.
Trade-Based Money Laundering
Misrepresenting the price, quantity or quality of goods in import/export documentation to move value across borders under the guise of trade.
Shell / Front Company Layering
Using companies with no genuine business activity, opaque beneficial ownership, or a registered address that resolves to a residential unit or mail drop.
Rapid Movement of Funds
Funds are deposited and withdrawn or transferred out again within an unusually short window, with little or no dwell time in the account.
Funnel / Pass-Through Account
An account receives many small deposits from geographically dispersed sources and consolidates them into one or a few large outbound transfers.
Sanctions Evasion
Attempting to transact with a sanctioned individual, entity, vessel or jurisdiction, often via name variants, intermediaries or front companies.
PEP / Corruption-Linked Flows
Activity connected to a politically exposed person that is inconsistent with their declared official income, or that follows shortly after a change in office.
Proliferation Financing
Transactions linked to dual-use goods, embargoed technology, or entities associated with weapons proliferation networks.
Cryptocurrency Mixing/Tumbling
Use of mixing services, chain-hopping, or many small in/out crypto transfers designed to break the on-chain link between source and destination of funds.
Unusual Cash Activity
Cash deposits or withdrawals inconsistent with the customer's declared occupation, income, or historical account behaviour.
Adverse Media Nexus
Credible negative news coverage linking the customer or a close associate to fraud, corruption, organised crime or terrorism.

Monitoring Rules & Red Flags (88)

R017 — Structuring: Avoidance of Reporting Thresholds

Structuring / Cash · Structuring (Smurfing)

  • 5 cash deposits within 7 days, each between $3,000–$9,999, meeting the rule's minimum count
  • Aggregate of $40,350 well above the $10,000 threshold
  • Deposits spread across 3 branches and 2 channels
  • Declared occupation unverified; no business licence on file

R018 — Structuring: Potential Structuring in Cash and Equivalents

Structuring / Cash · Structuring (Smurfing)

  • 5 monetary-instrument deposits over 7 days, each under the reporting threshold, meeting the minimum count
  • Aggregate £24,100 exceeds the aggregate threshold
  • Customer declared unemployed; source of instruments unclear
  • Instruments from different named issuers with no apparent connection

R019 — Large Reportable Transactions

Structuring / Cash · Structuring (Smurfing)

  • 6 transactions within 3 days, each below the individual reporting cap, meeting the minimum count of 6
  • Aggregate ₹40,90,000 far exceeds the reportable threshold
  • Deposits across 4 different branches within 3 days
  • Declared occupation as “forex consultant” has no matching licence or registration on file
  • One deposit is a demand draft from an unrelated named third party

R020 — Single or Multiple Cash Transactions: Possible CTR

Structuring / Cash · Structuring (Smurfing)

  • 5 deposits over 7 days meeting the minimum count
  • Aggregate £41,300 exceeds the aggregate threshold
  • Deposits made at two different branch locations
  • 5 cash deposits over 7 days meeting the minimum count, each between $7,900–$9,400
  • Aggregate $44,300 far exceeds the reportable threshold
  • No declared business registered under the customer's stated “consulting” occupation
  • Deposits split across three branches and two channels

R021 — Single or Multiple Cash Transactions: Large Significant Transactions

Structuring / Cash · Structuring (Smurfing)

  • 6 large cash transactions in 3 days meeting the minimum count
  • Aggregate €48,100 far exceeds the threshold and the account's declared income level
  • Declared part-time retail income wholly inconsistent with cash volume
  • Deposits alternate between two branches on each of the three days

R034 — Structuring: Deposits/Withdrawals of Mixed Monetary Instruments

Structuring / Cash · Structuring (Smurfing)

  • 6 mixed monetary instruments deposited in a single day, meeting the minimum count
  • Aggregate $30,500 far exceeds the threshold
  • Mixed instrument types (money orders, cashier's cheques, travelers cheques) from multiple unnamed issuers
  • Declared occupation as import/export broker unlicensed and unverified

R061 — High Risk Electronic Transfers

Structuring / Cash · Sanctions Evasion — Shell Entities

  • 5 wire transfers in 5 days to a single beneficiary with incomplete address information, meeting the minimum count
  • Aggregate £44,200 exceeds the threshold
  • Beneficiary jurisdiction flagged as monitored under the rule's geography filter
  • Company onboarded only 7 months prior with no established trading history
  • No underlying invoices or trade documentation attached to any transfer

R071 — Peer-to-Peer (P2P) Payment Structuring and Aggregation

Structuring / Cash · Money Mule / Layering

  • 5 P2P inflows from unrelated senders across 3 platforms within 2 days
  • Aggregate inflow $10,300 immediately followed by a near-matching $10,100 outbound wire
  • Account average balance ($1,800) inconsistent with this throughput
  • Sender names show no apparent relationship to the account holder or each other
  • Rapid in-and-out pattern consistent with mule-account layering

R022 — Anomalies in ATM, Bank Card: Excessive Withdrawals

Cards / ATM · Money Mule / Layering

  • 18 ATM withdrawals within 30 days (over the count threshold), against typical usage of 3–4/month historically
  • €9,800 in electronic transfer received then rapidly withdrawn as cash across multiple locations within 6 days
  • Withdrawal pattern begins immediately after the inbound transfer, not on the customer's normal payday cycle
  • Sender of the inbound transfer has no apparent relationship to the customer

R045 — Anomalies in ATM, Bank Card: Foreign Transactions

Cards / ATM · Account Takeover / Identity Fraud

  • Transaction in London followed by a transaction in Lagos, Nigeria only 2 hours later — physically impossible for the same cardholder
  • Customer has no travel history or prior foreign transactions on file
  • Foreign spending of £4,800 within 3 days far exceeds normal monthly card usage of £300–£400
  • Nigeria flagged as a monitored jurisdiction under the rule's risk parameters

R059 — Anomalies in ATM, Bank Card: Structured Cash Deposits

Cards / ATM · Structuring (Smurfing)

  • 6 CDM deposits over the alert window, meeting the minimum count
  • Every deposit clusters just under $1,000, a level notably consistent for a self-employed driver but also individually deliberate-looking
  • Deposits alternate between two branches

R084 — Social Engineering, Authorized Push Payment (APP) Fraud Proceeds Monitoring

Fraud Convergence · Money Mule / Fraud Convergence

  • Two large inbound wires from unrelated individuals within days, each referencing romantic/emergency/investment context in the memo field — classic APP fraud victim messaging
  • Combined inbound of $25,700 far exceeds the customer's near-zero average balance and declared unemployed status
  • Nearly the entire inbound amount transferred onward to a crypto exchange within 48 hours
  • Account opened only 3 months prior with no established legitimate income pattern

R087 — Account Takeover and Identity-Based Fraud Indicators

Fraud Convergence · Account Takeover / Identity Fraud

  • Login from a new device and unusual geolocation the customer has never used before
  • Password and phone number changed within minutes of the unusual login
  • New payee added and a large transfer executed within the same session, all within 60 minutes
  • Customer's historical login pattern is exclusively from UK IP addresses over 11 years

R001 — Sanctions List Match: Wire Transfers to OFAC SDN Beneficiary

Sanctions/High-Risk · Sanctions Evasion

  • 3 same-day wires to a single beneficiary, meeting the minimum count
  • Aggregate GBP 35,100 exceeds the threshold
  • Beneficiary name is a high-confidence match on the OFAC SDN list
  • No prior transaction history with this beneficiary

R002 — Payments to FATF-Blacklisted Jurisdiction Without Trade Documentation

Sanctions/High-Risk · Trade-Based Money Laundering

  • 3 same-day payments to a FATF-blacklisted-jurisdiction (Democratic People's Republic of Korea (DPRK / North Korea)) counterparty, meeting the minimum count
  • Aggregate $22,200 exceeds the threshold
  • No invoices, bills of lading, or customs documentation attached to any transfer
  • Account only 5 months old with no established import history

R003 — Near-Exclusive Fund Movement Between Similarly-Named Linked Accounts

Network/Ownership · Layering / Shell Networks

  • 3 internal transfers within 60 days, exclusively paired between two accounts, meeting the minimum count
  • Aggregate $75,500 exceeds the threshold
  • The two accounts are recorded under slightly different name variations ("Anthony J. Whitmore" vs "Tony Whitmore") with different tax identification numbers on file
  • No formal household, joint-account, or relationship linkage exists between the two accounts in the institution's systems

R004 — Journal Transfers Between Accounts With No Disclosed Relationship

Network/Ownership · Layering / Shell Networks

  • 3 journal transfers within 90 days between accounts with no formal relationship, meeting the minimum count
  • Aggregate $22,500 exceeds the threshold
  • No shared tax identifier, address, or household linkage between the two account holders
  • Both customers, when asked separately, denied knowing each other

R005 — Dormant Account: Sudden Large Unexplained Incoming Payments

General Monitoring · Dormant Account Reactivation

  • 3 large payments within 180 days on an account with 18 months of near-zero prior activity, meeting the minimum count
  • Aggregate GBP 29,500 exceeds the threshold, over 35x the account's historical average balance
  • No invoices or consulting engagement documentation for any of the three payments
  • Senders show no apparent relationship to each other or to the declared consulting business

R006 — Single Transaction Far Exceeding Historical Account Peak

General Monitoring · Unusual Activity vs. Profile

  • Single transaction of $42,000, meeting the minimum count of 1
  • Amount exceeds the account's highest recorded prior monthly peak ($6,500) by over 6x
  • Sender shows no relationship to the customer's declared occupation as a rideshare driver
  • No documentation or explanation accompanies the transfer

R007 — Abrupt Shift From Wire-Based to Cash-Based Activity

General Monitoring · Unusual Activity vs. Profile

  • 3 cash deposits within 90 days on an account with zero prior cash activity in 3 years, meeting the minimum count
  • Aggregate EUR 12,500 exceeds the threshold
  • Complete absence of any business rationale for a consulting firm suddenly receiving cash
  • No client invoices or engagement letters correspond to any of the three deposits

R008 — Rapid Pass-Through: Large Inbound Wire Followed by Near-Equal Outbound

Network/Ownership · Layering / Pass-Through

  • Inbound wire immediately followed by an outbound wire within 4 days, meeting the minimum count
  • Aggregate $232,500 exceeds the threshold
  • Only $3,500 net retained on the account despite $118,000 passing through
  • No commercial or investment rationale disclosed for either transfer
  • Account only 3 months old with no prior comparable activity

R009 — Mixed-Channel Inflows Rapidly Consolidated and Moved Out

Network/Ownership · Layering / Pass-Through

  • 5 mixed-channel transactions within 30 days, meeting the minimum count
  • Aggregate GBP 178,500 exceeds the threshold
  • Consolidated outbound transfer of GBP 88,000 sent 4 days after the final inbound deposit, leaving minimal retained balance
  • No declared income source consistent with this scale of activity for a freelance translator

R010 — Deposits Inconsistent With Declared Occupation and Income

General Monitoring · Income/Profile Mismatch

  • 2 deposits within 30 days grossly exceeding expected income for a part-time retail cashier, meeting the minimum count
  • Aggregate $30,700 exceeds the threshold, representing several months of expected income from the declared occupation received within 2 weeks
  • No verified secondary income source, business activity, or windfall documentation on file

R011 — Dormant Account Reactivated With New Device/Location and Large Activity

General Monitoring · Dormant Account Reactivation

  • 5 transactions within 30 days on an account inactive for over 2 years, meeting the minimum count
  • Aggregate $47,100 exceeds the threshold
  • Login pattern shows access from a new device and location never previously used, inconsistent with the declared elderly retired customer's historical usage
  • No contact from the customer to the institution regarding reactivating the account

R012 — Rapid Investment Account Liquidation Followed by Transfers Out

General Monitoring · Securities / Investment ML

  • 5 transactions within 30 days meeting the minimum count
  • Aggregate GBP 247,400 exceeds the threshold
  • Account value depreciated by over 90% within a single month via systematic liquidation
  • Liquidation immediately followed by large overseas outbound transfers with no disclosed purpose
  • Declared occupation as a financial trader has no matching FCA registration

R013 — Repeated Matched Deposit-and-Withdrawal Pattern With No Economic Purpose

General Monitoring · Layering

  • 5 transactions within 90 days showing a repeated matched deposit-then-withdrawal pattern, meeting the minimum count
  • Aggregate $74,400 approaching the threshold
  • Deposit and withdrawal amounts consistently near-identical, each occurring within 24 hours of each other
  • No economic rationale connects any of the sender/beneficiary pairs to the customer or to each other

R014 — High Proportion of Round-Dollar Transactions Without Supporting Documentation

General Monitoring · Structuring (Smurfing)

  • 3 perfectly round-dollar transactions within 30 days, meeting the minimum count
  • Aggregate $45,000 exceeds the threshold
  • No business registration exists for the declared independent consulting activity
  • No invoices, contracts, or scope-of-work documentation for any of the three round-figure payments
  • Three unrelated senders using identical generic "consulting fee" memo language

R015 — Structured Small Transfers to Recipient in Designated Conflict Region

Sanctions/High-Risk · Terrorist Financing

  • 4 transfers over 60 days to a single recipient in a designated conflict region, meeting the minimum count
  • Aggregate GBP 4,050 meets the threshold despite small individual amounts
  • Recipient name and region cross-referenced against internal and external terrorist watch lists returned a partial match requiring investigation
  • Regular fortnightly cadence with consistent small amounts, inconsistent with typical family remittance patterns

R016 — Sequentially Numbered Money Orders Deposited by Unrelated Individuals

Structuring / Cash · Structuring (Smurfing)

  • 5 sequentially numbered money orders deposited within 60 days by different individuals, meeting the minimum count
  • Aggregate $47,700 approaching the threshold
  • Sequential instrument numbering strongly suggests purchase in a single batch, despite being deposited by five apparently unrelated individuals over several weeks
  • Each amount falls just under the $10,000 reporting threshold

R023 — Personal Account Receiving Business-Scale Third-Party Deposits

General Monitoring · Unregistered Business Activity

  • 3 large deposits from unrelated third parties within 60 days on a personal account, meeting the minimum count
  • Aggregate GBP 31,700 exceeds the threshold
  • No registered business exists for the declared unemployed customer
  • Deposit pattern (multiple unrelated third-party payers, business-scale volume) is inconsistent with any personal account use case

R024 — New Account Opened Shortly After Prior Account's Suspicious-Activity Closure

General Monitoring · Repeat Offender / Prior SAR

  • New account opened 5 weeks after the customer's prior account was closed following a suspicious activity review, meeting the minimum count
  • Aggregate $18,100 approaching the threshold
  • Prior account's closure record notes cash structuring concerns - the identical pattern (sub-threshold multi-branch cash deposits) is now appearing on the new account
  • No change in declared occupation or circumstances between the closed and new accounts

R025 — Modest-Income Account Ranking Among Top Institutional Depositors

General Monitoring · Income/Profile Mismatch

  • 2 deposits within 30 days placing the account among the institution's top 100 depositors, meeting the minimum count
  • Aggregate $110,000 far exceeds the threshold and is grossly inconsistent with a delivery driver's expected income
  • No verified secondary income, business activity, or windfall documentation on file

R026 — Payments With Counterparty in Unrelated Industry to Declared Business

Network/Ownership · Trade-Based Money Laundering

  • 3 large transactions within 60 days with a counterparty in an entirely unrelated industry, meeting the minimum count
  • Aggregate GBP 83,500 exceeds the threshold
  • No commercial rationale disclosed for a single-location bakery transacting with an electronics wholesaler at this scale
  • No invoices or trade documentation for any of the three transactions

R027 — Undisclosed US-Person Indicators Absent FATCA Self-Certification

Sanctions/High-Risk · Regulatory Non-Disclosure (FATCA)

  • 2 transfers within 30 days from a US-domiciled brokerage account, meeting the minimum count
  • Aggregate EUR 26,500 exceeds the threshold
  • US phone number and US mailing address indicators present in the customer's historical correspondence file, despite no FATCA self-certification (W-9) ever completed
  • No IRS reporting or 30% withholding has been applied to any of this account's activity, inconsistent with undisclosed US-person status

R028 — Concentrated Wire Transfers to High-Risk-Jurisdiction Beneficiaries

Sanctions/High-Risk · Trade-Based Money Laundering

  • 3 wire transfers within 60 days concentrated to two beneficiaries in a high-risk jurisdiction, meeting the minimum count
  • Aggregate $28,500 exceeds the threshold, inconsistent with a declared construction worker's income
  • Consistent, near-identical transfer amounts each time, just under the $10,000 reporting threshold
  • No disclosed relationship or business rationale connecting the customer to either beneficiary

R029 — Coordinated Fund Movement Between Entities Sharing Formation Details

Network/Ownership · Layering / Shell Networks

  • 3 transactions between entities sharing identical registered address, phone number, and formation agent, meeting the minimum count
  • Aggregate GBP 64,500 exceeds the threshold
  • All four entities formed within the same 3-week window in late 2025
  • No genuine commercial relationship or shared parent company disclosed between the four entities

R030 — Beneficiary Associated With Multiple Tax Identification Numbers

Network/Ownership · Identity/Entity Anomaly

  • Same beneficiary name associated with two different tax identification numbers across the flagged payments, meeting the minimum count
  • Aggregate EUR 59,500 exceeds the threshold
  • No corporate group disclosure or explanation for the differing tax IDs under an identical entity name

R031 — Long-Standing Customer's Sudden First Transfer to High-Risk Geography

Sanctions/High-Risk · Trade-Based Money Laundering

  • 2 large outward remittances in a single day to a high-risk jurisdiction namely, Donetsk, meeting the minimum count
  • Aggregate INR 80,00,000 far exceeds the threshold
  • Zero prior international transfer activity anywhere in 12 years of account history
  • Customer has no independently declared income source consistent with funds of this scale
  • Both transfers initiated under the authorized signatory's transaction credentials, not the primary account holder's

R032 — Incoming Funds From a Source Inconsistent With Declared Profession

General Monitoring · Virtual Assets / Crypto ML

  • 2 transfers within 60 days from a cryptocurrency exchange, a source inconsistent with the declared teaching profession, meeting the minimum count
  • Aggregate $19,700 exceeds the threshold
  • No prior cryptocurrency activity anywhere on the account's 8-year history
  • No explanation of any crypto holdings, investment activity, or trading account on file

R033 — Funnel Account: Multiple Small Inflows Consolidated Into Large Outflows

Network/Ownership · Money Mule / Layering

  • 6 small inflows from unconnected individuals within days, followed by a single large outbound transfer, meeting the minimum count
  • Aggregate $12,700 inbound plus $11,200 outbound exceeds the threshold
  • No apparent relationship between the customer and any of the six senders
  • Classic hub-and-spoke aggregation pattern with minimal balance retention

R035 — Profile Data Change Followed by Large Transfer to New Beneficiary

Fraud Convergence · Account Takeover / Identity Fraud

  • Account data manipulation followed within 2 days by a large transfer to a newly added beneficiary, meeting the minimum count
  • Transfer amount exceeds the threshold
  • Customer's historical pattern shows no comparable prior transfers of this size
  • New phone number provided is a VOIP number inconsistent with the customer's prior mobile carrier on file

R036 — Unrelated Accounts Sharing Device/IP and Transacting in Coordination

Network/Ownership · Money Mule / Layering

  • 2 transfers between accounts with no formal linkage, meeting the minimum count
  • Aggregate $12,100 exceeds the threshold
  • Both accounts accessed online banking from the identical device ID and IP address on 11 separate occasions over the review window
  • No declared relationship (family, business, or otherwise) between the two account holders on file

R037 — Funds Routed Through Nested Correspondent Relationship to High-Risk Beneficiary

Sanctions/High-Risk · Trade-Based Money Laundering

  • 2 transactions within 90 days routed through a nested correspondent relationship, meeting the minimum count
  • Aggregate GBP 81,500 exceeds the threshold
  • True originating party of the inbound funds is not disclosed anywhere in the correspondent chain documentation
  • Rapid pass-through to a high-risk jurisdiction beneficiary shortly after receipt

R038 — Recurring Fixed-Schedule Payments to Undisclosed High-Risk-Jurisdiction Entity

Sanctions/High-Risk · Trade-Based Money Laundering

  • 3 payments on a fixed monthly schedule to the same external entity in a high-risk jurisdiction, meeting the minimum count
  • Aggregate $18,700 approaching the threshold
  • No disclosed business relationship or personal connection to the external entity
  • Amounts consistently near-identical each month, suggesting a pre-arranged fixed obligation

R039 — Fuzzy Name Match Against Sanctions List During Ongoing Screening

Sanctions/High-Risk · Sanctions Evasion

  • Name match against an external sanctions list during ongoing screening, meeting the minimum count
  • Aggregate EUR 79,000 exceeds the threshold
  • Fuzzy match on name, date of birth (within 1 year), and nationality against a designated sanctions list entry

R040 — Early Mortgage Payoff Funded by Unverified Lump-Sum Deposit

General Monitoring · Real Estate ML

  • 3 transactions within 90 days meeting the minimum count
  • Aggregate $635,800 far exceeds the threshold
  • Mortgage paid off in full, 22 years ahead of its scheduled term, funded by a single unidentified lump-sum deposit
  • Payoff amount grossly inconsistent with a restaurant manager's declared income and cash flow profile

R041 — Life Insurance Policy Cancelled Shortly After Large Cash Premium

General Monitoring · Insurance-Based ML

  • Policy purchased and cancelled within 6 weeks, meeting the minimum count of 2
  • Aggregate GBP 62,200 exceeds the threshold
  • Original premium was funded via a third-party bank draft, not the policyholder's own account
  • No life-insurance need or rationale disclosed, and cancellation occurred at the earliest possible opportunity after the policy's free-look period

R042 — Early Policy Surrender Funded by Unrelated Third-Party Premiums

General Monitoring · Insurance-Based ML

  • 3 large transactions over 180 days meeting the minimum count
  • Aggregate EUR 99,500 exceeds the threshold
  • Original premiums funded by two unrelated third-party payers, not the policyholder
  • Policy surrendered for cash value within 10 months of purchase, well inside the typical early-surrender risk window

R043 — Corporate Trade Activity Shifts to Undeclared, Unrelated Goods Category

Network/Ownership · Trade-Based Money Laundering

  • 3 payments over 120 days for goods entirely unrelated to the declared steel-manufacturing business, meeting the minimum count
  • Aggregate GBP 191,500 exceeds the threshold
  • No corresponding change filed with Companies House regarding business activity
  • Sudden shift with no prior trading history in this goods category anywhere on the account

R044 — Prepaid Card Loads Immediately Redeemed at Different Locations

Cards / ATM · Structuring (Smurfing)

  • 6 card load/redemption transactions within 5 days, meeting the minimum count
  • Aggregate $16,000 approaching aggregate patterns consistent with the rule's broader typology
  • Multiple cards loaded and redeemed in different geographic locations within 1-3 days
  • Declared part-time retail income inconsistent with this volume of card activity

R046 — Third-Party Checks From Undisclosed Remitters Below Reporting Threshold

Structuring / Cash · Structuring (Smurfing)

  • 3 checks within 60 days from named remitters with no disclosed relationship to the account holder, meeting the minimum count
  • Aggregate $26,700 approaching the threshold
  • Each amount falls just under the $10,000 reporting threshold
  • No employment, business, or personal relationship explains any of the three named remitters

R047 — Business Transaction Volume Far Exceeds Peer Group Benchmark

General Monitoring · Unusual Activity vs. Profile

  • Total 180-day transaction volume of $340,000 is approximately 12x the peer group median for single-location convenience stores of comparable size, meeting the minimum count
  • Individual deposits meet the threshold
  • No explanation for volume vastly exceeding what a business of this declared size and footprint would generate
  • Store has no point-of-sale system integration or inventory records on file to substantiate sales volume

R048 — Multiple Payments With Non-Standard 'Pay Upon Identification Only' Instructions

Network/Ownership · Layering

  • 5 same-day payments carrying non-standard 'pay upon identification only' instructions, meeting the minimum count
  • Aggregate GBP 29,500 exceeds the threshold
  • Five different named beneficiaries, none with any prior transaction history on the account
  • Account only 9 months old with no established payment pattern to compare against

R049 — Same-Day Offsetting Securities Trade With Related Counterparty

General Monitoring · Wash Trading

  • Same-day buy and sell of the identical instrument with the same counterparty, meeting the minimum count of 1
  • Trade value $94,800-$95,000 exceeds the threshold
  • Near-identical pricing on both legs, generating minimal genuine market exposure
  • Counterparty account has no independent trading history separate from Silvermark

R050 — Monetary Instruments Deposited With Unidentifiable Remitter Information

Structuring / Cash · Structuring (Smurfing)

  • 2 monetary instruments within 60 days with no identifiable remitter, meeting the minimum count
  • Aggregate $25,700 exceeds the threshold
  • Neither instrument's issuing institution could identify the original purchaser from their own records
  • No business licence exists for the declared business broker activity

R051 — Single Address Registered to Multiple Recurring External Entities

Network/Ownership · Layering / Shell Networks

  • Recipients at a single residential address associated with multiple recurring external entities, meeting the minimum count
  • Aggregate GBP 53,500 exceeds the threshold
  • 14 Milton Terrace is a residential property with no commercial use permit on file with the local planning authority
  • At least 5 distinct entities identified as registered at this same address across the institution's broader customer base

R052 — Beneficiary Appearing With Multiple Different Addresses

Network/Ownership · Identity/Entity Anomaly

  • Same beneficiary appearing with 3 different addresses across payments, meeting the minimum count
  • Aggregate $46,500 approaching the threshold
  • No relocation notice, lease documentation, or explanation on file for any of the address changes
  • All three addresses are residential rather than commercial properties

R053 — Single Destination Account Receiving Payments Under Multiple Beneficiary Names

Network/Ownership · Money Mule / Layering

  • 5 payments to a single account number under 4 different beneficiary names, meeting the minimum count
  • Aggregate $82,000 exceeds the threshold
  • No disclosed corporate or personal relationship explaining why a single account receives funds under multiple unrelated names
  • No consistent invoicing entity across the five payments despite the same underlying account

R054 — Corporate Customer's Sudden Shift to Undisclosed International Jurisdictions

Sanctions/High-Risk · Trade-Based Money Laundering

  • 3 international transfers within 30 days to three jurisdictions never previously associated with this domestic-only business, meeting the minimum count
  • Aggregate GBP 25,500 exceeds the threshold
  • No commercial rationale disclosed for a domestic cleaning services company suddenly transacting internationally
  • No corresponding change to the company's registered business activity or international trading status

R055 — Transaction Activity Sharply Diverges From Declared KYC Profile

General Monitoring · KYC Profile Deviation

  • 2 large international transfers within 90 days on an account whose declared KYC profile explicitly stated no international activity was expected, meeting the minimum count
  • Aggregate EUR 30,500 exceeds the threshold
  • Destination jurisdiction is high-risk, sharply inconsistent with the declared domestic-only profile
  • No profile update or KYC refresh submitted prior to this activity

R056 — Corporate Account Shift to Cash Activity Inconsistent With Peer Norms

General Monitoring · Unusual Activity vs. Profile

  • 2 cash deposits within 90 days, sharply inconsistent with the peer group norm of exclusively wire/ACH-based B2B software licensing accounts, meeting the minimum count
  • Aggregate $10,000 exceeds the threshold
  • No cash activity anywhere in the account's 2.5-year prior history
  • No explanation for a software licensing business receiving cash from any legitimate B2B customer

R057 — Insurance Beneficiary Change Followed by Rapid Policy Surrender

General Monitoring · Insurance-Based ML

  • Beneficiary change followed within 5 days by full policy surrender, meeting the minimum count
  • Surrender value exceeds the threshold
  • New beneficiary has no documented prior relationship (family, business, or otherwise) with the original policyholder
  • Policy administration file shows no notarized or witnessed documentation for the beneficiary change, inconsistent with standard procedure for a change of this significance

R058 — Multiple Policy Loans Taken Shortly After Large Premium Funding

General Monitoring · Insurance-Based ML

  • 5 transactions within 90 days meeting the minimum count
  • Aggregate $153,500 far exceeds the threshold
  • 4 separate policy loans taken within 60 days of funding a policy with a single large cash-equivalent premium
  • No investment consultancy licence or registration exists for the declared occupation

R060 — Repeated Beneficiary Instruction Changes for Supplier Before Large Payment

Fraud Convergence · Business Email Compromise / Payment Diversion

  • Payment instructions changed twice within 30 days for the same supplier relationship, meeting the minimum count
  • Payment amount exceeds the threshold
  • Both instruction changes were received via email with no verified callback confirmation performed
  • Payment made to a beneficiary account with no prior transaction history for this supplier relationship

R062 — Dormant Corporate Account Resumes Activity Amid Undisclosed Change of Control

Network/Ownership · Account Takeover / Identity Fraud

  • 2 large transactions within 60 days on an account inactive for 16 months, meeting the minimum count
  • Aggregate GBP 129,500 exceeds the threshold
  • Login and instruction pattern originates from a new IP address and device never previously associated with the account
  • Companies House filing shows a director change filed only 3 weeks before this reactivation, with no notification of this change provided to the institution

R063 — Trade Documentation Inconsistent With Underlying Claimed Transaction

Sanctions/High-Risk · Trade-Based Money Laundering

  • 3 large payments over 180 days to a single counterparty, meeting the minimum count
  • Aggregate EUR 590,000 exceeds the threshold
  • Attached invoices describe copper concentrate shipments, but no bill of lading, customs entry, or shipping record exists for any of the three claimed shipments
  • Invoiced weights and grades are inconsistent between the three invoices despite claiming the same commodity and counterparty

R064 — Near-Maturity Bond Purchase Immediately Redeemed With No Investment Rationale

General Monitoring · Securities / Investment ML

  • Purchase of a bond maturing in only 9 days, meeting the minimum count of 1
  • Transaction value GBP 520,000 exceeds the threshold
  • No apparent investment rationale - a 9-day holding period generates negligible yield relative to the transaction cost
  • Source of the GBP 520,000 purchase funds not evidenced by any prior account activity

R065 — Payments to High-Risk-Geography Counterparty Without Trade Documentation

Sanctions/High-Risk · Trade-Based Money Laundering

  • 2 large payments within 7 days to a high-risk-geography counterparty, meeting the minimum count
  • Aggregate INR 80,00,000 exceeds the threshold
  • No import licence or customs registration on file for the declared trading business
  • Account only 9 months old with no established trading history

R066 — Continued Activity With Counterparty Following Adverse Media Escalation

Sanctions/High-Risk · Adverse Media / Reputational Risk

  • 5 payments over 30 days to a single counterparty, meeting the minimum count
  • Aggregate GBP 102,100 exceeds the threshold
  • Counterparty's dynamic risk score escalated mid-window following new adverse information
  • Payment pattern continued unchanged after the risk-score escalation date

R067 — Import Invoice Values Materially Below Commodity Benchmark Pricing

Sanctions/High-Risk · Trade-Based Money Laundering

  • 3 payments over 120 days for goods priced materially below benchmark, meeting the minimum count
  • Aggregate GBP 280,700 exceeds the threshold
  • Declared invoice values approximately 38-45% below the commodity benchmark price for comparable automotive brake components
  • Same supplier for all three payments, in a jurisdiction flagged for weak trade oversight

R068 — Multiple Letter-of-Credit Drawings Without Shipping Documentation

Sanctions/High-Risk · Trade-Based Money Laundering

  • 3 drawings against a single letter of credit, meeting the minimum count
  • Aggregate EUR 515,000 exceeds the threshold
  • No bill of lading or cargo manifest on file for any of the three drawings despite each claiming a separate shipment
  • LC beneficiary jurisdiction has no port infrastructure consistent with the declared bulk grain trade

R069 — Crypto Exchange Transfer Linked to Sanctioned Wallet Address

Sanctions/High-Risk · Virtual Assets / Crypto ML

  • 2 transfers within 7 days to a crypto exchange wallet, meeting the minimum count
  • Aggregate $8,000 exceeds the threshold
  • Travel Rule originator/beneficiary information incomplete for both transfers
  • Blockchain analytics shows the destination wallet has direct prior transaction history with a wallet address on the OFAC SDN list

R070 — Crypto-to-Fiat Conversion Traced to Known Mixing Service

Sanctions/High-Risk · Virtual Assets / Crypto ML

  • 5 crypto-to-fiat conversions within 7 days, meeting the minimum count
  • Aggregate $10,100 exceeds the threshold
  • Blockchain analytics traces the source wallets directly to a sanctioned mixing service
  • Account only 2 months old with no established income pattern to compare against

R072 — Payments to Newly Incorporated Opaque Intermediary via Third Country

Sanctions/High-Risk · Layering / Shell Networks

  • 2 same-day payments to a newly incorporated intermediary entity, meeting the minimum count
  • Aggregate GBP 52,500 exceeds the threshold
  • Beneficiary incorporated less than 6 months prior with no public trading history
  • Ownership structure not disclosed in any documentation provided at account opening

R073 — Newly Formed Entity Makes Multiple All-Cash Property Purchases

General Monitoring · Real Estate ML

  • 3 all-cash residential property purchases within 90 days by the same entity, meeting the minimum count
  • Aggregate $893,000 exceeds the threshold
  • Entity formed only 2 months prior to the first purchase, with no other business activity on the account
  • No mortgage financing on any of the three purchases despite the entity having no other declared income source

R074 — Payments to Front Company for Dual-Use Precision Instruments

Sanctions/High-Risk · Trade-Based Money Laundering

  • 4 payments over 60 days to a single intermediary for precision instruments, meeting the minimum count
  • Aggregate EUR 3,160 meets the threshold despite small individual amounts
  • Intermediary entity registered in a neutral third-country jurisdiction with no manufacturing or distribution history
  • No end-use certificate or industrial customer identified for any payment
  • Declared business has no verifiable prior transaction history for this product category

R075 — Labor-Broker Wire Transfers With Withdrawal Pattern Indicating Forced Labor

Sanctions/High-Risk · Human Trafficking / Forced Labor

  • 2 large wire transfers from a labor recruitment agency in a high-risk source country, meeting the minimum count
  • Aggregate $59,000 far exceeds the threshold for a declared seasonal agricultural worker
  • Withdrawal pattern shows small, consistent-amount cash withdrawals at fixed intervals from a single ATM location, inconsistent with the account holder's independent control of the funds
  • Account activity pattern is consistent with published typology indicators for third-party-controlled accounts in labor exploitation cases

R076 — Consulting Payments Coinciding With Government Contract Award

Sanctions/High-Risk · Corruption / PEP

  • 3 large consulting fee payments over 90 days to a single entity, meeting the minimum count
  • Aggregate GBP 590,000 exceeds the threshold
  • Payments coincide with the same 6-week period in which Zenith was awarded a major government infrastructure contract in the relevant jurisdiction
  • No consulting deliverables, reports, or scope-of-work documentation on file for any of the three payments

R077 — Charity Donation Rapidly Disbursed to Unverified High-Risk-Region Recipient

Sanctions/High-Risk · Terrorist Financing

  • 3 transactions within days meeting the minimum count
  • Aggregate GBP 12,700 exceeds the threshold
  • Donation received with no donor identification, immediately followed by disbursement
  • Charity registered only 10 months prior with no verifiable field operations on record
  • No programmatic documentation linking the disbursement to any charitable activity

R078 — Timber Export Payments Without CITES Documentation From High-Risk Region

Sanctions/High-Risk · Trade-Based Money Laundering

  • 2 large payments over 120 days for exotic hardwood timber from a region known for illegal logging, meeting the minimum count
  • Aggregate EUR 555,000 exceeds the threshold
  • No CITES export permits on file for either shipment despite the timber species being CITES-listed
  • Supplier region independently identified in recent environmental-crime enforcement reporting for illegal logging activity

R079 — Multi-Layered Offshore Transfer Inconsistent With Beneficial Owner's Tax Filings

Network/Ownership · Layering / Shell Networks

  • Single large transfer routed through 3 layered offshore intermediary entities across 3 jurisdictions, meeting the minimum count of 1
  • Transaction value GBP 620,000 exceeds the threshold
  • UK-resident beneficial owner's most recent HMRC self-assessment filing declares income of GBP 52,000 - grossly inconsistent with a GBP 620,000 transfer
  • No commercial or investment purpose disclosed for the multi-jurisdictional routing

R080 — Large Transactions at Atypical Hours to a First-Time Counterparty

General Monitoring · Behavioral Anomaly

  • 3 large transactions within a single 17-minute window at 3am, exceeding 3 standard deviations from the customer's established behavioral baseline, meeting the minimum count of 1
  • Aggregate $27,900 exceeds the threshold
  • Beneficiary appearing for the first time anywhere in the account's 5-year history
  • Timing and rapid-fire structuring pattern inconsistent with the customer's established usage patterns (historically business-hours-only activity)

R081 — Payment Instructions Authorized by Undeclared Beneficial Owner

Network/Ownership · Beneficial Ownership Mismatch

  • 2 transactions authorized by a signatory not matching the declared beneficial owner, meeting the minimum count
  • Aggregate GBP 83,500 exceeds the threshold
  • No beneficial ownership change filing submitted to the institution's compliance team at any point
  • Declared beneficial owner has had no login activity, instruction authorization, or contact with the institution in over 8 months

R082 — Continued Large-Scale Activity After Adverse Media Financial-Crime Report

Sanctions/High-Risk · Adverse Media / Reputational Risk

  • 3 transactions within 90 days meeting the minimum count
  • Aggregate $145,000 exceeds the threshold
  • Adverse media report (published 22-May-2026) names the customer in connection with an SEC investigation into an unregistered investment scheme
  • The outbound personal-use transfer occurred after the adverse media report was published, suggesting continued access to investor funds despite public scrutiny

R083 — Crypto Deposits Traced to Darknet Marketplace Wallet Cluster

Sanctions/High-Risk · Virtual Assets / Crypto ML

  • 2 large crypto-to-fiat conversions within 14 days, meeting the minimum count
  • Aggregate $12,000 exceeds the threshold
  • Blockchain analytics traces both source wallets to a wallet cluster independently associated with a known darknet marketplace
  • Account only 6 weeks old, declared unemployed, with a near-zero balance immediately prior to these deposits

R085 — High-Value Luxury Goods Purchased and Quickly Resold at a Loss

General Monitoring · Trade-Based Money Laundering

  • Purchase of high-value luxury goods exceeding the threshold, meeting the minimum count of 1
  • Resale of the same items 26 days later at a 30% loss, with no apparent market justification
  • No prior history of luxury watch collecting or dealing on the account
  • Purchase funds source not evidenced by any prior account activity

R086 — Offshore Outflow Returns as Undocumented Foreign Direct Investment

Network/Ownership · Layering / Shell Networks

  • 3 transactions within 60 days meeting the minimum count
  • Aggregate EUR 440,000 far exceeds the threshold
  • Outbound funds to an offshore entity returned within weeks as "foreign direct investment" from the identical counterparty
  • No identifiable underlying commercial activity, business plan, or investment rationale for either leg
  • Round-trip amount (EUR 215,000 returned vs EUR 225,000 sent) is inconsistent with any genuine investment return over such a short period

R088 — Personal Account Consolidating Third-Party Inflows Into Outbound Payments

Fraud Convergence · Money Mule / Layering

  • 2 inflows from unrelated parties consolidated into a single outbound payment, meeting the minimum count
  • Aggregate GBP 59,500 exceeds the threshold
  • Personal retail account receiving corporate-scale third-party volumes inconsistent with the declared IT support occupation
  • No business registration or professional capacity disclosed that would explain acting as a fund conduit for third parties

This reference is part of CAMP by Risk Academy — the Certified Anti Money Laundering Professional programme, which pairs it with a live, graded alert-investigation simulation for L1 and L2 AML analysts.

Register for CAMP →