What is money laundering?

Every profit-generating crime — fraud, ransomware, drug trafficking, corruption — produces funds the criminal cannot openly use. Laundering is the machinery that converts those proceeds into apparently clean assets, and estimates commonly place its scale at a meaningful percentage of global GDP each year.

Cryptocurrency changed the mechanics without changing the goal. Crypto rails are fast, borderless and pseudonymous, which makes them attractive for moving illicit value — but they also record every transaction on a public ledger, which is why on-chain laundering is often more traceable than cash once investigators engage.

The classic model breaks laundering into three stages — placement, layering and integration — and most regulators, training courses and investigators describe the process in those steps. The phases are not always sequential in practice: a ransomware payment arrives on-chain already placed, and layering can begin within minutes. But the model remains the clearest way to see where controls apply. Each stage has a crypto-native equivalent and a point at which a list-based screening check can catch it:

Placement is the first stage: introducing criminal proceeds into the financial system so they can be moved at all. Classic placement methods break large amounts of cash into deposits small enough to avoid reporting thresholds (structuring, or smurfing when spread across many people and accounts), route cash through cash-intensive businesses such as restaurants and car washes, or buy monetary instruments that can be redeposited elsewhere. Placement is the stage where the launderer is most exposed, because the funds are still close to the crime.

In crypto, placement means converting cash to digital assets — through exchanges with weak controls, peer-to-peer markets or crypto ATMs — or skipping the conversion entirely when the proceeds are already on-chain, as with ransomware payments and exchange hacks. The screening checkpoint is the deposit: the source address of an incoming transfer can be checked against sanctions designations and known ransomware payment addresses before the funds are credited, which catches the placement paths that are already publicly identified.

Layering is the second stage: separating the funds from their criminal origin through a sequence of transactions designed to defeat the audit trail. Money is wired between accounts and jurisdictions, passed through shell companies and trusts, converted between currencies and asset types, and disguised as trade through over- and under-invoicing. Each layer adds a step an investigator has to unwind; secrecy jurisdictions and nominee owners add friction on top.

Layering is where crypto techniques concentrate. Mixers pool and redistribute funds to break the on-chain link between source and destination; chain-hopping moves value across blockchains through bridges and instant exchangers; privacy coins and DeFi protocols add further hops. Issuers have responded by designating the infrastructure itself: OFAC sanctioned the Blender.io mixer on 6 May 2022, Tornado Cash on 8 August 2022 (removed from the SDN list on 21 March 2025 after litigation) and Sinbad.io on 29 November 2023 for laundering proceeds of North Korea's Lazarus Group. Once a mixer or exchange is designated its addresses become sanctions-list identifiers, so a counterparty screen catches layering through designated services. Layering through undesignated services is the domain of blockchain analytics, not screening.

Integration is the third stage: bringing the laundered value back into the legitimate economy in a form the launderer can use openly. Typical methods are buying real estate, businesses or luxury goods, repaying loans taken against the laundered funds, paying fake invoices to a controlled company, or simply holding the money in an account that now has a plausible history. By this stage the funds look clean, which is why integration is the hardest stage to detect from the transaction alone.

In crypto, integration is the cash-out: selling through an exchange or over-the-counter broker, converting to stablecoins that can be spent, or buying assets directly with crypto. The screening checkpoint is the withdrawal or payout: the destination address and the counterparty receiving the funds can be checked before value is released, and a match on a sanctions or crime list stops the cash-out at the last point where the platform still controls it. Integration through counterparties that are not listed is caught, if at all, by transaction monitoring and analytics rather than by a list check.

Mostly in the layering stage described above: mixers, chain-hopping, privacy coins and cycling value through DeFi protocols. The pattern that matters for screening is that the infrastructure gets designated — three mixers in eighteen months, from Blender.io in May 2022 to Sinbad.io in November 2023 — which turns a laundering service's addresses into sanctions-list identifiers.

Other patterns include structuring value across many wallets, and cashing out through services with weak controls. Laundering infrastructure and sanctions increasingly intersect: exchanges and mixers that serve criminal flows end up designated, which pulls their addresses into sanctions screening scope.

Any product that moves value can be used to launder it, and anti-money-laundering law obliges regulated businesses to detect and report the attempt. For crypto and fintech teams the practical controls are layered: identity checks at onboarding, screening of counterparty identifiers against sanctions and crime data, monitoring of transaction patterns, and reporting of suspicious activity.

Screening contributes the list-based layer. Checking a wallet address against designated entities and known criminal infrastructure — ransomware payment addresses, sanctioned mixers, seized wallets — catches the laundering paths that are already publicly identified, before funds move.