Study AML compliance by practicing classification and proportionality: map each suspicious observation to placement, layering, or integration; compare it against the customer's stated profile; then select the response the risk actually justifies, from enhanced due diligence to escalation, and document the reasoning at every step.
Classifying a fact pattern into the correct laundering stage
The three stages are placement, layering, and integration. Classification matters because each stage produces different observable behavior and calls for different detection work, so a mislabeled stage leads to looking for the wrong evidence.
Placement is the first entry of illicit value into the financial system, typically through cash deposits, purchased monetary instruments, or mixed legitimate receipts. Layering is the movement of that value through transfers, exchanges, or shell entities to obscure its origin. Integration is the return of value to the launderer as apparently lawful wealth, such as asset purchases or business income. A single fact pattern can show more than one stage, which is why naming the stage forces you to justify it with specific observations rather than a vague sense of suspicion.
Train classification with a two-column drill. Write a short fact pattern from a study text or one you invent, then list every observation and label the stage it supports. For example, frequent cash deposits near a threshold support placement; rapid onward transfers to newly opened entities in unrelated jurisdictions support layering; a later purchase of property funded by those entities supports integration. If you cannot name the stage and the specific observation in one sentence, the pattern is not yet understood, and that gap is exactly what to study next.
Choosing between standard CDD and enhanced due diligence
Customer due diligence verifies identity and expected activity; enhanced due diligence adds deeper scrutiny when risk is higher, such as politically exposed persons, complex ownership, or higher-risk geographies and products.
The common confusion is treating EDD as simply more CDD. Standard CDD establishes who the customer is, the nature of their business, and a baseline of expected activity. Enhanced due diligence changes the questions, not just the volume: it seeks the source of funds and source of wealth, examines beneficial ownership through layered structures, and applies heightened ongoing monitoring. Comparing the two side by side in a table, then applying each to the same hypothetical customer, is the fastest way to internalize when the trigger conditions shift your obligations.
Scenario: a new corporate customer is owned through two holding companies in different jurisdictions, and one beneficial owner holds a senior public position. A plausible mistake is running standard identity checks on the company and stopping there, because the ownership chain itself is the risk trigger. The better decision is to classify the relationship as higher risk at onboarding, trace beneficial ownership to natural persons, document source of wealth for the public figure, and set tighter transaction monitoring. The distinction matters because EDD findings drive ongoing risk ratings, not just the opening file.
| Laundering stage | Typical observable behavior | Discriminating question | Proportionate response |
|---|---|---|---|
| Placement | Cash deposits, mixed receipts, purchased monetary instruments | Does the cash volume match the stated business profile? | Review activity against profile; escalate to EDD if unexplained |
| Layering | Rapid transfers, circular flows, shell entities, currency exchange chains | Does each movement have a documented business purpose? | Trace flows, request supporting records, raise the risk rating |
| Integration | Asset purchases, loans from related entities, inflated business income | Can the acquired wealth be reconciled to a verified source? | Reconcile source of funds and wealth; escalate if it cannot be |
Separating structuring from legitimate cash-intensive behavior
Structuring means breaking transactions into smaller amounts to evade a reporting threshold. The discriminator is not the amount itself but whether the pattern is consistent with the customer's explained, documented business activity.
Scenario: a restaurant owner deposits cash at several branches over consecutive days, each below a reporting threshold. A plausible mistake is concluding structuring from the sub-threshold amounts alone and escalating on that basis. The better decision is to compare the pattern with the stated profile first: a busy seasonal restaurant may genuinely generate large cash volumes, while deposits far exceeding plausible takings, made in a pattern that seems designed to stay under thresholds, point the other way. The reasoning you document should state what was compared and why the pattern was or was not consistent.
This comparison is the exercise to repeat until it is automatic. Take three invented cash customers: a market vendor, a construction firm with no retail presence, and a car wash. For each, write the expected cash profile, then write a deposit pattern that is consistent and one that is not. Expected observations: vendor deposits track market days; the construction firm should show little cash; the car wash falls between. If your patterns do not visibly differ by business type, you are reasoning from amounts rather than profiles, and that is the habit to correct before any assessment.
- Compare deposit patterns against stated business activity, not against a threshold alone
- Note behavior around thresholds as one signal among several, never as a standalone conclusion
- Document both the consistent and inconsistent observations so the escalation rationale is reviewable
- Re-rate the relationship when the pattern changes, not only at onboarding
Recognizing layering techniques that hide inside normal commerce
Layering disguises origin through rapid movements, circular flows, exchanges between asset types, and shell entities. Trade-based examples include over- and under-invoicing, multiple invoicing, and falsely described goods.
Scenario: an import company pays a supplier in one country, and the funds are immediately forwarded to an entity in a third country with no apparent role in the trade. Invoices show goods valued well above plausible market ranges. A plausible mistake is flagging the complexity of the payment route alone, which can also reflect legitimate multi-entity group structures. The better decision is to request the underlying trade documents, compare stated values against available market references, and check whether the receiving entity has any documented function. When documents do not reconcile, the inconsistency, not the wire complexity, becomes the basis for escalation.
The reason this scenario matters is that layering is deliberately built to resemble ordinary commercial activity. Wire chains, third-party payers, and intermediary entities all have legitimate uses, so the discriminating work is documentary: does the paper trail support the economics described? Build a short checklist of trade-based red flags, then apply it to a written fact pattern and record which flags are present, which are absent, and what additional document would resolve each open question. This habit of naming the missing document is what turns a red-flag list into a decision method.
Reporting judgment: escalating suspicion without tipping off
Escalation means documenting the inconsistency, referring internally through the designated channel, and permitting the required report if warranted. Tipping off means alerting the customer or an unauthorized person that scrutiny is underway.
The professional-standards difficulty here is acting on incomplete information. Suspicion in compliance practice is a state of grounded uncertainty: the pattern is inconsistent with what you can verify, and the customer's explanation does not resolve it. You do not need proof of laundering to escalate; you need a documented, articulable basis. Practice writing a two-paragraph internal memo for a scenario: what was observed, what the customer said, what remains unexplained. If your memo relies on adjectives like unusual rather than on the specific observations and comparisons, rewrite it until a reviewer could follow the reasoning without speaking to you.
Tipping off is the companion constraint. Once an escalation exists, continuing to ask the customer probing questions, or explaining why documents are needed in terms that reveal a suspicion, can compromise the process. The safe practice pattern is to frame document requests in ordinary onboarding or monitoring language, route the substantive concern through the designated internal channel, and let that channel own any external report. In drills, write both versions of a customer communication: one before escalation exists and one after. Comparing them shows exactly where ordinary diligence language ends and impermissible disclosure begins.
Building the documentation that supports your decisions
Defensible AML work leaves a record of the risk rating, the observations that drove it, the questions asked, the answers received, and the response chosen. Documentation converts judgment into something a reviewer can evaluate.
Work through a single scenario twice: once deciding, once documenting. For example, after classifying a deposit pattern as possible placement and escalating to enhanced review, write the file note: the profile reviewed, the pattern observed, the comparison made, the customer's stated explanation, and the reason it was insufficient. Then reread the note as a skeptical reviewer and mark anything that is asserted rather than evidenced. Expected observations from this exercise: first drafts lean on conclusions, and revisions force you to anchor each claim to a dated, specific observation, which is the standard the note should meet.
Extend the exercise across the relationship lifecycle by building a one-page decision log template with five fields: date, observation, stage and risk classification, response selected, and open items. Apply it to a multi-event scenario spanning onboarding, a mid-relationship pattern change, and an eventual escalation. The self-check is continuity: each row should reference earlier rows where relevant, so the final escalation reads as the culmination of a monitored history rather than a sudden reaction. If the log reads as disconnected events, the monitoring logic, not the writing, needs another pass.
A two-week practice sequence and readiness checks
Spend the first week on concept discrimination drills and the second on full decision scenarios scored against a rubric. Readiness means you can classify, compare, respond, and document a new pattern without prompts.
A realistic adaptable sequence: days one and two, write out the three stages, CDD versus EDD, and the red-flag categories from memory, then check against your study text and note gaps. Days three to five, run stage-classification drills on short fact patterns, five per session, writing one-sentence justifications. Week two, complete four full scenarios covering cash structuring, trade-based layering, a politically exposed relationship, and an escalation with tipping-off constraints, scoring each with the rubric below. Adjust the pacing to your schedule; the sequence, not the calendar, is what matters.
Readiness checks before you consider the topic covered: you can state the discriminating question for each laundering stage from memory; you can explain the EDD trigger conditions without looking them up; you can write a two-paragraph escalation memo in under ten minutes that a peer finds followable; and you can list three behaviors that risk tipping off and their compliant alternatives. Use the free practice questions and study-guide materials on this site to add question-format pressure, and treat any self-check score as a learning milestone, not a prediction of any particular assessment result.
- Rubric item 1: correct stage named, supported by a specific observation
- Rubric item 2: response selected matches the risk level, with the trigger stated
- Rubric item 3: customer explanation considered and its insufficiency explained
- Rubric item 4: documentation complete, dated, and free of unsupported conclusions
- Rubric item 5: no tipping-off risk in any drafted communication