/aml-typologies

name: aml-typologies
description: >
  Activate for: AML alert, transaction monitoring, suspicious activity,
  money laundering, structuring, smurfing, round-tripping, layering,
  placement, integration, typology, red flag, velocity alert, geographic
  anomaly, TBML, trade-based money laundering, network analysis, PEP alert.
  NOT for: SAR/STR drafting or filing (use aml-sar-drafting), customer onboarding
  or KYC documentation (use aml-cdd-edd), sanctions list screening (use
  sanctions-screening).
metadata:
  version: "1.0"
  author: "Panaversity — The AI Agent Factory"
  standard: "FATF 40 Recommendations — jurisdiction AML legislation (load overlay)"

THE THREE STAGES OF MONEY LAUNDERING

Placement — Introducing illicit funds into the financial system Red flags: Large cash deposits; multiple deposits just below reporting threshold (structuring); money service business transactions; casino chip purchases/redemptions.

Layering — Obscuring the audit trail through multiple transactions Red flags: Rapid movement through multiple accounts; complex wire sequences across multiple jurisdictions; shell company or nominee director use; conversion between asset classes (cash → wire → crypto → real estate).

Integration — Re-introducing laundered funds as apparently legitimate income Red flags: Luxury asset purchases (real estate, vehicles, art); unexplained business investments; loan repayments from obscure sources; complex "business transactions" with no apparent commercial purpose.

TOP 20 AML TYPOLOGIES WITH DETECTION LOGIC

1. STRUCTURING (SMURFING) Indicator: Multiple cash deposits/withdrawals in a single account, each just below the reporting threshold, within a defined period. Detection rule: ≥3 transactions within 7 days each ≥ 80% of the reporting threshold. ML enhancement: Aggregate transactions per customer per rolling 30-day window. Note: The reporting threshold is jurisdiction-specific (USD 10,000 in USA, varies elsewhere).

2. ROUND-TRIPPING Indicator: Funds sent from Account A to Jurisdiction X, then returned from Jurisdiction X to Account A or a closely connected account within a short period. Detection: Wire-out to jurisdiction X followed by wire-in from same jurisdiction within 30 days, same approximate amount (±10%).

3. RAPID FUND MOVEMENT / VELOCITY Indicator: Account receives large funds then transfers them out within 24–72 hours with minimal balance remaining. Detection rule: Opening balance < 10% of daily inflow; >80% of incoming funds transferred out within 48 hours.

4. GEOGRAPHIC ANOMALY Indicator: Transactions to/from high-risk jurisdictions inconsistent with customer profile. Detection: Any transaction above de minimis to FATF grey-listed or black-listed countries. Enhanced scrutiny for: Iran, North Korea, Myanmar (FATF black list); current grey list — check FATF.org for current listing as it changes quarterly.

5. TRADE-BASED MONEY LAUNDERING (TBML) Indicator: Over/under-invoicing; multiple invoicing; falsely described goods. Red flags: Invoice amounts inconsistent with commodity market price; import/export volumes inconsistent with declared business size; inconsistency between shipping documents and invoices.

6. PROFESSIONAL MONEY LAUNDERING NETWORKS Indicator: Account connected through transactions to other accounts with known AML suspicion or law enforcement interest. Detection: Graph network analysis — identify high-centrality nodes, clusters of accounts with high internal velocity and cash-out at network periphery.

7. PEP UNUSUAL TRANSACTION Indicator: Politically Exposed Person receives unexplained large incoming transfer disproportionate to known income/wealth profile. Detection rule: Any PEP account single transaction > 3× average monthly balance. Any PEP incoming transfer from jurisdiction with high corruption index.

8. SHELL COMPANY LAYERING Indicator: Corporate account with no apparent operational activity — no payroll, no supplier payments, only wire receipts and outflows. Red flags: Beneficial owner structure through Cayman / BVI / Panama / Cyprus; multiple directors with no apparent operational role; no website or publicly verifiable business presence.

9. LOAN-BACK Indicator: Customer places cash/funds in account, then takes a "loan" collateralised by those funds. Repays loan with laundered funds; withdraws original "collateral" clean. Detection: Secured lending against own deposits; loan repayments from sources inconsistent with declared income.

10. REAL ESTATE MONEY LAUNDERING Indicator: All-cash property purchase; multiple rapid buy/sell transactions in same property; purchase at significantly above or below market value. Red flags: Payment from a third party with no apparent connection to the buyer; offshore corporate as buyer with opaque beneficial ownership.

11. CRYPTO-TO-FIAT CONVERSION Indicator: Incoming wires from cryptocurrency exchanges to bank accounts. Red flags: High-frequency conversion from multiple exchanges; exchanges operating in high-risk jurisdictions with weak AML controls; transaction amounts not rounded (characteristic of crypto exchange deposits).

12. MONEY MULE ACTIVITY Indicator: Account receives funds from multiple unknown sources and immediately transfers to third parties; account holder's profile inconsistent with transaction volumes. Detection: Multiple incoming wires from unknown parties; average transaction ≫ declared income; account holder has changed personal details (address, employment) recently.

13. INSURANCE PREMIUM FINANCING LAUNDERING Indicator: Purchase large-value life insurance policy with lump sum; cancel early and accept surrender penalty to receive "clean" refund cheque from insurer. Red flags: Large single premium life insurance; early policy surrender; cash source inconsistent with declared income.

14. INV