Money Laundering Stages: Placement, Layering, Integration
The 3 money laundering stages, placement, layering and integration, explained with crypto examples and the AML controls that break each stage.
The three money laundering stages are placement, layering and integration. Placement moves criminal proceeds into the financial system, layering hides where they came from through a chain of transfers, and integration returns the money to the criminal looking like legitimate income. That is how the United Nations Office on Drugs and Crime (UNODC) describes the process, and it is the model most AML training and regulation still uses.
Crypto has not changed the three stages, only the tools. This guide explains each stage with crypto examples drawn from government sources (mule networks, mixers, chain-hopping, over-the-counter cash-outs) and shows which compliance controls are designed to break each one.
What money laundering is
UNODC defines money laundering as "the processing of criminal proceeds to disguise their illegal origin", so that the criminal can enjoy the profits without exposing their source. The legal definition in Article 3.1 of the 1988 UN Vienna Convention covers converting or transferring property, knowing it comes from an offence, to conceal its illicit origin or to help someone evade the legal consequences.
The scale is hard to measure. UNODC's estimate is that 2 to 5% of global GDP is laundered each year, or USD 800 billion to 2 trillion, and it notes that the clandestine nature of laundering makes any total difficult to pin down.
In the US, laundering the proceeds of "specified unlawful activity" to conceal their nature, source or ownership, or to avoid a reporting requirement, carries up to twenty years in prison and a fine of up to USD 500,000 or twice the value involved, whichever is greater, under 18 U.S.C. 1956.
Stage 1: Placement
UNODC describes placement as "moving the funds from direct association with the crime". It is the riskiest moment for a criminal, because the money is still close to its source and has to pass through a gatekeeper such as a bank or exchange for the first time.
Crypto versions of placement include:
- Buying crypto with dirty cash or bank funds, often through accounts opened by money mules rather than by the criminal.
- Crypto ATMs and kiosks, where cash goes straight into a wallet. The FATF lists using kiosks in high-risk patterns as a red flag, while noting that a single kiosk use is not suspicious on its own.
- Splitting deposits into small amounts to stay under thresholds, known as structuring or smurfing. See our guide to smurfing and structuring.
- Proceeds that start as crypto, such as ransomware payments, hacks and darknet sales. Here there is no cash to place: the job is to get coins from a flagged address into an account that can eventually reach fiat.
A case in the FATF's Virtual Assets Red Flag Indicators report (September 2020), contributed by South Africa, shows placement and layering working together. Cash was deposited at several financial institutions, moved through company accounts in smaller electronic payments, then passed to mules' accounts at local crypto platforms. The mules bought crypto and immediately sent it to two overseas platforms. More than 150 people were involved, moving about USD 108 million (BTC 11,960). The case came to light because a local platform filed suspicious transaction reports.
What breaks placement: identity verification at onboarding, checks for duplicate accounts (shared addresses, devices and IP addresses), sanctions and PEP screening, and deposit monitoring. Placement is where KYC does most of its work.
Stage 2: Layering
Layering is "disguising the trail to foil pursuit", in UNODC's words. The goal is to put as many hops, assets and jurisdictions as possible between the money and the crime. The FATF report found that, across the cases jurisdictions submitted, the most common misuse was drug trafficking, either sold directly for crypto or using crypto "as an ML layering technique".
Common crypto layering techniques:
- Mixers. Mixers pool many users' coins and pay them out again so that inputs and outputs are hard to link. When the US Treasury's Office of Foreign Assets Control (OFAC) sanctioned Tornado Cash in August 2022, it said the mixer had been used to launder more than USD 7 billion since 2019, including over USD 455 million stolen by North Korea's Lazarus Group. Treasury removed those sanctions on 21 March 2025. In November 2023 OFAC sanctioned Sinbad.io, a Bitcoin mixer it called a key laundering tool of the Lazarus Group.
- Chain-hopping. Swapping assets across different blockchains, often through bridges, so that the trail moves to a new ledger. After the theft of about USD 1.5 billion from the exchange Bybit on or about 21 February 2025, the FBI reported that North Korean actors had converted some of the stolen assets to Bitcoin and other assets "dispersed across thousands of addresses on multiple blockchains", and asked exchanges, bridges and DeFi services to block the addresses involved.
- Peel chains and address fan-out. Moving a large balance through long chains of fresh wallets, shaving off small amounts at each step.
- Rapid swaps between assets, including privacy coins, and depositing then withdrawing from exchanges without trading. The FATF says the latter "effectively turns the exchange/VASP into an ML mixer".
What breaks layering: on-chain analytics. Public blockchains record every hop, so analytics tools can trace funds back through mixers and bridges with varying confidence and score each address's exposure to known illicit sources. Exchanges screen deposit and withdrawal addresses against those scores and against sanctioned addresses. See blockchain analytics explained.
Stage 3: Integration
Integration is "making the money available to the criminal from what seem to be legitimate sources". In crypto, it usually means converting to fiat or spending in a way that looks normal: selling through an exchange account backed by a plausible story, using an over-the-counter (OTC) broker, or buying property, vehicles and luxury goods.
OTC traders matter here because they can turn large crypto balances into cash or bank transfers off the order book. In April 2023 OFAC sanctioned two OTC traders who, according to Treasury, helped convert stolen virtual currency into fiat for North Korean actors working with the Lazarus Group. The FBI's Bybit notice made the same point about the end goal: the stolen assets were expected to be "further laundered and eventually converted to fiat currency".
What breaks integration: source-of-funds and source-of-wealth checks, which ask the customer to prove where a large balance came from, and enhanced due diligence on high-risk customers and OTC counterparties. See source of funds vs source of wealth.
The stages often overlap
The three-stage model is a teaching tool, not a law of nature. UNODC itself says real cases "may not have all three stages", that stages can be combined, and that some repeat several times. Its example: cash split into small amounts, deposited by money mules and then transferred to a shell company as payment for "services" combines placement and layering in one step.
Crypto blurs the lines further. Proceeds from a hack are already inside the system, so there is no classic placement. A single automated swap can be layering and the start of integration at once. That is why regulators ask firms to monitor behaviour across the whole relationship rather than look for a neat sequence.
How compliance controls map to each stage
| Stage | Crypto techniques | Controls that target it |
|---|---|---|
| Placement | Mule accounts, kiosk deposits, structured deposits, deposits from hacked or ransom addresses | KYC and liveness checks, duplicate-account detection, sanctions and PEP screening, deposit monitoring |
| Layering | Mixers, chain-hopping via bridges, peel chains, rapid asset swaps, deposit-and-withdraw cycling | Blockchain analytics, address screening, velocity rules in transaction monitoring |
| Integration | Fiat cash-outs, OTC brokers, purchases of property and luxury goods | Source-of-funds and source-of-wealth checks, enhanced due diligence, suspicious activity reporting |
No single control covers all three stages, which is why AML programmes layer them. Screening tools such as iDenfy's AML screening, which checks customers against sanctions lists, PEP lists and adverse media and keeps monitoring them after onboarding, sit alongside transaction monitoring and on-chain analytics. When those controls produce a suspicion the firm cannot clear, it files a report with the authorities; see our guide to the suspicious activity report (SAR).
What this means for ordinary users
Most people will never launder money, but the controls built to catch each stage reach everyone:
- Onboarding questions about your job, income and expected activity exist to make placement harder.
- Holds on incoming crypto usually mean an analytics tool linked the coins, sometimes several hops back, to a mixer, hack or sanctioned address. That is layering detection at work.
- Requests for proof of funds on a large withdrawal or a large first deposit are integration controls.
- Being asked to "receive and forward" money for someone else is the most common way ordinary people end up inside a laundering chain. See money mules in crypto.
Non-custodial DeFi apps sit outside this account-based model. JewelSwap's DeFi apps are non-custodial and do not run KYC themselves (see KYC in DeFi explained), but any regulated exchange you later move funds to will screen their on-chain history.
Frequently asked questions
What are the three stages of money laundering?
Placement, layering and integration. Placement moves criminal proceeds into the financial system, layering hides their origin through a chain of transactions, and integration returns the money to the criminal so it appears to come from a legitimate source.
What is an example of layering in crypto?
Sending stolen coins through a mixer, swapping them across several blockchains through bridges, or splitting them across thousands of fresh addresses. After the 2025 Bybit theft, the FBI reported the stolen assets had been converted and dispersed across thousands of addresses on multiple blockchains.
Does every money laundering case go through all three stages?
No. UNODC notes that real cases may skip a stage, combine stages or repeat them. Crypto proceeds from a hack, for example, start inside the system, so there is no classic cash placement.
How do exchanges detect money laundering at each stage?
Identity verification and screening target placement, blockchain analytics and transaction monitoring target layering, and source-of-funds checks and enhanced due diligence target integration. Suspicions that cannot be cleared are reported to the authorities.
Is using a crypto mixer illegal?
It depends on the jurisdiction and the mixer. In the US, OFAC sanctioned Tornado Cash in 2022 and removed it in March 2025, and sanctioned Sinbad.io in 2023. Even where use is lawful, exchanges usually treat funds that passed through a mixer as high risk.
Keep reading
- AML red flags in crypto
- Smurfing and structuring explained
- Blockchain analytics explained
- Crypto AML compliance guide for exchanges and VASPs
- Money mules in crypto
This article is educational and is not legal or financial advice. Stage definitions and estimates are from UNODC; case details are from the FATF report Virtual Assets Red Flag Indicators (September 2020), US Treasury press releases on Tornado Cash (2022, 2025) and Sinbad.io (2023), and FBI PSA250226 (February 2025). All sources were checked on 9 October 2026 and are linked inline.
