CAMP · Certified Anti Money Laundering Professional
AML Typology & Monitoring Rules Reference
A working reference of common money-laundering typologies (structuring, layering, trade-based ML, sanctions evasion, and more) and the transaction-monitoring red flags used to detect each one.
Part of a Live, Graded Simulation
This reference sits alongside Riskpro's CAMP (Certified Anti Money Laundering Professional) simulation — a live, graded case-management exercise where you triage and investigate realistic AML alerts exactly as an L1 analyst or L2 investigator would on a real compliance desk. Every case pulls its own customer profile, transaction ledger and red flags, and every decision you make, including how you write up your rationale, is scored against a deterministic rubric, with a Director and Investigation Lead guiding you through the programme. It's the practical counterpart to this reference: read the theory here, then apply it against real alerts inside the simulation.
Register for CAMP →Typologies
- Structuring / Smurfing
- Breaking a large sum into multiple smaller transactions, often just under a reporting threshold, to avoid triggering currency transaction reporting.
- Layering
- Moving funds through multiple accounts, entities or jurisdictions in rapid succession to obscure the audit trail back to the original source.
- Trade-Based Money Laundering
- Misrepresenting the price, quantity or quality of goods in import/export documentation to move value across borders under the guise of trade.
- Shell / Front Company Layering
- Using companies with no genuine business activity, opaque beneficial ownership, or a registered address that resolves to a residential unit or mail drop.
- Rapid Movement of Funds
- Funds are deposited and withdrawn or transferred out again within an unusually short window, with little or no dwell time in the account.
- Funnel / Pass-Through Account
- An account receives many small deposits from geographically dispersed sources and consolidates them into one or a few large outbound transfers.
- Sanctions Evasion
- Attempting to transact with a sanctioned individual, entity, vessel or jurisdiction, often via name variants, intermediaries or front companies.
- PEP / Corruption-Linked Flows
- Activity connected to a politically exposed person that is inconsistent with their declared official income, or that follows shortly after a change in office.
- Proliferation Financing
- Transactions linked to dual-use goods, embargoed technology, or entities associated with weapons proliferation networks.
- Cryptocurrency Mixing/Tumbling
- Use of mixing services, chain-hopping, or many small in/out crypto transfers designed to break the on-chain link between source and destination of funds.
- Unusual Cash Activity
- Cash deposits or withdrawals inconsistent with the customer's declared occupation, income, or historical account behaviour.
- Adverse Media Nexus
- Credible negative news coverage linking the customer or a close associate to fraud, corruption, organised crime or terrorism.
Monitoring Rules & Red Flags (13)
R017 — Structuring: Avoidance of Reporting Thresholds
- 5 cash deposits within 7 days, each between $3,000–$9,999, meeting the rule's minimum count
- Aggregate of $40,350 well above the $10,000 threshold
- Deposits spread across 3 branches and 2 channels
- Declared occupation unverified; no business licence on file
R018 — Structuring: Potential Structuring in Cash and Equivalents
- 5 monetary-instrument deposits over 7 days, each under the reporting threshold, meeting the minimum count
- Aggregate £24,100 exceeds the aggregate threshold
- Customer declared unemployed; source of instruments unclear
- Instruments from different named issuers with no apparent connection
R019 — Large Reportable Transactions
- 6 transactions within 3 days, each below the individual reporting cap, meeting the minimum count of 6
- Aggregate ₹40,90,000 far exceeds the reportable threshold
- Deposits across 4 different branches within 3 days
- Declared occupation as “forex consultant” has no matching licence or registration on file
- One deposit is a demand draft from an unrelated named third party
R020 — Single or Multiple Cash Transactions: Possible CTR
- 5 deposits over 7 days meeting the minimum count
- Aggregate £41,300 exceeds the aggregate threshold
- Deposits made at two different branch locations
- 5 cash deposits over 7 days meeting the minimum count, each between $7,900–$9,400
- Aggregate $44,300 far exceeds the reportable threshold
- No declared business registered under the customer's stated “consulting” occupation
- Deposits split across three branches and two channels
R021 — Single or Multiple Cash Transactions: Large Significant Transactions
- 6 large cash transactions in 3 days meeting the minimum count
- Aggregate €48,100 far exceeds the threshold and the account's declared income level
- Declared part-time retail income wholly inconsistent with cash volume
- Deposits alternate between two branches on each of the three days
R034 — Structuring: Deposits/Withdrawals of Mixed Monetary Instruments
- 6 mixed monetary instruments deposited in a single day, meeting the minimum count
- Aggregate $30,500 far exceeds the threshold
- Mixed instrument types (money orders, cashier's cheques, travelers cheques) from multiple unnamed issuers
- Declared occupation as import/export broker unlicensed and unverified
R061 — High Risk Electronic Transfers
- 5 wire transfers in 5 days to a single beneficiary with incomplete address information, meeting the minimum count
- Aggregate £44,200 exceeds the threshold
- Beneficiary jurisdiction flagged as monitored under the rule's geography filter
- Company onboarded only 7 months prior with no established trading history
- No underlying invoices or trade documentation attached to any transfer
R071 — Peer-to-Peer (P2P) Payment Structuring and Aggregation
- 5 P2P inflows from unrelated senders across 3 platforms within 2 days
- Aggregate inflow $10,300 immediately followed by a near-matching $10,100 outbound wire
- Account average balance ($1,800) inconsistent with this throughput
- Sender names show no apparent relationship to the account holder or each other
- Rapid in-and-out pattern consistent with mule-account layering
R022 — Anomalies in ATM, Bank Card: Excessive Withdrawals
- 18 ATM withdrawals within 30 days (over the count threshold), against typical usage of 3–4/month historically
- €9,800 in electronic transfer received then rapidly withdrawn as cash across multiple locations within 6 days
- Withdrawal pattern begins immediately after the inbound transfer, not on the customer's normal payday cycle
- Sender of the inbound transfer has no apparent relationship to the customer
R045 — Anomalies in ATM, Bank Card: Foreign Transactions
- Transaction in London followed by a transaction in Lagos, Nigeria only 2 hours later — physically impossible for the same cardholder
- Customer has no travel history or prior foreign transactions on file
- Foreign spending of £4,800 within 3 days far exceeds normal monthly card usage of £300–£400
- Nigeria flagged as a monitored jurisdiction under the rule's risk parameters
R059 — Anomalies in ATM, Bank Card: Structured Cash Deposits
- 6 CDM deposits over the alert window, meeting the minimum count
- Every deposit clusters just under $1,000, a level notably consistent for a self-employed driver but also individually deliberate-looking
- Deposits alternate between two branches
R084 — Social Engineering, Authorized Push Payment (APP) Fraud Proceeds Monitoring
- Two large inbound wires from unrelated individuals within days, each referencing romantic/emergency/investment context in the memo field — classic APP fraud victim messaging
- Combined inbound of $25,700 far exceeds the customer's near-zero average balance and declared unemployed status
- Nearly the entire inbound amount transferred onward to a crypto exchange within 48 hours
- Account opened only 3 months prior with no established legitimate income pattern
R087 — Account Takeover and Identity-Based Fraud Indicators
- Login from a new device and unusual geolocation the customer has never used before
- Password and phone number changed within minutes of the unusual login
- New payee added and a large transfer executed within the same session, all within 60 minutes
- Customer's historical login pattern is exclusively from UK IP addresses over 11 years
This reference is part of Riskpro's CAMP — Certified Anti Money Laundering Professional programme, which pairs it with a live, graded alert-investigation simulation for L1 and L2 AML analysts.
Register for CAMP →