Anti-Money Laundering: Mission Domain Intelligence Guide

Money laundering intelligence is not about spotting dirty money. It is about spotting structures whose only purpose is to make ownership unreadable. The structure is the evidence.

What Anti-Money Laundering covers as a mission domain

Anti-money laundering intelligence covers the detection and disruption of the processes by which criminal proceeds are placed, layered and integrated into the legitimate economy, and the regulatory architecture built to stop it. Practitioner work includes typology analysis, suspicious activity assessment, beneficial-ownership resolution, correspondent banking and payment corridor risk, trade-based laundering detection, virtual-asset tracing and the review of professional gatekeepers. It also covers terrorist and proliferation financing, which share the same plumbing but differ in that funds may be lawfully sourced and the harm lies in the destination.

Typologies cluster into cash-intensive front businesses; trade-based laundering through mis-invoicing and phantom shipments; corporate layering through low-transparency jurisdictions and nominee arrangements; real estate, luxury goods and art used as value stores; underground banking and hawala; money mule networks; and virtual assets moved through mixers, cross-chain bridges and non-compliant exchanges. Gatekeepers, meaning lawyers, accountants, trust and company service providers and estate agents, appear in almost every serious structure.

Why it matters

Laundering is the service layer that makes profit-driven crime worth committing, and disrupting it is what converts a predicate offence into asset recovery and returns value to victims and treasuries. Its side effects are broad: inflated housing markets, corrupted professional sectors, and financial institutions carrying enforcement penalties measured in billions. Weak controls also let sanctioned and proliferation-linked actors reach the banking system through intermediaries that look ordinary on paper.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

• Corporate chains crossing three or more jurisdictions with no operating substance, terminating in nominee or bearer-equivalent arrangements.
• Transaction values sitting just below reporting or declaration thresholds, repeated across accounts, branches or consecutive dates.
• Round-figure cross-border transfers referencing consultancy or management fees with no supporting contract or deliverable.
• Invoice values diverging materially from prevailing market price for the commodity, or shipments of goods the parties never otherwise handle.
• Long-dormant accounts suddenly receiving many small credits from unrelated individuals and immediately transferring the aggregate out.
• Property purchased in cash or through short-lived corporate ownership and resold rapidly at little or no gain.
• Virtual-asset flows routed through mixers, chain-hopping or exchanges with no verified customer identification before fiat cash-out.
• A single professional services address serving as registered office for hundreds of companies with unrelated declared activities.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

• FATF — Recommendations, mutual evaluation reports, and the lists of jurisdictions under increased monitoring or call for action.
• Basel AML Index — Comparative country risk scoring drawn from FATF and governance indicators, useful for portfolio triage.
• FinCEN — Advisories, enforcement actions and typology guidance derived from US suspicious activity reporting.
• ICIJ Offshore Leaks Database — Searchable records from the Panama, Paradise and Pandora Papers linking entities to beneficial owners.
• OpenCorporates and OpenOwnership — Company registry aggregation and beneficial ownership data supporting cross-jurisdiction linkage.
• Egmont Group — Framework and membership for financial intelligence unit cooperation and cross-border information exchange.
• Public beneficial ownership registers — Where available, direct evidence of the controlling natural persons behind corporate vehicles.
• Blockchain explorers and public attribution datasets — Address clustering, flow tracing and exchange attribution for virtual-asset laundering analysis.

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

1. Establish the predicate hypothesis — Identify what crime generated the funds, because without it unusual is not suspicious and asset recovery has no legal foundation.
2. Resolve beneficial ownership — Work the corporate chain down to natural persons using registries, filings, leaks, litigation and signature evidence, recording confidence at each hop.
3. Reconstruct the flow — Sequence transactions into placement, layering and integration phases, noting every point where value changes form or jurisdiction.
4. Test economic substance — Ask whether each transaction makes commercial sense on its own terms, and identify counterparties with no capacity to perform.
5. Assess gatekeepers and institutions — Name the professionals and financial institutions in the chain and determine whether controls failed, were absent or were deliberately circumvented.
6. Locate recoverable assets — Map assets to jurisdictions and ownership forms, and assess the practical enforceability of restraint or confiscation in each.
7. Report and refer — Produce a suspicious activity report, regulator referral or law enforcement package with a stated typology and an indexed evidence set.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Practised with these disciplines

• Financial Intelligence — Following Value Through the Financial System
• Sanctions Intelligence — Screening, Designations, and Evasion Detection
• Corporate Intelligence — Understanding Companies, Structure, and Control
• Accounting Intelligence — Financial Statements and Accounting Analysis
• Legal Intelligence — Law, Litigation, and Regulatory Intelligence
• Cryptocurrency Intelligence — Tracing Value on Public Ledgers
• Identity Intelligence — Resolving and Verifying Who Someone Is

Worked in these data points

• Bank Account / IBAN — A bank account identifier (IBAN, SWIFT/BIC, routing + account) central to financial tracing.
• Company / Organization — A legal entity — corporation, LLC, NGO, or business.
• Person / Name — A named individual — the subject of identity resolution and profiling.
• Sanction / Watchlist Entry — An entry on a sanctions list, watchlist, or PEP database.
• Legal Entity Identifier — A 20-character global identifier for a legal entity participating in financial transactions.
• Cryptocurrency Address — Blockchain wallet address for receiving or sending crypto assets.
• Corporate Filing — A regulatory or corporate filing (SEC, Companies House, court).

Adjacent mission domains

• Financial Crime
• Sanctions Evasion
• Fraud & Identity
• Corruption & Governance
• Organized Crime
• Art & Antiquities Trafficking

Inside the platform: where Anti-Money Laundering lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

• sanctions.php — Anti-Money Laundering dashboard
• domain.php?d=aml — Mission domain hub
• theater.php?d=aml — Threat theater view
• search.php — Company / Organization profile
• correlate.php — Correlation graph
• cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

Relevant playbooks

Of the 14 incident playbooks in playbooks.php, these apply directly to Anti-Money Laundering:

• Sanctions Screening & Escalation — a step-checked workflow with the pivots, sources and handling rules already wired in.
• Cryptocurrency Tracing — a step-checked workflow with the pivots, sources and handling rules already wired in.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

• Threat Hunt
• Correlate Infrastructure
• Run Alert Rules
• Export STIX/MISP
• Summarise (Copilot)
• Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

1. Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Establish the predicate hypothesis is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
2. Building the picture. A single indicator is rarely the story. Reconstruct the flow turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
3. Producing something actionable. Analysis that ends in a document nobody can use is wasted. Report and refer feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Anti-Money Laundering

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Defence use is counter-threat finance: understanding how an adversary moves and stores value, which commercial structures carry its logistics payments, and where financial pressure would degrade capability. Products support targeting of networks by non-kinetic means, contractor vetting on deployment, and assessment of whether local payment channels used by the force are being exploited. Analysts contribute the structural picture, meaning the front companies, exchange houses and trade routes, while financial intelligence units and treasuries hold the transactional detail. Constraints are significant: military analysts rarely have lawful access to financial records, and any product implying access to banking data without the corresponding authority creates immediate handling and legal problems.

🕵 National intelligence

National services use money laundering analysis to map the financial infrastructure of hostile states, proliferation programmes, organised crime and terrorist organisations, and to identify the professional gatekeepers servicing several of them at once. Requirements are structural: who launders for whom, through which jurisdictions, using which corporate vehicles. Fusion combines FIU disclosures, sanctions data, corporate registries, trade data and leak-derived material, and the handling rules of the most restricted input govern the whole product. Dissemination priorities are treasury and sanctions authorities, prosecutors, and partner FIUs through Egmont channels, normally with the underlying disclosure material excluded.

👮 Law enforcement

For investigators, laundering charges are frequently easier to prove than the predicate offence, because the movement of funds is documented while the underlying crime may not be. Evidence requirements are the account records, corporate documents, communications showing knowledge or suspicion, and the tracing analysis connecting proceeds to a criminal source. Production orders, account freezing orders and mutual legal assistance are the routine instruments, and the sequencing against dissipation risk is a strategic choice. Reliance on suspicious activity reports is legally constrained in most jurisdictions: they are intelligence, generally not evidence, and tipping-off provisions restrict what can be disclosed to whom.

🔍 Private investigation and corporate security

Private-sector work covers enhanced due diligence, correspondent banking reviews, source-of-wealth and source-of-funds assessment, asset tracing and remediation of failed onboarding files. The deliverable is a documented ownership and funds assessment stating what has been verified, what is asserted and what could not be established. A private actor cannot access transaction data outside their own institution, may not obtain banking records by pretext, and must not tip off a subject where a report has been made. The recurring risk is producing a file that discharges a procedural obligation without answering the question, which regulators increasingly test and penalise.

📰 Journalism and OSINT media

Reporting in this field rests on documents: registry filings, leaked corporate records, court judgments, property registers and enforcement notices. Verify beneficial ownership claims against at least two independent sources, since nominee arrangements make single-source attribution unreliable. Be precise about the difference between a structure that is opaque and one that is criminal, because most complex structures are lawful. Protect whistleblowers and leak sources absolutely, including from metadata exposure. Provide detailed right of reply, expect well-funded pre-publication legal challenge, and secure legal review that specifically addresses the jurisdiction of every named individual.

🌍 NGO, humanitarian and human rights

Transparency and anti-corruption organisations use laundering analysis to demonstrate how public funds leave developing countries, to campaign for beneficial ownership registers, and to support asset recovery for affected populations. Documentation should be built to evidentiary standards so it can support formal complaints, sanctions submissions and litigation. Do-no-harm requires care with named individuals in jurisdictions where accusation invites violence rather than due process, and with local partners who carry the exposure. Duty of care includes preparing legal support for staff before publication, since strategic litigation against civil society in this field is routine and well resourced.

🎓 University and research

Research covers illicit financial flow estimation, effectiveness of AML regimes, corporate transparency and network analysis of ownership structures. Methodology must confront a chronic evidence problem: the standard flow estimates rest on contested trade-mispricing assumptions, and the effectiveness literature struggles because outcome data on prevented laundering does not exist. Reproducibility is well served by open registry and leak datasets, provided entity resolution rules are published, since they drive results. Ethics approval matters for interviews with compliance professionals and for handling leaked personal data, which requires a documented public interest assessment and minimisation before any analysis begins.

Playbook: working Anti-Money Laundering end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Establish the question and the legal basis

Fix whether you are assessing a customer, tracing proceeds, testing a typology or building a network picture, and confirm what data you may lawfully hold and use for that purpose. Record the lawful basis for any personal data and the handling caveats of any restricted input. Output is a scope note with the legal basis stated. Stop when you know which sources are available to you and which would require an instrument you do not have.

Phase 2 — Resolve the entity and its identifiers

Build a canonical record for each subject: legal name and variants, transliterations, registration numbers, LEI, dates of birth or incorporation, addresses and known aliases. Poor entity resolution is the most common cause of both false positives and missed matches, and everything downstream inherits the error. Stop when every identifier in use is recorded with its source and you can state the confidence that two records refer to the same party.

Phase 3 — Map the ownership structure

Trace shareholdings and control upward through each layer until you reach natural persons or an unresolvable jurisdiction. Record nominee arrangements, trusts, foundations, bearer instruments and powers of attorney. Where the chain breaks, state precisely where and why rather than presenting an incomplete chain as complete. Output is a structure diagram with confidence per link. Stop when further work produces no new layers.

Phase 4 — Test the structure against a purpose

For every structural feature, ask what legitimate commercial, tax or succession purpose it serves. Complexity alone is not evidence. A finding is generated where a feature has no explanation other than obscuring ownership, defeating enforcement or breaking a traceable link. Stop when you can articulate, feature by feature, the purpose served and which features lack any innocent account.

Phase 5 — Assess source of wealth and source of funds separately

Source of wealth explains how the overall fortune was accumulated; source of funds explains where the specific money in this transaction came from. Conflating them is a routine and consequential error. Evidence each with documents: business sale agreements, dividend records, property sales, inheritance documents, tax filings. Stop when each is separately evidenced or explicitly recorded as unverified.

Phase 6 — Analyse the transactional pattern

Where you have lawful access to transaction data, examine structuring, round-sum activity, rapid pass-through, circularity, jurisdictional routing inconsistent with the trade, and value that does not match the customer's stated profile. Compare against the customer's own stated expected activity. Output is a documented pattern assessment referencing specific transactions and dates, not a generic typology label.

Phase 7 — Test trade and value-transfer channels

For trade-based laundering, compare invoiced values, quantities and commodity descriptions against market prices, shipping records and physical plausibility. For informal value transfer, look for settlement patterns, dealer networks and offsetting flows. For virtual assets, trace on-chain and identify the fiat off-ramp. Stop when you can name the channel and the counterparties rather than asserting a mechanism.

Phase 8 — Identify the gatekeepers

Name the professionals in the structure: trust and company service providers, lawyers, accountants, estate agents, corporate directors and payment institutions. Check their regulatory status and disciplinary history. Gatekeepers appear across many structures and are the most productive systemic target. Stop when you can identify which appear in more than one matter you hold.

Phase 9 — Screen for sanctions and PEP exposure

Run every resolved natural person and entity against sanctions lists, PEP data and adverse media, resolving hits properly rather than clearing them on a name mismatch. Apply ownership and control aggregation rules where designated persons appear below threshold individually. Output is a screening record with the list versions and dates used, which is what a supervisor will examine.

Phase 10 — Grade the finding and decide the action

Classify as suspicion requiring a report, risk requiring enhanced measures, or explained. Where a report is required, file it to the standard the FIU actually needs: specific, structured, with identifiers and a clear statement of what is suspected and why. Observe tipping-off restrictions absolutely from this point. Stop when the decision and its reasoning are recorded in a form that will be defensible years later.

Phase 11 — Preserve for enforcement

Retain the underlying documents, screening records, decision rationale and version history with continuity. Financial investigations surface years later and the ability to demonstrate what was known and when is what determines liability for the institution and credibility for the analyst. Output is an archived case file that a successor can reconstruct without asking you anything.

Phase 12 — Feed typologies back into detection

Convert the mechanics observed into monitoring rules, onboarding questions and risk-model changes, and share sanitised typologies through industry and public-private partnership channels. The value of a resolved case lies mostly in whether the next instance is detected earlier. Stop when each observed mechanic has either produced a control change or been consciously accepted as out of appetite.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
FATF standards, guidance and mutual evaluations	Open	The forty Recommendations, typology reports and country evaluation reports assessing technical compliance and effectiveness.	Supplies the governing standard, recognised typologies and an assessment of each jurisdiction's actual control quality.
Egmont Group	Open	Global network of financial intelligence units with governance material and guidance on information exchange.	Establishes the route by which FIU-to-FIU information requests move across borders in a cross-jurisdiction case.
FinCEN advisories, guidance and enforcement	Open	US financial intelligence unit red-flag advisories, regulatory guidance and enforcement actions against institutions.	Provides current typology indicators and the US regulatory expectation for detection and reporting quality.
OpenSanctions	Open	Consolidated open dataset of sanctions targets, politically exposed persons and related entities with identifiers.	Enables multi-regime screening and PEP identification without a commercial subscription, with reproducible source data.
OpenOwnership register	Open	Aggregated beneficial ownership data from participating jurisdictions in a standardised structured format.	Resolves declared beneficial owners across borders and identifies inconsistencies between national declarations.
OpenCorporates	Registration	Company registry aggregation with officers, addresses and cross-jurisdiction linkage across many registries.	Builds ownership and directorship graphs and detects shared addresses and nominee patterns across jurisdictions.
Companies House	Open	UK registry including persons of significant control declarations, filing history and charges.	Primary evidence for UK layers of a structure, including control declarations that can be tested against reality.
ICIJ Offshore Leaks database	Open	Searchable database of offshore companies, trusts, officers and intermediaries from major leak investigations.	Identifies offshore layers and the formation agents behind them where registries publish no ownership data.
Aleph by OCCRP	Registration	Cross-searchable archive of leaks, registries, court records and procurement data from many jurisdictions.	Surfaces mentions of entities and individuals across document collections that registry search alone would miss.
Basel AML Index	Registration	Composite country risk ranking for money laundering and terrorist financing built from public indicators.	Supports jurisdiction risk scoring in customer and correspondent banking risk assessments with a citable basis.
StAR Initiative resources	Open	Stolen Asset Recovery Initiative research on asset recovery practice, beneficial ownership and PEP handling.	Provides practical guidance and case precedent on tracing and recovering proceeds held through corporate vehicles.
Wolfsberg Group principles and questionnaires	Open	Bank-developed standards for correspondent banking, PEPs, trade finance and customer due diligence.	Supplies the industry benchmark used to assess whether an institution's correspondent controls were adequate.
Blockchain explorers and analytics	Open	Public transaction histories, address clustering and service attribution for major distributed ledgers.	Traces virtual asset movement to exchange deposit addresses and identifies the point of fiat conversion.
UN Comtrade	Registration	Bilateral trade statistics by commodity code enabling comparison of reported export and import values.	Supports trade-based laundering analysis through mispricing detection and mirror comparison by corridor.
UNODC money laundering resources	Open	Convention frameworks, model legislation and analytical work on laundering and asset confiscation regimes.	Establishes the international legal basis and supports capacity-building and legal-reform recommendations.
National Crime Agency guidance on suspicious activity reporting	Open	UK guidance on submission standards, glossary codes and defence against money laundering requests.	Sets the practical standard for UK reporting quality and consent processes in live transactions.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Anti-Money Laundering. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

• Transaction monitoring systems — Rule and model-based detection of anomalous account activity at scale. Limitation: alert volumes are dominated by false positives, and tuning is where the real analytical work sits.
• Screening and name-matching engines — Compare customers against sanctions and PEP data with fuzzy matching. Limitation: transliteration and threshold settings drive both false positives and silent misses.
• Linkurious or Maltego — Visualises ownership, address and transaction relationships across large entity sets. Limitation: presentation confers unwarranted confidence on inferred links.
• Aleph by OCCRP — Cross-searches leaked and public document collections for entity mentions. Limitation: uneven coverage and unreliable document dating require verification at source.
• Blockchain analytics platforms — Cluster addresses and attribute them to services and exchanges. Limitation: attribution is proprietary and probabilistic, so it corroborates rather than proves.
• OpenSanctions and open screening datasets — Reproducible multi-regime screening data with published provenance. Limitation: update cadence and identifier quality vary by source list.
• Entity resolution frameworks — Deduplicate and match records across registries and internal systems. Limitation: matching rules embed assumptions that must be documented or results cannot be defended.
• Case management with audit trails — Records decisions, evidence and timing to support later regulatory examination. Limitation: value depends entirely on analysts recording reasoning rather than conclusions.
• Trade price benchmarking data — Compares invoiced unit values against market ranges for mispricing detection. Limitation: legitimate price variance is wide, so outliers need corroboration before they mean anything.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

• Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
• Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
• Run Alert Rules — Evaluates saved rules against new data so a first sighting raises a notification rather than waiting for review.
• Export STIX/MISP — Streams the selection in CTI standard formats for sharing with partners and ISACs.
• Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
• Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

• The finding is a structure with no purpose other than opacity. Complex is not criminal, and analysts who treat layering as inherently suspicious produce reports that regulators and courts discard, so evidence the absent legitimate rationale feature by feature.
• Source of wealth and source of funds are different questions with different evidence. A subject can document a plausible fortune while being entirely unable to explain the specific money in the account in front of you, and it is the second failure that matters.
• Entity resolution quality determines everything downstream. Two hours spent building canonical identifiers with transliterations, registration numbers and dates prevents both the false positive that wastes a week and the silent miss that ends a career.
• Nominee directors are visible in aggregate. A single person holding hundreds of directorships across unrelated sectors and jurisdictions is a service, not a businessman, and mapping that service reveals more structures than working any individual company will.
• Trade mispricing needs a physical test, not only a price test. Compare declared quantity against container capacity, vessel manifests and the physical characteristics of the goods, because a wildly implausible volume is far harder to argue away than an unusual unit price.
• Treat suspicious activity reports as intelligence with legal constraints attached. They are generally not evidence, they carry tipping-off restrictions, and building an external narrative around their existence rather than around the underlying documents creates serious legal exposure.
• Gatekeepers are the systemic target. A trust and company service provider or formation agent that appears in several unrelated structures yields more disruption than any individual laundering chain, and unlike the launderers they are regulated, insured and locatable.
• Record what you could not establish as carefully as what you could. A file that states clearly where the ownership chain broke and why is defensible; one that presents a partial chain as complete is a finding waiting to be reversed by a supervisor or a court.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Anti-Money Laundering is producing anything, and they are worth baselining before you change process or tooling.

• Proportion of suspicious activity reports that the receiving FIU or law enforcement actions, rather than the number of reports filed.
• False positive rate in screening and monitoring alerts, tracked alongside confirmed true positives to show tuning is improving both.
• Median time from alert to a documented decision with reasoning, as a measure of investigative throughput quality.
• Percentage of customer files in which beneficial ownership is resolved to natural persons or the break point is explicitly documented.
• Number of gatekeepers identified as recurring across unrelated structures, indicating network-level rather than case-level analysis.
• Value of assets restrained or recovered attributable to analysis produced, tracked over multi-year horizons.
• Proportion of typologies observed in casework that result in a specific monitoring rule or onboarding control change.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

• Treating jurisdiction as a verdict, when legitimate businesses use offshore structures and onshore states host plenty of opacity.
• Over-relying on name screening, since transliteration, common names and weak matching logic generate both false positives and confident misses.
• Confusing complexity with criminality, because tax planning, family governance and creditor protection also produce complicated structures.
• Assuming a leaked database entry is current, when offshore records go stale quickly and directors and shareholders change.
• Chasing every hop in a virtual-asset trace instead of identifying the off-ramp where a real identity is actually attached.

Legal and ethical considerations

Suspicious activity reporting carries strict tipping-off prohibitions in most jurisdictions, and disclosing that a report has been made can itself be an offence. Beneficial ownership data drawn from leaks is lawful to analyse in many places but may be inadmissible or restricted, so treat it as lead material and corroborate from primary records. Data-protection law limits profiling of individuals, and unsupported laundering allegations expose both analyst and client to serious defamation and regulatory consequences.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Anti-Money Laundering, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 7 intelligence disciplines, 7 data points, 6 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

Is a complex offshore structure evidence of money laundering?

No, and treating it that way is the fastest route to a discredited report. Multi-jurisdiction structures are routinely used for legitimate tax planning, succession, joint venture governance, asset protection and regulatory reasons. The analytical task is to identify features that serve no purpose other than obscuring ownership or defeating enforcement: bearer instruments, nominee arrangements layered without commercial function, jurisdictions chosen purely for non-disclosure, or structures that break traceability at exactly the point where funds change character. Evidence the absence of a legitimate purpose feature by feature, and be honest when a structure is merely opaque rather than suspicious.

Why is trade-based laundering so hard to detect?

Because the mechanism hides inside ordinary commercial variance. Invoiced prices legitimately vary by contract terms, quality, volume, relationship and timing, so a single mispriced consignment is unremarkable. Detection requires either a physical plausibility test, comparing declared quantities against container and vessel capacity, or a pattern across many shipments between the same parties. Trade documents are also generated by the parties themselves and rarely verified by anyone. Add the volume of world trade against the number of officers examining it, and the base rate problem becomes obvious. Systematic corridor analysis works far better than transaction-level screening.

How should virtual assets change the approach?

Tracing becomes easier and attribution becomes harder. Public ledgers provide complete movement history at no cost, which no banking system offers, so reconstruction is often immediate. The difficulty is connecting an address to a person, which requires records from an exchange or service obtained through legal process, and the trail degrades where funds move through non-compliant services, cross-chain bridges or privacy mechanisms. Practically, this means preservation requests must go out within hours, and analysts should focus on the fiat off-ramp, which is the regulated chokepoint where identity actually exists.

What does a good suspicious activity report look like?

Specific and structured. It names the parties with full identifiers, states clearly what is suspected and the reasoning, references the particular transactions with dates and amounts, identifies the predicate offence suspected where possible, and flags any urgency or dissipation risk. It avoids boilerplate typology language and avoids burying the point in narrative. FIUs triage on actionability, so a report that gives them a clear hypothesis and the identifiers to develop it competes for attention. Defensive reporting of anything unusual, without analysis, degrades the whole system and buries the reports that matter.

Are beneficial ownership registers actually useful?

Yes, with important caveats. They provide a declared starting point, they create a criminal offence for false declaration in several jurisdictions, and they let analysts spot inconsistency between what is declared in different countries about the same structure, which is a strong signal in itself. The caveats are that many registers are unverified, coverage is partial, some have been restricted following legal challenge, and determined actors declare a nominee. Treat a register entry as a testable claim rather than as the answer, and give real weight to contradictions between filings in different jurisdictions.

How do you handle leaked data lawfully and ethically?

Assess before you open it. Establish the lawful basis for processing, conduct and document a public interest assessment, minimise to what is necessary for the question, and store separately with restricted access. Personal data of uninvolved individuals should be excluded from analysis and never published. Verify anything material against independent sources rather than relying on the leak alone, since leaked collections contain errors, drafts and forgeries. In several jurisdictions possession or use by a regulated firm raises specific problems, so obtain legal advice before ingesting a collection into any institutional system.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

• FATF Forty Recommendations, the global standard covering customer due diligence, beneficial ownership, reporting, supervision and international cooperation.
• UN Convention against Transnational Organized Crime and the UN Convention against Corruption, which frame criminalisation, confiscation and mutual legal assistance.
• EU Anti-Money Laundering Directives and the Anti-Money Laundering Regulation package, governing obliged entities, registers and supervision in the EU.
• UK Proceeds of Crime Act and Money Laundering Regulations, which define the reporting duties, tipping-off offences and civil recovery powers.
• US Bank Secrecy Act and the Corporate Transparency Act framework, governing reporting obligations and beneficial ownership information collection.
• Wolfsberg Group principles for correspondent banking, trade finance and politically exposed persons, the recognised industry benchmark.
• Egmont Group principles for information exchange between financial intelligence units, governing cross-border FIU cooperation.
• Basel Committee guidance on sound management of risks related to money laundering and financing of terrorism, applying to banking supervision.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

1. The FATF Recommendations and methodology — Financial Action Task Force. The global AML and CFT standard and its assessment framework.
2. Advisories and red flag guidance — FinCEN, US Department of the Treasury. Current typology indicators for institutions and investigators.
3. Beneficial ownership data standard and register — OpenOwnership. Structured cross-border beneficial ownership disclosure data.
4. Offshore Leaks database — International Consortium of Investigative Journalists. Offshore entity, officer and intermediary records from leak investigations.
5. Stolen Asset Recovery Initiative publications — World Bank and UNODC. Practical guidance on tracing and recovering proceeds of corruption.
6. Basel AML Index — Basel Institute on Governance. Composite country risk ranking used in jurisdiction risk assessment.
7. Correspondent banking and due diligence principles — Wolfsberg Group. Industry benchmark standards for financial institution controls.
8. Information exchange principles for financial intelligence units — Egmont Group. Framework governing FIU-to-FIU cooperation and disclosure.
9. Money laundering and asset confiscation frameworks — UN Office on Drugs and Crime. Convention basis and model legislation for national regimes.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: resolves opaque ownership chains to natural persons and reconstructs the flow that connects them. Explore the platform, or browse the rest of the library by following any tag above.