Fraud & Compliance / Learning brief
AML transaction-monitoring typologies
Your notes
In simple terms / 01
What this means in plain language
Transaction monitoring watches for named laundering behaviours such as structuring, pass-through movement, round-tripping, and layering. This defensive article explains each pattern and how scenarios and thresholds surface it for review.
Transaction monitoring is the automated review of account activity that looks for behaviour associated with money laundering. It works by running scenarios, which are rules that describe a suspicious pattern, against the flow of payments, and by raising an alert when activity crosses a defined threshold. This article is defensive: it names the classic patterns so that controls can recognise them. Structuring, also called smurfing, breaks a large sum into many small transactions to stay under reporting limits. Pass-through, or rapid movement, sends funds into an account and straight out again so the balance never settles. Round-tripping moves money out and back through connected parties to create a false trail of activity. Layering combines many such steps to hide an origin. Monitoring does not decide guilt. It surfaces activity that does not fit the expected picture, and a human analyst then reviews the context, requests information if needed, and escalates a genuine concern for reporting.
Complete lesson / 02
Understand the full idea, step by step
A single payment almost never looks criminal on its own. EUR 9,000.00 moving between two accounts is just a payment. What makes laundering visible is repetition and shape — the same move, again and again, arranged to stay quiet. This lesson names the shapes that transaction monitoring watches for. It describes them so controls can detect them; it is not a set of instructions for anyone attempting them.
Scenarios and thresholds, briefly
A scenario is a description of a suspicious pattern written so a computer can test it; a threshold is the point at which activity becomes notable enough to raise an alert. Set thresholds too loosely and analysts drown in false positives; set them too tightly and genuine cases slip through. So teams tune scenarios using historical outcomes and segment customers, so a small business is not judged by the same yardstick as a large corporate. Throughout, hold onto one framing: an alert is a question, not a verdict.
Structuring (smurfing) — splitting an amount to stay under a threshold
Structuring splits a large amount into many smaller transactions so each falls below a reporting or scrutiny threshold. As a detection signal, defensive scenarios look for clusters of similar-sized transactions just under a known limit, for the same customer using several branches or channels in a short period, and for many small credits that aggregate to a large sum. Maya's nine deposits are the textbook shape: similar amounts, just under the limit, spread across branches, adding to far more than any one would draw attention to.
Pass-through (rapid movement)
Pass-through describes funds that arrive and leave quickly, so an account behaves like a corridor rather than a store of value. Monitoring detects it by measuring the time between credit and debit, the proportion of incoming funds sent onward, and whether an account holds little balance despite high turnover. It is difficult to see one transaction at a time and clear across a window — which is exactly what a scenario examines.
Round-tripping
Round-tripping moves money out of an account and eventually back to the same interest through connected companies or individuals, manufacturing apparent trading or investment activity that has no real economic substance. Detecting it depends on seeing relationships, not individual payments: link analysis reveals that seemingly separate accounts share owners, addresses, devices, or repeated counterparties, and spots circular flows where value returns to its starting point after several hops.
Typologies as detection signals
- Structuring / smurfing
- Clusters of similar amounts just under a threshold, across branches or channels, that aggregate to a large sum
- Pass-through / rapid movement
- Short time between credit and debit; most of what arrives is sent onward; high turnover, low balance
- Mule-account behaviour
- A previously quiet personal account suddenly receiving from many unrelated parties and forwarding onward
- Round-tripping / layering
- Circular flows among connected parties; chains that reconnect after several hops with no clear economic purpose
Is a mule account always someone knowingly laundering money?
Not necessarily — and that is why the account is investigated, not condemned. A mule account receives funds from others and forwards them onward, and the account holder is sometimes a willing participant, sometimes a victim recruited under a false pretext, and occasionally someone whose ordinary activity simply resembles the pattern. The scenario surfaces the behaviour — many unrelated inbound payers, quick onward movement from a formerly quiet account — and a trained analyst then examines the full context before drawing any conclusion.
Why monitoring is the right tool for these
Every typology here is defined by aggregation or relationship rather than by any single payment. Structuring is a cluster; pass-through is a timing ratio; round-tripping is a circle in a network. None of them is visible one transaction at a time, and all of them are visible across a window or across a graph of counterparties — which is exactly the view monitoring assembles and real-time screening cannot. That is why these behaviours belong to monitoring, and why the honest description of each is a description of how it is caught.
STRICTLY SPEAKING
Strictly speaking, the exact definition of each typology, the thresholds that surface it, and the reporting obligations that follow are set by each jurisdiction and each institution's risk assessment — the patterns are stable, the parameters are not. Naming these shapes supports detection and investigator training; it is deliberately not operational detail for evasion, and none is offered here.
FOR NOW, REMEMBER
- Typologies are named laundering shapes described here as what controls watch for — never as a how-to.
- Structuring splits an amount to stay under a threshold; monitoring catches the cluster that any single deposit would hide.
- Pass-through and mule behaviour show as timing and turnover signals; round-tripping shows as circular flows in a network.
- Each is defined by aggregation or relationship, invisible in one payment and clear across a window — which is why monitoring, not screening, surfaces them, and an alert remains a question for an analyst.
TRY IT YOURSELF
Over four days a customer makes nine cash deposits of EUR 9,400.00 each at three different branches; the regime's scrutiny threshold is EUR 10,000.00 per deposit. What has monitoring most likely detected, and what happens next?
When an alert survives investigation and a real suspicion holds, the bank has a duty to act on it. The next lesson follows that duty: filing a suspicious activity report, the MLRO's role, and the ban on tipping off.
KEEP GOINGKey takeaways / 03
Three things to remember
- 01
Scenarios and thresholds turn suspicious patterns into reviewable alerts.
- 02
Structuring, pass-through, round-tripping, and layering are classic typologies.
- 03
Monitoring surfaces activity for human review; it does not decide guilt.
Practical use cases / 04
Where you would use this
Analysts triage alerts against a named typology to focus investigation.
Model teams tune thresholds to balance detection against false positives.
Investigators assemble alert patterns into a case for a suspicious activity report.
Worked example / 05
Put the idea into a real situation
Illustrative example: a fictional account at Meridian Trust receives 9 deposits of EUR 2,800.00 over 4 days, just under a EUR 3,000.00 reporting threshold, then sends EUR 25,000.00 onward within 6 hours of the final deposit. A structuring scenario and a pass-through scenario both alert. An analyst reviews the account's expected profile, finds no matching business activity, requests an explanation, and escalates the case for a suspicious activity report.
Evidence & review / 07
Evidence & review
Common money-laundering typologies framed as detection signals for transaction monitoring; typology definitions, thresholds, and reporting duties vary by jurisdiction and institution.
What this brief simplifies: Describes each typology at the level of the signal a control looks for, deliberately omitting operational detail. Real scenarios combine multiple signals, use link analysis and statistical scoring, and are tuned per segment; the EUR figures are illustrative and jurisdiction-specific.
Sources for this brief2
- Official requirement
The FATF Recommendations: International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation ↗ — Financial Action Task Force · Recommendation 20 (suspicious transaction reporting); Recommendation 1 (risk-based approach)
Adopted in 2012 and updated regularly since; the June 2025 FATF plenary agreed revisions to Recommendation 16 on payment transparency. Consult the live consolidated text for the current wording.
- Simplified educational illustration
Payments Signal editorial teaching models — Payments Signal · Maya's nine-deposit structuring case and the typology signal table
Used wherever diagrams, scenarios, figures, or example values are didactic constructions rather than sourced facts; every such use carries a simplifications disclosure. All people, companies, banks, and list entries in examples are fictional.