Network layering detection
Graph analysis linking accounts through shared counterparties and rapid pass-through transfers to expose layering chains and money mule networks.
Supporting approachTechnique: Graph Analysis
Network layering detection changes the unit of review from the single transaction to the chain of accounts behind it, which is how a layering scheme or a money mule network becomes visible when each individual transfer looks unremarkable on its own.
It supports triage scoring rather than replacing it: an account that scores as low risk individually can still sit inside a high-value layering chain once it is linked, through shared counterparties or beneficial ownership, to accounts already implicated in a confirmed case.
The technique lives or dies on entity resolution, since account and counterparty identifiers arrive inconsistently across correspondent banking messages, a beneficiary name gets formatted differently across SWIFT and domestic ACH rails, and a shared address links a legitimate family account to an unrelated one.
It is the wrong tool for a single, isolated suspicious transaction with no connected accounts, where building and maintaining a graph adds cost without adding a lead.
Use it specifically when the concern is coordination: rapid pass-through transfers designed to separate funds from their source, mule networks recruited to receive and forward deposits, or trade-based laundering schemes touching multiple related accounts.
Strengths for this problem
- Surfaces coordinated activity, such as funds moving through a chain of pass-through accounts within hours, that no single-transaction alert would catch.
- Gives an investigator a concrete lead, the chain of accounts and transfers, rather than an abstract risk number.
- Gets more valuable as more accounts are connected, since a mule network that looks like isolated noise across separate business lines becomes obvious once retail, correspondent, and commercial accounts are linked by shared counterparties.
Limitations for this problem
- Depends entirely on entity resolution across account numbers, beneficial owners, and counterparty names; a missed match hides a layering chain and a false match wastes an investigation.
- Heavier to build and maintain than scoring transactions independently, since it requires a linked transaction graph, not just an account-level feature table.
- A shared counterparty is frequently innocent, such as a large payroll processor or utility that legitimately transacts with thousands of unrelated accounts, so raw connection count is a weak signal on its own.
Data needed
- Resolved identifiers linking accounts through wire, ACH, and internal transfer counterparties, including beneficial ownership where available.
- Transaction timing and amount detail across the chain, to distinguish rapid pass-through layering from ordinary, unrelated payment flows.
- Correspondent banking relationship data, since layering frequently routes through cross-border corridors with weaker visibility.
How it is measured
- Confirmed chain length and total value moved once a suspected layering pattern is investigated.
- Precision of flagged networks, meaning the share of a flagged chain's accounts an investigator confirms as connected activity rather than coincidental overlap.
- Entity resolution accuracy, measured against a manually confirmed sample of account and counterparty matches.
Pitfalls
- Flagging every account connected to a high-volume, legitimate counterparty such as a payroll processor as suspicious, which buries real layering chains in noise.
- Acting on a flagged network before entity resolution is validated, so a misspelled beneficiary name creates a phantom link between two unrelated accounts.
- Treating network membership as a decision rather than a lead, which risks an investigator anchoring on the chain instead of evaluating each account in it on its own facts.
Human oversight
A specialist investigator reviews a flagged network, confirms the linked accounts are genuinely connected, and only then opens or expands a case. No coordinated action, such as restricting every account in a flagged chain, happens without that confirmation and compliance officer sign-off.