Funds flow analysis traces money as it moves across accounts, banks, and people to reconstruct where it came from, how it was layered to hide the trail, and where it ended up. It is the core technique behind investigating layering, mule networks, and any scheme that turns dirty money into clean-looking assets.
What is funds flow analysis, in plain English?
Money launderers do not leave the trail intact. They break funds up, bounce them between accounts, and mix them with legitimate flows so the origin and destination blur. Funds flow analysis is the discipline of following the money anyway: reconstructing the chain of transactions to answer where the money started, how it was moved, and where it finally landed.
An analyst builds this picture by combining internal records with counterparty data, sometimes gathered through 314(b) information sharing with other institutions. The output is a reconstructed path that shows the source, the layering steps in the middle, and the ultimate use or beneficiary. That path is what turns a vague suspicion into a described sequence of events.
It feeds directly into the how and why of a SAR narrative. When a filing has to explain what happened, funds flow analysis is what supplies the amounts, dates, accounts, and movement that make the story concrete rather than boilerplate.
How a funds trace is built
- Source — Establish where money entered. The analyst identifies the funds coming in and, where possible, their legitimate or illicit origin.
- Trace — Follow each hop. Transfers are mapped account by account, capturing the layering steps designed to obscure the trail.
- Bridge — Reach across institutions. Where funds leave the bank's view, counterparty and 314(b) data help extend the trail beyond internal records.
- Land — Identify the destination. The endpoint is pinned down: an asset purchase, a cash-out, or a final beneficiary account.
- Explain — Feed the narrative. The reconstructed path supplies the concrete detail for a SAR or an investigation file.
What it looks like in practice
In practice
An investigator starts with a single alert: a personal account received 40,000 dollars from an unfamiliar business, then emptied within days. Tracing the outflow, she sees the money split into five transfers to five different accounts, each just under a reporting threshold, then reconverge two hops later into one account that bought a used car.
Three of the intermediate accounts sit at another bank. Using 314(b), she confirms those hops and learns the same pattern touched several unrelated customers. What looked like one odd transfer becomes a documented layering chain feeding a mule structure, and the reconstructed flow becomes the backbone of the SAR narrative.
Why it matters to operators
Funds flow analysis is where a program actually sees laundering happen. Layering, mule networks, and asset-conversion schemes are invisible at the level of a single transaction and only reveal themselves as a chain. Reconstructing that chain is what lets an investigator describe the scheme instead of just flagging one strange payment, and it is what makes a SAR usable to law enforcement.
Two pitfalls define the craft. The first is losing the trail when funds cross into another institution the analyst cannot see; this is why counterparty data and 314(b) sharing matter so much. The second is mistaking normal business for layering: complex, high-volume flows are routine for many legitimate businesses, so the analyst has to establish purpose before calling a pattern suspicious, or risk building a case on ordinary commerce.
Operator notes
- Mind the institutional boundary. The trail often goes dark when money leaves your bank; counterparty data and 314(b) are how you keep following it.
- Establish purpose first. Complex flows can be perfectly legitimate; confirm intent before labeling movement as layering.
- Watch for rapid split-and-recombine. Funds fanning out under thresholds and reconverging later is a classic layering signature.
- Capture amounts and dates. The value of the trace is its specificity; vague reconstruction makes a weak narrative.
- Link to the network. A single trace often exposes shared counterparties that widen the case into a mule or ring investigation.
Quick questions
How is funds flow analysis different from link analysis?
Funds flow analysis follows the money along a path, hop by hop, to show source, movement, and destination. Link analysis maps relationships among parties and accounts. They complement each other: the flow shows how money moved, the links show who is connected.
What happens when the trail leaves your institution?
Your visibility ends at your own records. Counterparty information, and voluntary 314(b) sharing with other institutions, are the main ways to extend the trace across a boundary you otherwise cannot see past.
How do you avoid mistaking normal business for layering?
By establishing the purpose of the flows first. Many legitimate businesses move money in complex, high-volume ways. Suspicion should rest on activity that lacks a plausible business rationale, not just on complexity.
Why does it matter for the SAR narrative?
A strong narrative has to explain how and why activity is suspicious, with specific amounts, dates, and accounts. Funds flow analysis produces exactly that detail, turning a vague filing into a usable lead.
What typologies rely most on this technique?
Layering, mule networks, self-laundering, and schemes that convert cash into assets all hinge on movement across accounts. Funds flow analysis is the primary way to reconstruct and document them.
Go deeper
- FinCEN ↗ — The US financial intelligence unit. Bank Secrecy Act rules, advisories, and SAR and CTR guidance.
- FFIEC BSA/AML Examination Manual ↗ — The manual US examiners use to assess BSA and AML programs.