Anti-Money Laundering and Counter-Terrorist Financing Fundamentals
The core concepts
Money laundering is the process of disguising the origin of criminal proceeds so they appear legitimate. The classic three-stage model - placement, layering, integration - is the backbone of this domain. Placement introduces illicit cash into the financial system (deposits, structuring, casino chips); layering obscures the audit trail through transfers, conversions, and shell entities; integration returns the funds to the launderer as apparently clean assets (property, investments, business revenue).
Terrorist financing differs in important ways: the funds may be small, may originate from legitimate sources, and the objective is to fund violence rather than to conceal profit. Questions often test whether you can distinguish the two - a large structured cash deposit is a classic laundering typology, while a series of small, hard-to-trace remittances to a conflict zone is more characteristic of terrorist financing.
Know the predicate offences concept: money laundering requires an underlying crime. Know the difference between money laundering (concealing proceeds) and predicate offence (the crime that generated them). Know structuring/smurfing (splitting transactions to evade reporting thresholds) and trade-based laundering (over/under-invoicing, misdescribed goods).
Traps and rule of thumb
A frequent trap is the claim that laundering always involves cash or that all three stages must occur - layering and integration can happen without a distinct placement stage, particularly in electronic transfers. Another trap conflates intent: terrorist financing does not require the funds to be criminal in origin.
Rule of thumb: ask where did the money come from, where is it going, and does the pattern make economic sense? If any answer is unsatisfying, that is your red flag.
Worked example: A customer deposits EUR 9,000 in cash daily for six days, just under a EUR 10,000 threshold. This is structuring - a placement typology designed to evade reporting - and should trigger a suspicious activity report regardless of whether the total exceeds the threshold.