What is money laundering?

In simple terms, money laundering is making money from crime look like money from a legitimate source, so it can be spent, saved or invested without pointing back to the crime. That is the meaning of money laundering in every legal system that criminalises it. Every profit-generating crime — fraud, ransomware, drug trafficking, corruption — produces funds the criminal cannot openly use. Laundering is the machinery that converts those proceeds into apparently clean assets, and estimates commonly place its scale at a meaningful percentage of global GDP each year.

Cryptocurrency changed the mechanics without changing the goal. Crypto rails are fast, borderless and pseudonymous, which makes them attractive for moving illicit value — but they also record every transaction on a public ledger, which is why on-chain laundering is often more traceable than cash once investigators engage.

The classic model breaks laundering into three stages — placement, layering and integration — and most regulators, training courses and investigators describe the process in those steps. The phases are not always sequential in practice: a ransomware payment arrives on-chain already placed, and layering can begin within minutes. But the model remains the clearest way to see where controls apply. Searches for the three types of money laundering usually mean these three stages; the methods inside each stage — cash, trade, shell companies, crypto — are the types in the other sense. Each stage has a crypto-native equivalent and a point at which a list-based screening check can catch it:

Placement is the first stage: introducing criminal proceeds into the financial system so they can be moved at all. Classic placement methods break large amounts of cash into deposits small enough to avoid reporting thresholds (structuring, or smurfing when spread across many people and accounts), route cash through cash-intensive businesses such as restaurants and car washes, or buy monetary instruments that can be redeposited elsewhere. Placement is the stage where the launderer is most exposed, because the funds are still close to the crime.

In crypto, placement means converting cash to digital assets — through exchanges with weak controls, peer-to-peer markets or crypto ATMs — or skipping the conversion entirely when the proceeds are already on-chain, as with ransomware payments and exchange hacks. The screening checkpoint is the deposit: the source address of an incoming transfer can be checked against sanctions designations and known ransomware payment addresses before the funds are credited, which catches the placement paths that are already publicly identified.

Layering is the second stage: separating the funds from their criminal origin through a sequence of transactions designed to defeat the audit trail. Money is wired between accounts and jurisdictions, passed through shell companies and trusts, converted between currencies and asset types, and disguised as trade through over- and under-invoicing. Each layer adds a step an investigator has to unwind; secrecy jurisdictions and nominee owners add friction on top.

Layering is where crypto techniques concentrate. Mixers pool and redistribute funds to break the on-chain link between source and destination; chain-hopping moves value across blockchains through bridges and instant exchangers; privacy coins and DeFi protocols add further hops. Issuers have responded by designating the infrastructure itself: OFAC sanctioned the Blender.io mixer on 6 May 2022, Tornado Cash on 8 August 2022 (removed from the SDN list on 21 March 2025 after litigation) and Sinbad.io on 29 November 2023 for laundering proceeds of North Korea's Lazarus Group. Once a mixer or exchange is designated its addresses become sanctions-list identifiers, so a counterparty screen catches layering through designated services. Layering through undesignated services is the domain of blockchain analytics, not screening.

Integration is the third stage: bringing the laundered value back into the legitimate economy in a form the launderer can use openly. Typical methods are buying real estate, businesses or luxury goods, repaying loans taken against the laundered funds, paying fake invoices to a controlled company, or simply holding the money in an account that now has a plausible history. By this stage the funds look clean, which is why integration is the hardest stage to detect from the transaction alone.

In crypto, integration is the cash-out: selling through an exchange or over-the-counter broker, converting to stablecoins that can be spent, or buying assets directly with crypto. The screening checkpoint is the withdrawal or payout: the destination address and the counterparty receiving the funds can be checked before value is released, and a match on a sanctions or crime list stops the cash-out at the last point where the platform still controls it. Integration through counterparties that are not listed is caught, if at all, by transaction monitoring and analytics rather than by a list check.

The money laundering examples that appear in enforcement actions are variations on a handful of methods, each sitting in one of the three stages. The table lists the common ones, what a control sees, and the part a list-based screen can catch on its own — which is the minority: most examples of money laundering offenses are patterns, visible to transaction monitoring and analytics rather than to a list check.

The Sinbad.io designation of 29 November 2023 is the clearest recent example: OFAC designated the mixer for laundering virtual currency stolen by North Korea's Lazarus Group, including proceeds of major exchange hacks. The stolen funds were placed on-chain at the moment of theft, layered through the mixer to break the link to the hacks, and integrated by cashing out through exchanges and brokers. Blender.io, designated on 6 May 2022, played the same role for the Lazarus Group a year earlier and was the first mixer OFAC ever sanctioned.

The largest money laundering cases by value are bank enforcement actions and state-level hacks rather than single prosecutions, and the figures move with each new settlement; the regulators' own enforcement pages — OFAC's recent actions, FinCEN's enforcement actions and the Department of Justice's press releases — are the places to read them with their dates and amounts attached.

Mostly in the layering stage described above: mixers, chain-hopping, privacy coins and cycling value through DeFi protocols. The pattern that matters for screening is that the infrastructure gets designated — three mixers in eighteen months, from Blender.io in May 2022 to Sinbad.io in November 2023 — which turns a laundering service's addresses into sanctions-list identifiers.

Other patterns include structuring value across many wallets, and cashing out through services with weak controls. Laundering infrastructure and sanctions increasingly intersect: exchanges and mixers that serve criminal flows end up designated, which pulls their addresses into sanctions screening scope.

Any product that moves value can be used to launder it, and anti-money-laundering law obliges regulated businesses to detect and report the attempt. For crypto and fintech teams the practical controls are layered: identity checks at onboarding, screening of counterparty identifiers against sanctions and crime data, monitoring of transaction patterns, and reporting of suspicious activity.

Screening contributes the list-based layer. Checking a wallet address against designated entities and known criminal infrastructure — ransomware payment addresses, sanctioned mixers, seized wallets — catches the laundering paths that are already publicly identified, before funds move.

How do you know if someone is laundering money? Rarely from one transaction. An AML program watches for the red flags that accumulate: deposits kept just under reporting thresholds, money that moves in and out within hours, volume out of line with the stated business, the use of mixers and privacy tools, and counterparties that appear on sanctions or crime lists. The last of those is the one red flag a screen produces on its own; the rest are monitoring judgements. In the United States the Bank Secrecy Act adds record-keeping duties that make the patterns visible: financial institutions must record and pass on originator and beneficiary details for funds transfers of $3,000 or more (31 CFR 1010.410), and keep a log of bank checks, money orders and similar instruments bought with currency in amounts of $3,000 to $10,000 inclusive (31 CFR 1010.415) — the rules behind the "$3,000 rule" question.