Short answer: a typology is a method criminals use to launder money; a red flag is an indicator that something may be wrong. Red flags justify further review, not automatic conclusions. The CAMS exam tests whether you can recognise both and choose the sensible next step.
This post is a revision aid. The CAMS syllabus lists Domain 1 (risks and methods of financial crime) as 30 percent of the exam, so this is a high-value topic. Practise it with the free CAMS test.
Sourcing note. The typologies below are drawn from widely published sources such as FATF typology reports and regulator guidance. They are examples, not exhaustive lists, and no single red flag proves wrongdoing.
The three stages
| Stage | What happens | Example |
|---|---|---|
| Placement | Illicit cash enters the financial system | Structuring deposits below reporting thresholds; buying chips at a casino |
| Layering | Funds are moved to obscure the trail | Rapid transfers through shell companies in several countries |
| Integration | Funds re-enter the economy as apparently legitimate | Buying real estate; "loan-back" arrangements; investing in a business |
Not every case shows all three stages, and they can overlap.
Main typologies
| Typology | How it works | Typical red flags |
|---|---|---|
| Structuring (smurfing) | Breaking cash into amounts below reporting thresholds | Repeated deposits just under the threshold, several branches, several people |
| Shell and front companies | Entities with no real operations used to move funds | No staff or premises, nominee directors, inconsistent activity |
| Trade-based money laundering | Over- or under-invoicing, phantom shipments, multiple invoicing | Prices far from market value, vague goods descriptions, unusual routing |
| Cash-intensive businesses | Mixing illicit cash with legitimate takings | Revenue out of line with the premises or the sector |
| Loan-back | Illicit funds lent to oneself through a company | Loan with no commercial purpose, early repayment in cash |
| Cuckoo smurfing | Funds paid to an innocent beneficiary to cover a remittance | Unexpected deposits from unknown third parties |
| Professional enablers | Lawyers, accountants and company formation agents who facilitate | Complex structures with no clear rationale |
| Money mules | People who move funds for others | Account receives and quickly forwards funds; young or new accounts |
| Real estate | Property bought with illicit funds, often via companies | All-cash purchases, rapid resale, purchase by third parties |
Red flags by sector
Retail and private banking
- Transactions inconsistent with the customer's profile.
- Reluctance to provide information about source of funds.
- Use of multiple accounts or addresses with no reason.
- PEPs with complex ownership of assets.
Correspondent banking
- Respondent banks in high-risk jurisdictions or with weak controls.
- Nested relationships (the respondent providing services to other banks).
- Payable-through accounts.
- Payment messages with missing or stripped originator data.
Trade finance
- Documents that do not match the goods or the shipment route.
- Use of third parties with no clear role.
- Letters of credit with unusual terms or frequent amendments.
- Dual-use goods or sanctioned destinations.
Casinos and gaming
- Buying chips with cash and cashing out with little play.
- Playing with a partner on opposite sides of a bet.
- Large deposits from unknown sources.
Money services businesses and payment providers
- Frequent small transfers to the same recipients.
- Multiple senders using the same beneficiary.
- Transfers split across agents.
Virtual assets
- Funds moved through mixers or privacy-focused coins.
- Rapid chain-hopping between assets.
- Exposure to darknet markets, ransomware or sanctioned entities.
- See crypto and VASP money laundering risk.
Terrorist financing and proliferation financing
Terrorist financing may involve small amounts, legitimate funds (salaries, donations, businesses) and the use of non-profit organisations. Proliferation financing relates to funding the development or transfer of weapons of mass destruction and often uses trade and front companies. Because the money may not be criminal in origin, transaction patterns alone are less reliable; context and screening matter.
How the exam asks about red flags
| Question style | How to answer |
|---|---|
| "Which is the MOST suspicious?" | Pick the one that is inconsistent with the customer's profile and has no business rationale |
| "What should you do FIRST?" | Review and gather information; escalate internally; do not tip off or exit before understanding |
| "Which is NOT a red flag?" | Look for the option that is consistent with the stated business |
| "Which typology does this describe?" | Match the pattern (structuring, layering through shells, trade-based) |
Five habits that avoid wrong answers
- Ask whether the activity makes commercial sense for the customer.
- Treat a single indicator as a prompt, not a conclusion.
- Check for combinations of indicators.
- Remember that tipping off is prohibited.
- Remember that an STR/SAR is based on suspicion, not proof.