Table of Contents
What Money Laundering Laws Are Actually Trying to Stop
Cash is heavy, traceable and awkward. That is the entire problem for someone holding the proceeds of a crime. A bank deposit leaves a record. A property purchase leaves a record. A wire transfer leaves a record that never goes away.
Money laundering laws exist to punish the process of making dirty money look clean, and to force the institutions that move money to act as unpaid detectives. The legal definition shifts from country to country, but the shape is consistent: converting, transferring, concealing or acquiring criminal property, or helping someone else do it.
Notice what is missing from that definition. The underlying crime. Laundering is a separate offence, and in most jurisdictions you can be convicted of it even if the person who committed the fraud or the robbery is never identified, let alone charged.
The Three Stages Prosecutors Look For
Investigators describe laundering in three movements. It is a teaching model rather than a legal test, but it maps neatly onto how cases get built.
- Placement: getting cash into the financial system. Smurfed deposits just under reporting thresholds, chips bought at a casino, a restaurant’s takings inflated into a business account.
- Layering: moving it to break the audit trail. Shell companies in three jurisdictions, invoices for services nobody delivered, a loan from a company owned by the same person.
- Integration: bringing it back as apparently legitimate wealth. A property sale, a share portfolio, a business that suddenly qualifies for a mortgage.
Modern schemes skip steps. A ransomware payment converted into crypto and tumbled through a mixer never touches cash at all, so there is no placement stage in the traditional sense. The offences still apply.
The Statutes Behind the Rules
No single law governs this. Most regimes stack a criminal statute on top of a regulatory one, and the two do different jobs.
United Kingdom
The Proceeds of Crime Act 2002 carries the criminal offences. Sections 327 to 329 cover concealing, arranging and possessing criminal property, with a maximum of 14 years behind them. The Money Laundering Regulations 2017 handle the compliance side: who must register with a regulator, what checks they run, what records they keep. The Criminal Finances Act 2017 then added a corporate offence of failing to prevent the facilitation of tax evasion, which pushed liability onto firms for what their own staff do.
United States
The Bank Secrecy Act of 1970 is the foundation. It created Currency Transaction Reports for cash movements above $10,000 and Suspicious Activity Reports for anything a bank finds odd, regardless of amount. The PATRIOT Act expanded the machinery after 2001, and the Corporate Transparency Act pushed beneficial ownership disclosure onto small companies that had been invisible for decades.
Internationally
The Financial Action Task Force does not make law. It publishes 40 Recommendations and then grades countries against them, maintaining a grey list and a black list that carry real economic consequences for anyone doing business there. The EU’s anti-money-laundering directives implement much of that framework across member states, and a new central authority, AMLA, now sits in Frankfurt.
The Predicate Offence Problem
Laundering needs a source. The crimes that generate the money are called predicate offences, and the list runs long: drug trafficking, fraud, tax evasion, human trafficking, bribery, ransomware. Some countries restrict the list to serious offences. Others, including the UK, define it as “criminal conduct” broadly, which means the proceeds of almost any crime can be laundered.
This matters more than it sounds. A conviction for embezzlement at a mid-sized company can spawn a second prosecution for what happened to the money afterwards, and that second charge frequently carries the longer sentence.
What Businesses Are Legally Required to Do
Banks, solicitors, estate agents, accountants, casinos, crypto exchanges and, in several countries, art dealers are obliged entities. The duties are broadly the same everywhere.
- Customer due diligence: identifying the client, verifying documents, and working out who actually owns the company on the other side of the deal.
- Ongoing monitoring: watching transactions against the expected profile, not just at onboarding.
- Reporting: filing a suspicious activity report with the national financial intelligence unit. In the UK that goes to the NCA. In the US, to FinCEN.
- Record keeping: typically five years, and those records are the first thing investigators ask for.
- Training and a nominated officer: someone senior and personally liable for the firm’s compliance.
The technology behind all this has become an industry in itself. Automated screening, transaction monitoring rules and sanctions checks are now welded into core banking platforms, which is part of why fintech software development spends so much of its budget on compliance plumbing rather than customer-facing features.
Penalties: Personal and Corporate
Sentences vary, but the direction of travel is upward. The UK maximum is 14 years. US federal money laundering generally caps at 20. Fines are increasingly calculated against the value of the transactions rather than set at a fixed sum; Danske Bank’s Estonian branch scandal ended with penalties above €1.5 billion after roughly €200 billion in suspicious flows passed through.
Individual liability is the part professionals underestimate. A nominated officer who ignores a red flag, or a solicitor who completes a property purchase without asking where the funds came from, can be prosecuted personally. “I relied on the system” is not a defence if nobody ever used the system.
Courts also chase the assets themselves. Confiscation orders, account freezing orders and civil recovery proceedings do not always need a criminal conviction, which is how some very wealthy people lose everything without a trial ever reaching a verdict.
Where Crypto and Fintech Break the Old Model
Peer-to-peer transfers, mixers, privacy coins and offshore exchanges opened a gap that regulators have spent a decade closing. The EU’s Transfer of Funds Regulation now requires originator and beneficiary information on crypto transfers, mirroring the wire transfer rules banks have followed since the 1990s. The travel rule, as the industry calls it, is now standard across most major jurisdictions.
Enforcement is messier. Chain analysis can trace funds further than most people assume, but attribution to a real human is hard, and jurisdiction is a nightmare when an exchange is registered in one country, hosted in another and run from a third. Much of this overlaps with cybercrime laws, which handle the theft and the intrusion while laundering statutes handle the money’s journey afterwards.
The Defences That Actually Work
Lack of knowledge is not the easy escape people imagine. Most statutes require only suspicion, or circumstances that would put a reasonable person on notice. The defences that succeed tend to be procedural: an authorised disclosure made before the transaction (an “appropriate consent” request in UK practice), a genuinely reasonable belief formed on documented checks, or, in the US, an advice-of-counsel defence backed by written guidance.
Which makes the paper trail the case. Investigators reconstruct intent from what you recorded, when you recorded it, and whether you acted on it. A suspicious activity report filed at 4pm on a Friday, three months after the unusual transfers started, is evidence of the precise opposite of diligence.
