In 2014, the Organized Crime and Corruption Reporting Project (OCCRP) and its partners exposed what became known as the Russian Laundromat. Around $20 billion had been moved out of Russia between 2010 and 2014. The scheme used fake loans between shell companies, rulings from Moldovan judges ordering those “debts” to be repaid, and a bank in Latvia to push the money into the European financial system.
No single transaction told the story. A single payment between two companies looked unremarkable. It was only when investigators connected the companies, the guarantors, the court cases and the bank accounts that the shape of the network appeared.
That’s the core challenge of modern money laundering detection. Laundering at scale isn’t done by one person moving one payment. It’s done by networks, and a money laundering investigation has to uncover the network, not just the transaction.
What a laundering network looks like
Most large laundering operations have the same basic parts, even if they look very different on the surface:
- The source: criminals, corrupt officials or fraudsters who need to make proceeds look legitimate
- Controllers and organizers: the people who design and run the scheme, and who are rarely named on any document
- Professional enablers: company formation agents, accountants, lawyers or bankers who knowingly or carelessly provide the structures
- Shell and front companies: entities that hold accounts, sign contracts and issue invoices
- Nominees: people paid to act as directors or shareholders on paper
- Money mules: individuals whose accounts are used to receive and pass on funds, sometimes knowingly and sometimes not
- Exit points: property, businesses, luxury goods, investment accounts or crypto, where laundered value comes to rest
The network is designed so that each part only sees a small piece. Breaking it open means putting those pieces back together.
How a money laundering investigation uncovers the network
1. Start from an anchor
Every investigation begins somewhere concrete: a suspicious account, a company, a person, a crypto wallet, or a cluster of transactions flagged by monitoring. That anchor is the first node in the network.
2. Expand through shared identifiers
Laundering networks reuse infrastructure because setting it up is expensive. Investigators look for shared details across companies and accounts:
- The same directors, nominees or company secretaries
- The same registered address or formation agent
- Shared phone numbers, email domains and IP addresses
- Common bank accounts, guarantors or signatories
- Linked crypto wallets and exchange accounts
Each shared identifier can reveal new companies and people connected to the scheme.
3. Follow the flow of funds
A financial investigation reconstructs how money moved between the entities identified. Patterns start to emerge: round-number transfers, funds passing straight through accounts within hours, circular payments that return to where they started, and repeated “loans” or “consultancy fees” between related parties.
4. Build the network map
Link analysis brings people, companies, accounts and transactions into a single picture. Clusters show which entities work together. Hubs show which accounts or people sit at the center. Gaps show where more evidence is needed. This visual map is often what turns a pile of suspicious activity into a clear explanation of the scheme.
5. Find the controllers
Nominees and mules are the visible face of a network. The real targets are the people who control it and benefit from it. Investigators look for the links that nominees can’t hide: who pays them, who gives them instructions, who has access to the accounts, and who ultimately receives the money.
6. Identify where the value lands
The final step is locating the assets that the network was built to protect. Property, businesses and investment holdings are usually held through further layers of ownership, so the same techniques apply again until the end beneficiary is reached.
Red flags that point to a network, not a one-off
Financial crime investigations often escalate when individual alerts start to look connected. Signs include:
- Several unrelated customers using the same address, agent or contact details
- New companies with little history moving large sums soon after opening accounts
- Funds that pass through accounts with no obvious business purpose
- Many small deposits from different people followed by a single large outflow
- Trade or loan payments that don’t match the stated business of either party
- Directors who appear on an unusually large number of companies
- Counterparties based in jurisdictions with no apparent link to the business
Why network investigations need specialists
Network investigations are slow and difficult if they’re done one alert at a time. They need people who can work across corporate registries in many countries, analyze large volumes of transaction data, trace crypto, interpret local records and media, and present complex findings in a way that boards, regulators and courts can follow.
Money laundering investigation services bring those skills together. They also bring independence, which matters when findings may lead to account exits, regulatory reports, litigation or criminal referrals.
How CAT Investigators can help
CAT Investigators provides money laundering investigation services and wider financial crime investigations for banks, fintechs, crypto businesses, corporates and law firms. From New York, London and Hong Kong, our investigators map the people, companies and accounts behind suspicious activity, trace funds and crypto across jurisdictions, identify the beneficial owners behind nominee structures, and locate the assets at the end of the chain.
One suspicious transaction is often the visible edge of something much larger. We help you see the whole network.
Speak to our money laundering investigators
This article is for general information and does not constitute legal advice.