How money laundering works and how you recognise it

By Mitchell Zandwijken · 4 September 2026 · Typologies, red flags

Money laundering is the concealment of the criminal origin of money or goods, so that they appear legitimate and can be spent freely. It almost always runs through three phases — placement, layering and integration — and it succeeds only where a gatekeeper somewhere in the chain does not ask the follow-up question. You are never required to prove which offence produced the funds; under Dutch law that is not your task. This article sets out the mechanism and the signals that repay attention in practice.

Need help with this? In a free thirty-minute call we look at your situation with you. Book a call or ring +31 6 11 32 53 62.

What money laundering is under Dutch law

Money laundering is the concealment of the criminal origin of money or goods so that they appear legitimate and can be spent freely. The Dutch Criminal Code makes it an offence to conceal or disguise the true nature, origin, location or rightful owner of an object that derives from any criminal offence. It also catches the simple acts of acquiring, holding, transferring or converting such an object while knowing its origin. There is no minimum amount, and the object need not be money: a car, a consignment of goods, a crypto balance or a receivable all qualify.

Two features of the Dutch construction matter for the way you work.

• Negligent money laundering is a separate, lighter offence. It catches not only deliberate laundering but handling an object you should reasonably have suspected derived from crime. For a gatekeeper this is the provision that bites: failing to ask the obvious question can itself become the reproach.
• The predicate offence does not have to be identified. The law refers to an object deriving from any criminal offence. You are never expected to establish which offence produced the funds, nor to name a perpetrator. You observe that the picture does not add up, and you pass that observation on.

Staff arriving from a suspicion-based regime often assume a report needs a theory of the crime attached. It does not. Under the Wwft the reporting threshold is an unusual transaction, not a proven one, and the analysis is the job of FIU-the-Netherlands.

The three phases, and what each one looks like

Laundering almost always moves through three phases. The boundaries are not clean and a scheme may loop back repeatedly, but the model is useful because each phase produces a different kind of signal. A set-up that only watches amounts sees placement and misses layering, which is where the recognisable patterns live.

Read the right-hand column as what lands on your desk. A deposit just below a threshold is placement. A payment that arrives and leaves within hours, to a party with no commercial relationship to the customer, is layering. A property bought partly in cash and resold at a steep gain months later is integration. One customer may generate all three in a year, which is why alerts read one at a time tell you so little.

Methods you will actually encounter

The typologies below turn up most often in Dutch practice. Each is paired with what makes it recognisable, because the method is rarely visible to you — only its footprint is.

• Cash-intensive businesses. Hospitality, car dealing, hairdressers, car washes and launderettes, where criminal cash is booked as turnover. Recognisable when turnover does not fit the location, opening hours, staff count or supplier invoices — a restaurant with the takings of a full house and the grocery bills of an empty one.
• Structuring, also called smurfing. Breaking a large amount into smaller ones that stay below a reporting threshold or an internal limit. Recognisable as a run of amounts just under a round number, often across several days, several branches or several people.
• Money mules and nominees. Accounts and companies in someone else's name, often a financially vulnerable person. Recognisable when the holder's profile is out of all proportion to the flows, when the same address or telephone number recurs across unrelated customers, or when a director has no discernible link to the company's sector.
• Trade-based money laundering. Over- or under-invoicing, duplicate invoices, or goods that do not exist. Recognisable through prices that deviate from the market, shipping documents inconsistent with the invoice, or a description too vague to price.
• Property. Purchase partly in cash or funded by a loan from a related party, then resold at a rapid and unexplained gain. Recognisable in the funding side of the file rather than the transaction itself.
• Underground banking. Value moved without money crossing a border, through intermediaries who settle among themselves. Recognisable as unexplained domestic transfers between parties with no economic relationship, often in matching amounts.

Sector-specific typologies

The Wwft makes a broad group co-responsible for guarding the gate: banks and payment service providers, but also civil-law notaries, accountants, tax advisers, lawyers, estate agents, trust offices, crypto-asset service providers and dealers accepting large cash payments. What arrives at the gate differs sharply by sector, and a generic red flag list underperforms unless it is translated into the transactions your firm actually sees.

Translating this into your own environment separates a rule set that fires on volume from one that fires on the behaviour your customers are capable of.

The signals that repay attention

Grouping signals by where they surface maps onto who sees what: a relationship manager sees the customer and the behaviour, an analyst the transaction and the counterparty, a file reviewer the documentation.

The behavioural row is left out of most formal indicator lists and is often decisive in practice. A customer who asks at what amount you have to report something has told you what they are staying underneath. Such remarks belong in the file, dated and in the customer's own words, not in a corridor conversation.

A red flag is not a conclusion

Almost every signal above has an innocent explanation. Cash-heavy takings are normal in some trades, round amounts occur, and people lose patience with onboarding questions. Treating one flag as proof produces defensive reporting and damages legitimate relationships; treating flags as nothing produces the opposite failure.

Three things separate a flag from a finding.

1. Combination. One signal is weak evidence. Several pointing the same way, across different categories, are stronger than the sum of their parts.
2. The answer you get when you ask. The most informative step available to you, and the most under-used. An absent, shifting or evasive answer weighs heavier than the original signal. A clear answer supported by documents you can check usually closes the matter.
3. Whether it fits the recorded profile. A signal is only anomalous against a baseline. If nobody wrote down what this customer said they would do, nothing can be inconsistent with it. Weak due diligence does not just fail at onboarding; it silently disables monitoring for the rest of the relationship.

Write the reasoning down either way. A file recording what you saw, what you asked, what you were told and why you were or were not satisfied is the only durable evidence that the judgement was made. An undocumented good decision looks identical to no decision.

How terrorist financing differs

Money laundering and terrorist financing sit in a single statute but are mirror images. In money laundering the origin is the problem and the money is criminal. In terrorist financing the destination is the problem, and the money may have been earned entirely lawfully, from a salary, a benefit or a donation.

The practical consequence is routinely underestimated: terrorist financing involves far smaller amounts, so a set-up calibrated on unusually large transactions will not find it. Signal lies in pattern and destination — small recurring transfers to a high-risk jurisdiction, collections that do not match the stated charitable purpose, or funds moving to a party with no plausible relationship to the customer.

What to do when you spot something

The moment you notice something you are in a process with a defined order. Follow it rather than improvising.

1. Record the observation immediately. Date, what you saw, whose words, and any transaction references. Recollection three weeks later is worth far less.
2. Ask, if the relationship allows it. A normal question about the background to a payment or the source of funds is not tipping off. Note the answer verbatim, not in summary.
3. Escalate internally. Route it to the person your procedure names, usually the compliance officer or MLRO, within the timeframe it sets. Escalation is not an accusation and does not require you to be sure.
4. Do not tip off. Never tell the customer, or anyone outside the process, that a report has been made or is being considered. The prohibition is statutory. It does not stop you asking ordinary due diligence questions; it stops you disclosing the report.
5. Report without delay if the unusual character stands. Reporting goes to FIU-the-Netherlands and the threshold is a supposition, not proof. Uncertainty is no reason to hold back, and reporting in good faith carries a statutory indemnity. See reporting an unusual transaction.
6. Decide what happens to the relationship. A report is not automatically a reason to exit, and exiting is no substitute for reporting. Record that decision and its grounds too.

One organisational point underlies all of this. Recognition fails most often not because staff cannot see the signal, but because whoever sees it has no low-friction route to escalate and hears nothing afterwards. If your front line does not know who to tell, or has learned that reports disappear without response, the best indicator list in the sector will not help you.

Frequently asked questions

What is money laundering?

Money laundering is the concealment of the criminal origin of money or goods so that they appear legitimate and can be spent freely. In legal terms it covers hiding or disguising the true nature, origin, location or rightful owner of an object that derives from a criminal offence, as well as simply acquiring, holding, transferring or converting such an object while knowing its origin. There is no minimum amount and the object does not have to be cash.

What are the three phases of money laundering?

Placement, layering and integration. Placement introduces criminal money into the financial system, for example through cash deposits or a cash-intensive business. Layering makes the origin untraceable through a series of transactions, companies or jurisdictions. Integration allows the money to re-emerge as apparently legitimate wealth, for example as property, a salary or a loan.

What are the signals of money laundering?

Among others: transactions that do not fit the customer profile you have recorded, unusual volumes of cash, a structure more complex than the business activity justifies, amounts just below a reporting threshold, rapid pass-through with no economic rationale, involvement of high-risk jurisdictions, and a customer who is noticeably reticent about the source of funds. Behavioural signals such as questions about reporting thresholds also matter.

Do I have to prove which crime the money came from?

No. Dutch law refers to an object deriving from any criminal offence, and as a reporting institution you are not expected to identify the predicate offence or the perpetrator. The reporting threshold under the Wwft is an unusual transaction, not a proven one. Analysis and the decision on whether something is suspicious belong to FIU-the-Netherlands.

Is money laundering an offence if I did not know?

Yes, in a lighter form. Alongside intentional money laundering the Dutch Criminal Code contains negligent money laundering, which catches anyone who should reasonably have suspected that an object derived from crime. For gatekeepers this is the relevant provision, because failing to ask an obvious question can itself become the reproach.

What is the difference between money laundering and terrorist financing?

The direction of the money. In money laundering the funds have a criminal origin and are being cleaned. In terrorist financing the funds may have been obtained entirely lawfully and the destination is the problem. Terrorist financing therefore often involves much smaller amounts, which makes detection based on amounts alone largely ineffective.

What should I do if I spot a possible signal?

Record the observation with a date and in the customer's own words, ask a normal due diligence question if the relationship allows it, and escalate internally to your compliance officer or MLRO. Do not tell the customer that a report has been made or is being considered, because tipping off is prohibited. If the unusual character remains after your enquiries, report the transaction to FIU-the-Netherlands without delay.

Sources

• Dutch Criminal Code (Wetboek van Strafrecht) - wetten.overheid.nl
• Anti-Money Laundering and Anti-Terrorist Financing Act (Wwft) - wetten.overheid.nl
• FIU-the-Netherlands
• Financial Action Task Force (FATF)

Read next

• Reporting an unusual transaction
• Transaction monitoring and sanctions screening
• AML/CFT training
• AML/CFT in the Netherlands: a guide
• Glossary of AML and sanctions terms

Facing this in practice? In a free thirty-minute call we look at your situation with you and say plainly whether we can help. Book a call or ring +31 6 11 32 53 62.