How money laundering detection works
How is money laundering detected?
Money laundering is detected through layered controls: banks identify customers (KYC), file automatic currency reports above fixed thresholds, monitor transactions for suspicious patterns, and send suspicious activity reports to national financial intelligence units, which develop them into cases. Leaks, whistleblowers, and blockchain analytics increasingly do the rest.
The four layers
Anti-money-laundering detection is not one system but four stacked ones, each catching what the previous layer missed.
1. Knowing the customer. Before any transaction happens, banks must establish who a customer is, who owns them, and what their activity should look like. This is KYC and customer due diligence. It exists so that “unusual” has a baseline; monitoring only means something if the bank knows whose behaviour it is watching.
2. Automatic reports. Above fixed thresholds, reporting is mechanical: currency transaction reports in the US, large cash transaction reports in Canada, threshold transaction reports in Australia. No suspicion required. The full table, by country, is on the thresholds page.
3. Suspicion. When patterns look wrong (structured deposits, funnel-account velocity, activity inconsistent with the customer) institutions file suspicious activity reports with their national financial intelligence unit, confidentially. This is where human judgment and monitoring software meet, and where the false-positive problem lives.
4. Investigation. FIUs match reports across institutions and borders, and hand packages to investigators. Around this formal machinery sit the irregulars that drive modern enforcement: whistleblowers, leak-based journalism (the Panama Papers, the FinCEN Files), and, for crypto, blockchain analytics firms whose clustering work turns public ledgers into evidence.
What the system is bad at
Measured honestly, the numbers are grim: about 1% of criminal proceeds confiscated in the EU, alert queues dominated by false positives, and compliance that can shade into box-ticking, filing reports to be safe rather than to be useful. De-risking makes it worse: banks that dump whole customer categories push those flows into channels with less oversight, not more.
The system’s real strength is different from its advertising. It rarely stops laundering in real time. What it does is preserve evidence: reports, records, and trails that turn into prosecutions years later, when an investigation finally asks the right question. Nearly every case in the case files was built on records some institution was once required to keep.
Where detection is heading
Three shifts define the 2020s. Ownership transparency: registers in the UK, Canada, and the EU now name the people behind companies, though the US narrowed its own register to foreign-registered companies in 2025–26. Asset-side rules: real-estate reporting and unexplained wealth orders interrogate what the money bought rather than how it moved. And chain analytics: for crypto, the ledger is public, so detection has become a data problem, one that firms and agencies keep getting better at, as several cases show.
Frequently asked questions
Who actually reads suspicious activity reports?
National financial intelligence units: FinCEN in the US, FINTRAC in Canada, AUSTRAC in Australia, the NCA’s UKFIU in Britain. They triage millions of filings into intelligence packages for police and prosecutors. Most reports never become cases; they become database entries that later investigations query.
Why do banks file so many reports?
Incentives. A bank that under-files risks enforcement (TD Bank’s US$3 billion resolution in 2024 followed systematic monitoring failures) while over-filing costs only staff time. The result is defensive filing, and a signal-to-noise problem the whole system struggles with.
Does detection actually work?
Partially, and unevenly. The controls deter casual abuse and generate the evidence that powers big cases, but measured by money recovered (around 1% of criminal proceeds in the EU) the system loses most of the time. The honest description is: detection works well against sloppy launderers and slowly against good ones.
Detection, in depth
- Reporting: CTRs, SARs, and STRs · The reports that feed the AML system (automatic currency reports, confidential suspicion reports, and border declarations) and what happens after filing.
Sources
- FinCEN releases figures on BSA filings (FY2024) (ABA Banking Journal, June 2025).
- Does crime still pay? Criminal asset recovery in the EU (Europol, February 2016).
- Are you too negative about false positives? (Datos Insights, 2023).
- Black and grey lists (Financial Action Task Force, accessed August 2026).
- TD Bank Pleads Guilty to Bank Secrecy Act and Money Laundering Conspiracy Violations (US Department of Justice, October 2024).