Following the Layers
You are investigating a personal account at a digital bank. The customer, M. Ivanov, opened the account five months ago and receives a salary of about $3,200 per month. On March 3 the account received six incoming transfers totaling $48,000 from four different individuals, each transfer between $7,500 and $9,000, within 48 hours. The same day, $46,500 was sent to a cryptocurrency exchange. One week later, two unrelated companies transferred $61,000 in, and $60,000 was wired to a bank in Cyprus. The account has no loan or investment activity. Ivanov says he is 'helping friends with currency exchange.' The bank has no branches in Cyprus, and onboarding records show the customer has never traveled there. The case has a 15-day target for a filing decision.
1. Reconstruct the fund flow and identify the most likely typology. Be explicit about what is fact and what is inference.
Read the worked answer
Fact pattern: salary of about $3,200 per month; six incoming transfers of $48,000 from four individuals within 48 hours; $46,500 same-day out to a crypto exchange; one week later $61,000 in from two unrelated companies; $60,000 wired to Cyprus. Total inflows are $109,000 and outflows are $106,500, leaving about $2,500 retained.
Inference: the account behaves like a funnel or mule account. The profile is inconsistent with the stated salary, the inflows come from multiple unrelated parties, the funds move out rapidly, and the destinations are a crypto exchange and a high-risk jurisdiction. The near pass-through pattern suggests layering rather than savings or investment. The customer's explanation - helping friends with currency exchange - is generic and does not identify the friends, the source of their funds, or why a personal account is being used.
What is not yet established: whether Ivanov is a witting participant, an unwitting mule, or running an informal money transfer business. The typology is a hypothesis to test, not a conclusion. The crypto leg may be an investment purchase rather than layering, but the timing and the Cyprus wire make that less likely.
Why it matters: the rapid movement and low retention mean the account is a conduit. That should drive tracing toward the counterparties and the ultimate beneficiary, not just the account holder.
2. What tracing steps would you take to identify the ultimate source and beneficiary, and how would you prioritize them?
Read the worked answer
Prioritize time-sensitive and internally available evidence first:
- Preserve and analyze internal data: login IP addresses and device IDs, beneficiary details, wire instructions, transfer references, account opening records, and any linked accounts. A change of device or IP around March 3 is highly relevant.
- Identify the four individual senders and two companies: are they customers of the bank? If so, review their KYC and account activity. If not, obtain names, addresses, and bank details from incoming payment messages and check corporate registries and adverse media.
- Trace the crypto leg: obtain the exchange deposit address and use blockchain analytics to see whether funds moved to a mixer, a high-risk exchange, or a wallet linked to other cases. This is time-sensitive because crypto tracing degrades as funds move.
- Trace the Cyprus wire: identify the beneficiary bank, account name, and any intermediary banks; check whether the beneficiary is a known shell company or shares an address with other entities.
- Check for commonalities: shared addresses, phone numbers, email domains, or introducers across the counterparties. A common controller would change the case from a single mule to a network.
- Use legal process where needed: coordinate with legal for subpoenas or requests to correspondent banks; do not contact counterparties directly in a way that could tip off the customer.
Reasoning: the goal is to connect the account to identifiable people and entities, not merely list transactions. Each step should either identify a controller, establish a legitimate source, or support a law enforcement referral.
3. How would you document the flow in the case file so another investigator or law enforcement can rely on it?
Read the worked answer
Build a fund-flow exhibit with a clear audit trail:
- Chronology table: date, time, amount, direction, counterparty name, account number, institution, payment reference, and source document number. Reconcile total inflows ($109,000) and outflows ($106,500) to the statements.
- Source documents: statements, payment messages, onboarding records, IP/device logs, and crypto exchange records, each indexed as an exhibit with page numbers and retention dates.
- Fact versus inference: label observed transactions as fact. Label conclusions such as 'funnel account' or 'possible mule' as analytical inference, with the reasons stated.
- Gaps and assumptions: identify missing counterparty information, unreturned requests, and any assumptions about currency or timing.
- Visual flow: a simple diagram showing the four individuals and two companies feeding the account, then the crypto exchange and Cyprus beneficiary.
- Chain of custody: record who collected each item, when, from which system, and where the original is stored. If records are exported, preserve the native format and hash where possible.
Reasoning: a reliable case file lets a reviewer reproduce the analysis without redoing it. It should not overstate the evidence: the flow is suspicious, but the file must show what is known and what remains an open question.