CFCI key terms

The process of disguising the origin of illegally obtained funds by moving them through transactions so they appear to come from a legitimate source, typically in placement, layering, and integration stages.

The first stage of money laundering, in which illicit cash enters the financial system through deposits, purchases, or currency exchange, often split into small amounts to avoid reporting thresholds.

The stage of money laundering that creates complex chains of transfers, shell companies, and cross-border movements to separate funds from their criminal origin and obscure the audit trail.

The final money laundering stage, where laundered funds re-enter the legitimate economy as apparently lawful assets, investments, or business revenue, making the funds usable without raising suspicion.

Deliberately breaking transactions into amounts below currency reporting thresholds to avoid triggering mandatory disclosure, an activity that is itself a federal offense in many jurisdictions.

Using multiple individuals or accounts to conduct many small transactions that collectively move a large sum, thereby spreading activity across people to evade detection and reporting requirements.

A legal entity with no genuine operations, employees, or physical presence, formed to hold accounts or assets and often used to conceal true ownership and distance criminals from transactions.

The identity of the natural persons who ultimately own or control a legal entity or account, regardless of the nominal titleholder, a concept central to customer due diligence and transparency rules.

The risk-based process of identifying customers, verifying their identity, understanding their business purpose, and monitoring activity, used by financial institutions to detect and deter illicit finance.

A confidential filing submitted by a financial institution to a financial intelligence unit describing transactions that appear unusual or potentially tied to criminal activity, without requiring proof of wrongdoing.

A national agency that receives, analyzes, and disseminates suspicious transaction reports and other financial data to law enforcement and regulators, often coordinating international information sharing.

The raising, movement, and provision of funds to support terrorist acts or organizations, which may involve small sums and legitimate sources, distinguishing it from profit-driven money laundering.

The automated comparison of customers, transactions, and counterparties against government watchlists and embargo lists to prevent dealings with prohibited persons, entities, or jurisdictions.

Intentional deception for financial or personal gain, encompassing schemes such as identity theft, payment card fraud, investment scams, and fraudulent claims, often executed through misrepresentation or forged documents.

Obtaining and using another person's personal identifiers, such as name, account numbers, or government identification, without authorization to commit fraud or gain access to resources.

Offering, giving, receiving, or soliciting something of value to influence the actions of a person in a position of trust, including public officials, often detected through unusual payments or gifts.

The illegal concealment of income or assets from tax authorities through false reporting, hidden accounts, or offshore structures, frequently generating unexplained wealth requiring laundering.

A social engineering attack that sends fraudulent messages impersonating a trusted party to trick recipients into revealing credentials, authorizing payments, or opening malicious attachments.

Manipulating people through deception, urgency, or authority to obtain confidential information or induce actions, exploiting human trust rather than technical vulnerabilities in systems.

Creating a fabricated scenario or false identity to persuade a target to disclose information or perform an action, commonly used in voice and business email compromise schemes.

A scheme in which attackers impersonate executives, vendors, or colleagues via compromised or spoofed email accounts to trick employees into transferring funds or changing payment details.

Malicious software that encrypts files or systems and demands payment, often in cryptocurrency, for decryption keys, sometimes coupled with threats to leak stolen data.

Software designed to disrupt, damage, or gain unauthorized access to systems, including viruses, worms, trojans, spyware, and ransomware, frequently used as a foothold for financial crime.

Unauthorized access to and control of a user's account, often achieved through stolen credentials, phishing, or session hijacking, enabling fraudulent transactions and data theft.

The acquisition of usernames, passwords, tokens, or certificates by attackers through phishing, keylogging, or data breaches, enabling impersonation and unauthorized system access.

A remote server that attackers use to issue instructions to compromised devices and receive stolen data, a key node in botnets and ransomware operations that investigators seek to identify.

A network of compromised computers or devices controlled remotely by an attacker, used to distribute malware, send spam, or launch denial-of-service attacks while concealing the operator's identity.

An attack that overwhelms a target system or network with traffic from many compromised sources, disrupting services and sometimes serving as a distraction for fraud or data theft.

Analyzing public blockchain records and clustering addresses to follow the movement of funds, identify wallets linked to criminal activity, and support attribution and asset recovery.

A business that exchanges, transfers, custodies, or administers virtual assets for customers, typically subject to anti-money-laundering registration, monitoring, and reporting obligations.

A portion of the internet accessible only through anonymizing software such as Tor, used for both legitimate privacy purposes and illicit marketplaces trading stolen data, drugs, and malware.

The documented, unbroken record of who collected, handled, transferred, and stored evidence from seizure through trial, used to demonstrate integrity and admissibility in legal proceedings.

Creating a bit-for-bit duplicate of a storage device or data source using write-blocking tools, preserving the original while providing a working copy for analysis and verification.

A fixed-length digital fingerprint computed from data by an algorithm such as SHA-256, used to verify that evidence has not been altered since acquisition.

The assurance that digital evidence is authentic, complete, and unmodified, demonstrated through hashing, documented procedures, access controls, and a verifiable chain of custody.

Information that disappears when a system is powered off or rebooted, such as running processes, network connections, and memory contents, which must be captured first during live response.

Collecting and analyzing evidence from a running system, including memory and network state, to preserve volatile data that would be lost if the device were simply seized and shut down.

A trace left by user or system activity on a device, such as log entries, registry keys, browser history, or file timestamps, that an examiner interprets to reconstruct events.

Correlating timestamps from multiple evidence sources into a chronological sequence to reconstruct when actions occurred, establish relationships between events, and test competing explanations.

Techniques used to frustrate investigation, such as file wiping, encryption, timestomping, and log deletion, which examiners must recognize and account for when assessing evidence.