Money laundering risks and threats

Artificial intelligence (AI) and deepfakes

The National Crime Agency (NCA) has identified generative AI as “highly likely the most significant threat to the fraud landscape”.

Through large language models (LLMs), voice cloning and deepfakes, generative AI has made sophisticated tools more easy for fraud offenders to obtain and misuse.

AI continues to fuel the expansion of deepfake technology and use, transforming the cybersecurity landscape.

A deepfake is a video or sound recording that replaces a person’s face and/or voice with that of someone or something else, in a way that appears real.

Deepfake tools allows manipulated audio, imagery or text to flourish. This can lead to data leakage, financial losses, regulatory risks and reputational damage.

The use of malicious deepfake technology is highly likely to present a long-term fraud risk.

This could result in organisations and customers being increasingly exposed to multiple fraud and insider risks.

The rising market for “deepfakes as a service” highlights that criminals are taking advantage and monetising this technology.

There are reports that customers are asked on impersonation calls to repeat specific phrases. These requests could be linked to deepfake schemes that use audio samples for account takeover fraud.

As technology develops, it is likely that smaller voice samples may be sufficient to ‘train’ AI models for real-time impersonations.

The NCA has identified generative AI as “highly likely” to enhance the threat from investment fraud, romance fraud, impersonation-enabled fraud and phishing attacks.

It notes that as all cyber-enabled frauds involve the use of text, images, audio or video, generative AI is “more likely to augment existing high-harm frauds than create entirely new ones”.

Learn more about generative AI

Cash-based money laundering

It is highly likely that some organised crime groups are changing their cash-based money laundering methods in response to law enforcement activity.

It is a realistic possibility that some groups are moving away from using car washes and nail bars towards nighttime economy businesses.

Chinese underground banking (daigou)

The demand for money laundering services from Chinese underground banking networks is highly likely increasing.

This is likely exacerbated by tightening Chinese Communist Party capital flight controls and economic uncertainty in China.

In August 2023, China experienced capital outflows of £38.5 billion – the largest monthly outflow since December 2016.

One international network laundered more than £55 million through underground banking between February 2020 and June 2023.

In the UK, Chinese organised crime groups launder money using a range of methods.

Informal value transfer systems (IVTS) do not use the normal banking system and/or do not comply with national currency controls.

In IVTS, value (rather than monies) is what moves, so the monies entering the system are not the same funds used to settle the inward remittance.

It is key that you understand and are satisfied with the source of the UK funds used in the inward remittance.

Clients receiving money from individuals or businesses that you cannot verify can be a risk indicator of money laundering.

It could also be a sign that money is being sent using unofficial sources.

Intelligence indicates Chinese underground banking groups are continuing to find new ways for UK-based Chinese students to launder cash.

Learn more about Chinese underground banking

Conveyancing fraud

Criminals actively target property purchases, with the aim of tricking clients into transferring property deposits and/or the balance of purchase monies to them.

Fraudsters have successfully stolen large sums of money from homebuyers.

These schemes can be highly sophisticated, and almost always involve impersonation of conveyancers to convince clients to send payments to a criminal-controlled account.

Payment diversion fraud is where criminals target a specific individual and impersonate others to divert payments to criminal-controlled bank accounts.

Techniques used by criminals include:

• hacking into email chains
• creating a fake seller's identity
• stealing a seller's identity
• setting up a bogus law firm
• email spoofing (creating email messages with a forged sender address)
• phishing or vishing (attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity)

Conveyancing fraud affects everyone, though small and medium-sized businesses are particularly vulnerable.

Make sure team members in finance, payroll and other departments that make payments are aware of the risk.

When year-end approaches, increased payments and workload make businesses more vulnerable.

To learn what preventative steps you and your clients can take, read our joint guidance on conveyancing fraud and payment diversion fraud.

Corporate structures

Circular ownership structures can be used to mask the true beneficial ownership of a company.

It can be difficult to identify the ultimate beneficial owner when multiple entities part-own each other in a circular fashion.

A beneficial owner is not just an individual who directly or indirectly owns more than 25% of the shares or voting rights. It also includes any individual who:

• controls the entity
• has ultimate control over the management of the company

You cannot solely rely on the persons with significant control or Companies House registers to identify a beneficial owner.

Circular ownership can create the appearance of lower ownership percentages that do not trigger regulatory thresholds for beneficial ownership disclosure or enhanced due diligence.

However, the circular structure can result in a higher level of control or ownership than what is visible on paper.

Circular ownership structures can also be used to facilitate fraudulent transactions, such as false invoicing, by obscuring the true parties involved.

The complexity makes it harder to follow the money trail and identify suspicious activity.

Potential indicators of corporate structure misuse highlighted by the National Crime Agency include:

• multiple companies being registered at the same residential address
• creation of large numbers of dormant companies

Cryptocurrency

Despite a drop in value received by known illicit cryptocurrency addresses in 2023, the overall scale of money laundering using cryptocurrency is unlikely to have fallen.

Opportunities to pay for goods and services with cryptocurrency appear to be increasing.

A high-end London estate agent has partnered with an overseas cryptocurrency exchange for customers to pay tenancy fees.

There are also reports Russian criminals have been using cryptocurrency to help UK drug gangs launder money.

This involves converting dirty cash into untraceable cryptocurrency, which is then used to reinvest in criminal activities.

Cryptocurrency laundering has been linked to complex money laundering networks that launder money across multiple countries, involving both street-level cash and cryptocurrency.

Overall, the use of cryptocurrency in the legal sector remains low.

The challenge is around obligations in identifying source of funds and source of wealth in relation to client funds. For example, conveyancing and corporate services.

Solicitors are obliged to carry out the same level of customer due diligence whether funds originate from traditional financial institutions or cryptocurrency.

Risk indicators to look out for include:

• unusual transactions – large, unexplained transactions involving cryptocurrency, especially if linked to known high-risk jurisdictions like Russia
• clients who are unusually secretive or reluctant to provide information about the source of funds
• high-risk clients with connections to industries or regions known for high levels of corruption or criminal activity
• use of complex corporate structures, multiple intermediaries or shell companies without a clear business rationale
• high volumes of cash transactions, especially in businesses that typically do not handle large amounts of cash

It is common for cryptocurrency funds to be converted to traditional bank currency before engaging solicitors' services.

However, this does not negate solicitors from making sure they are satisfied on the origins of the funds and potential money laundering.

International bribery and corruption

The NCA has indicated sectors “highly likely to be most at risk” from international bribery and corruption:

• energy
• extraction
• construction
• metals
• defence
• transport
• finance

Layering and placement of assets through offshore corporate entities and trusts is the “main method” for laundering the proceeds of corruption.

Money mules

Money muling involves criminals employing others to move the proceeds of crime on their behalf. It can take many different forms.

The most common form is a criminal offering cash in exchange for the use of a person’s bank account. The funds are moved through a complex network of mule accounts.

Some money mules may be willingly complicit in money laundering. Others may be vulnerable people who have been exploited.

Children as young as 11 have been recruited to move funds. Around 23% of money mules are under the age of 21 and 65% are under 30.

Estimates suggest 37,000 bank accounts in the UK showed mule behaviour in 2023, equating to £10 billion laundered a year.

Read the UK government’s money mule and financial exploitation action plan.

Nominee arrangements

A nominee arrangement is when a person or entity (the nominee) is appointed to act on behalf of another person or entity, with the purpose of concealing that person’s identity.

The nominee acts as a ‘front’ while the true owner or controller stays anonymous.

These arrangements can be formal (with a written agreement) or informal (unwritten).

While nominee arrangements can serve legitimate purposes, they are also prone to abuse. Examples of illegal purposes include:

• hiding true ownership for money laundering purposes
• tax evasion
• evading legal liability
• sanctions evasion
• fraud and corruption

It can be challenging to differentiate between a legitimate nominee arrangement and an illegal one.

To mitigate these risks, it is critical to dig deeper into beneficial ownership, making sure you know who is really in control and that your anti-money laundering (AML) processes address potential misuse.

Organised immigration crime

There is a realistic possibility that organised crime groups are targeting firms to launder the funds of modern slavery, human trafficking and other organised immigration crime.

Known criminal activities include:

• false or otherwise inappropriate national referral mechanism claims
• fraudulent leave to remain applications
• false medico-legal reports
• abuse of Tier 1 and Tier 2 routes
• abuse of section 45 of the Modern Slavery Act 2015

Risk indicators include:

• duplicate medical reports for clients
• false contact details
• being asked to act beyond the scope of your remit or without relevant qualifications

Pension liberation (early pension release) fraud

A rising trend in pension fraud is individuals being targeted by websites online.

These scams often prey on vulnerable people who may require the financial help of early pension release.

Risk indicators include malicious websites:

• promoting early pension release (or pension liberation)
• offering loans against an individual’s pension
• offering pension consolidation, mis-sold pensions and pension scam assessments – where data harvesting often leads to secondary victimisation

Threat actors are using Google ad services to maximise impact.

Often, victims are contacted by ‘lead generators’ who operate across multiple websites to contact prospective victims, whose details are distributed to wider criminal networks.

The scale of pension scams enabled by social media is a growing concern.

Postal interception

Customers have their bank account taken over by organised crime groups that obtain account details by intercepting post.

The same mobile phone number has been used in several instances of account takeover and calls are made by the same individual.

The organised crime group also appears to use the same email address format when taking over an account: title forename surname @gmail.com.

An example email address is mrjohndoe@gmail.com.

Professional enablers

A professional enabler is an individual or organisation that is providing professional services that enable criminality.

Professional enablers continue to be used to conceal and move criminal assets.

They can work in various sectors, but have mainly been associated with:

• banking
• payment service providers
• accountancy services
• estate agents
• legal services
• wealth management
• trust and company service providers

Learn more about professional enablers

Proliferation financing

Proliferation financing risks are constantly evolving.

It is broadly defined in regulation 16A(9) of the Money Laundering Regulations 2017 as:

“the act of providing funds or financial services for use, in whole or in part, in the manufacture, acquisition, development, export, trans-shipment, brokering, transport, transfer, stockpiling of, or otherwise in connection with the possession or use of, chemical, biological, radiological or nuclear weapons, including the provision of funds or financial services in connection with the means of delivery of such weapons and other CBRN-related goods and technology, in contravention of a relevant financial sanctions obligation.”

Under the regulations, regulated entities must carry out proliferation financing risk assessments.

You need to factor into your risk assessment processes that proliferation financing risks are connected to more countries than just North Korea and Iran.

As global concerns on the proliferation of weapons of mass destruction evolve, it is vital to broaden the risk assessment process to make sure your firm is not caught out.

Learn more about proliferation financing

Sanctions evasion

According to the National Crime Agency, the scale of sanctions against Russia and complexity of economic links to the UK mean Putin-linked individuals pose the greatest risk for sanctions evasion.

Most methods used to evade financial asset freezes are:

• non-complex – such as a simple transfer of assets, or
• anticipatory – transferring assets to trusted proxies (such as relatives or employees) before designation

Sham litigation

Sham litigation involves criminals or their associates instructing lawyers to act in fake legal disputes to add an air of legitimacy to the source of criminal funds.

The claimant and defendant are likely linked and rely on their connection being missed in customer due diligence.

There are two main forms of sham litigation:

• using a client account to add a layer of transaction to disguise dirty money
• using a court to give an alibi for the movement of money from one person to another

In the first example, a client instructs a solicitor to recover a debt and pays a sum on account.

Early in the transaction – often after the first letter to the debtor – the debtor remits the amount due to the client account.

The money is passed on to the client, often with a refund of the monies on account.

In the second example, the client’s case goes quite far – if not all the way to final hearing – and a court orders the movement of money from one person to another.

Read the SRA's guidance on sham litigation

Smurfing

Smurfing is where a large sum of dirty cash is split into numerous, much smaller accounts.

Each sum is given to a different low-level financial criminal (or ‘smurf’) and deposited into separate bank accounts.

These sums are then often consolidated into fewer, higher value accounts, which follow separate money laundering journeys.

Smurfing can be as simple as depositing cash at a high street bank through to international money mules moving sums of cash across borders to deposit in foreign banking systems.

Identification of potential smurfing around source of funds would be a potential risk indicator, indicating a need for greater due diligence.

Structuring

Structuring is where a larger sum of dirty cash is split into smaller sums and deposited into the banking system by an individual.

The deposits are kept under the threshold of suspicion, but the individual may not try to hide the source of funds or send the cash through the other stages of money laundering.

This is a popular method of money laundering by individuals trying to engage in tax avoidance.

It’s similar to smurfing, which is carried out by a wide criminal network, rather than a single individual.

Identification of potential structuring around source of funds would be a potential risk indicator, indicating a need for greater due diligence.

Trade-based money laundering

Trade-based money laundering uses the trading of seemingly innocent goods such as flowers, used cars, precious metals, electronics or textiles to launder money.

Sectors at higher risk include:

• minerals and precious metals
• vehicle and car parts
• food and agricultural products
• textiles and clothing
• potable electronics

Risk indicators include:

• a firm in one line of business (such as cars) trades in something else (fridges)
• importer transfer payment exceeding the value of what they’re importing
• an exporter receives payments inconsistent with the value of its registered exports
• an unrelated third party pays on behalf of a buyer and/or payment appears circular

HMRC’s trade-based money laundering handbook has more information on common techniques and examples.