Transaction laundering is pushing hidden, banned, or illegal sales through a legitimate merchant account so the payments look like they come from a compliant business. It defeats underwriting and monitoring by hiding high-risk activity in plain sight behind a clean payment descriptor.
What is transaction laundering, in plain English?
Transaction laundering, also called undisclosed aggregation or factoring, happens when a merchant runs someone else's payments through its own approved account. The acquirer thinks it underwrote a coffee shop or a clothing store, but the card volume flowing through is really coming from an unrelated and often illegal business: an unlicensed gambling site, a counterfeit-goods shop, an adult site, or an outright scam.
The clean merchant account acts as a front. Buyers on the hidden site are quietly routed to the legitimate business's payment page, or their charges are simply batched in with the real ones. On the statement the customer, and the bank, see an innocuous descriptor that has nothing to do with what was actually bought.
This sits at the crossroads of fraud and anti-money-laundering. It defeats onboarding and monitoring because the risky activity never appears under its own name, and it moves proceeds of prohibited or criminal commerce through the regulated payment system as if they were ordinary retail sales.
How a laundering front is set up
The setup is deliberately mundane, which is the point:
- Front — Get a clean merchant account. A legitimate-looking business is onboarded and underwritten by an acquirer for an ordinary product line.
- Route — Point hidden sales at it. Payments from an undisclosed illegal or banned site are funneled through the approved account's processing.
- Disguise — Show a clean descriptor. Charges settle under the front's harmless name, so statements and monitoring see nothing unusual.
- Extract — Pull out the proceeds. Settled funds are withdrawn or moved on, having entered the banking system looking fully legitimate.
Who is involved?
Who | Their role |
The front merchant | Holds the approved account and lends its clean identity to the hidden traffic, sometimes knowingly, sometimes paid to look away. |
The hidden business | The illegal, banned, or high-risk site whose sales are disguised so it can accept cards it could never get approved for. |
The acquirer | Underwrote and monitors the front, and carries the regulatory and financial exposure when the scheme surfaces. |
The card networks | Set the rules against undisclosed aggregation and run programs that hunt for laundering merchants. |
What it looks like in practice
In practice
A small online homeware shop is approved for card processing, projecting maybe a few thousand dollars a month. Within weeks its volume is many times that, the average ticket keeps landing on suspiciously round numbers, and a big share of transactions come from countries the shop claims not to ship to.
A closer look shows the checkout page quietly redirects some buyers from an unlicensed gambling site. The homeware descriptor is a mask. The acquirer's monitoring flags the volume-to-profile mismatch, freezes settlement, and files a suspicious activity report while investigating who set up the redirect.
Why it matters to operators
Transaction laundering is dangerous precisely because it slips past your best controls. Underwriting cannot flag a risk it never sees, and transaction monitoring built around a merchant's stated profile is blind to activity dressed up to match that profile. The hidden business gets card acceptance it would otherwise be denied, and criminal proceeds enter the system with a clean paper trail.
For the acquirer the exposure is real: network fines, forced offboarding, chargeback liability, and AML scrutiny. That is why detection leans on mismatch signals, comparing what a merchant said it does against what its payment data actually shows, rather than trusting the descriptor.
What to watch in the data
- Descriptor mismatch. The product implied by the descriptor does not match the goods, refund patterns, or customer behavior in the data.
- Profile blow-out. Volume, ticket size, or geography far exceeds what the business was underwritten to do.
- Unnatural traffic. Buyers that do not look like real customers: odd timing clusters, repeat cards, and heavy foreign origination for a local shop.
- Round-number tickets. Repeated clean amounts that fit a gambling deposit or subscription tier more than genuine retail.
- Shared infrastructure. The same site, IPs, or payment page linking a clean merchant to an undisclosed high-risk one.
Quick questions
How is transaction laundering different from money laundering?
Money laundering is the broad process of disguising illicit funds. Transaction laundering is a specific technique that uses a legitimate merchant account to disguise the sales themselves, so prohibited commerce is processed as ordinary card revenue. It is one channel through which laundering happens.
Why is it called factoring or aggregation?
Factoring refers to processing another party's transactions through your own merchant account, which card rules prohibit. Undisclosed aggregation means bundling unrelated merchants' sales under one approved account without telling the acquirer, the same violation from a slightly different angle.
Is the front merchant always in on it?
Not always. Some fronts are complicit and paid, but others are compromised sites, lax operators, or businesses that took on a partner without realizing what was being routed through them. Intent has to be established during investigation.
What kinds of business hide behind it?
Common ones include unlicensed gambling, counterfeit and illegal goods, unregulated adult content, and scam operations, essentially anything that cannot pass normal underwriting or is banned by the card networks.
How do teams actually catch it?
By comparing the merchant's stated profile against real transaction behavior, screening website content and checkout flows, and using network programs that scan for laundering. The tell is almost always a gap between what the merchant claims to sell and what the data shows.
What happens when it is confirmed?
The acquirer typically freezes settlement, offboards the merchant, and files a suspicious activity report. The front and the hidden business may face fines, chargeback liability, and referral to law enforcement.
Go deeper
- EMVCo ↗ — Maintains the EMV chip and 3-D Secure specifications for card payments.
- PCI Security Standards Council ↗ — Security standards for handling cardholder data, including PCI DSS.