The Silent Drain: Detecting A Slow-Burn Money Laundering Network
How RemitSo's continuous transaction monitoring uncovered a 90-day layering scheme that manual reviews would have missed entirely.
- Linked accounts identified
- 23
- Laundered funds intercepted
- £187K
- Monitoring window
- 90 days
- Transactions analysed
- 340+
Nothing looked wrong. Until it did.
A UK-based FCA-registered payment institution deployed RemitSo's white-label platform to serve diaspora communities across 25+ corridors. Over 90 days, continuous transaction monitoring tracked subtle, evolving patterns across 23 seemingly unrelated accounts, gradually building a risk profile that revealed a layering operation routing £187,000 through the UAE to Nigeria-based shell entities.
When nothing looks wrong.
Transactions that individually appeared entirely legitimate. Every customer had passed eKYC, every transaction had a plausible purpose, and no single amount triggered reporting thresholds.
Individual transactions ranged between £200 and £800, well below the £1,000 threshold that typically triggers enhanced scrutiny.
Transactions were spaced 5 to 12 days apart per account, mimicking genuine family remittance patterns.
Senders included healthcare workers, students and small business owners, a natural mix for diaspora remittances.
Transactions appeared to target different countries before converging on common intermediary accounts in the UAE.
Four phases over 13 weeks.
The Risk Rule Engine's 55+ automated factors accumulated micro-indicators, from baseline profiling to critical escalation.
| Timeline | Accounts flagged | Risk score |
|---|---|---|
| Weeks 1–2 | 0 of 23 | 18/100 · Low |
| Weeks 3–5 | 8 of 23 | 42/100 · Medium |
| Weeks 6–9 | 19 of 23 | 67/100 · High |
| Weeks 10–13 | 23 of 23 | 91/100 · Critical |
- Weeks 1–2 · Baseline profiling
Behavioural baselines built. All 23 accounts showed normal activity: small, periodic transfers to Nigeria, Ghana and the UAE. Risk scores 10–25. No alerts.
- Weeks 3–5 · Pattern divergence
8 accounts began routing to a common UAE intermediary. Average values rose from £280 to £620. Intervals shortened across 11 accounts. 6 accounts changed their declared purpose without profile updates.
- Weeks 6–9 · Network mapping
All 23 accounts surfaced as one connected cluster, routing through 3 UAE intermediaries into 7 Nigerian beneficiaries. One beneficiary was a partial OFAC SDN match. 5 senders had KYC documents with sequential serial numbers. 14 accounts used just 4 devices.
- Weeks 10–13 · Escalation
All 23 accounts breached the critical threshold. The system suspended them, froze £12,400 in pending transactions and escalated everything to the compliance officer with a complete evidence package.
Unmasking the network.
| Stage | Details | Volume |
|---|---|---|
| Placement | 23 UK senders, individual small transfers | £187,340 |
| Layering | Consolidated into 3 UAE intermediary accounts | £182,100 |
| Integration | Disbursed to 7 Nigerian shell company accounts | £176,800 |
- 23 sender accounts suspended and moved to a "Blocked: AML investigation" customer segment.
- 3 UAE intermediary accounts permanently blacklisted across the platform.
- £12,400 frozen in pending transactions; £174,940 in completed transactions flagged for tracing.
- High-risk country rules updated to apply enhanced monitoring to all UAE–Nigeria corridor transfers.
| Authority | Action taken |
|---|---|
| UK National Crime Agency | Suspicious activity reports filed for all 23 accounts with full histories, device fingerprints and the behavioural timeline |
| FCA supervisor | Proactive notification showing the effectiveness of automated monitoring controls |
| UAE Financial Intelligence Unit | Intermediary account details shared for downstream investigation |
| NFIU Nigeria | Beneficiary details and flow analysis shared through international cooperation channels |
The pattern was suspicious, not the accounts.
Continuous profiling catches drift that point-in-time snapshots miss.
Scoring escalated 23 accounts from low to critical over 90 days, with no analyst needed to trigger it.
Risk Radar connected 23 isolated accounts into one visible cluster.
Intermediary patterns exposed the layering structure, connecting UK senders to Nigerian shell entities.
System-driven suspension and freeze stopped further movement without human delay.
One evidence package supported reporting to four authorities in three jurisdictions.
The most dangerous financial crimes are not the ones that trigger alarms. They are the ones designed to avoid them entirely.
Get the complete analysis, including detailed forensic findings, regulatory references and recommendations.
Download PDF of this case studyOperators like you, running on RemitSo.
Compliance
4 days
to full detection
Stopping a sanctions evasion ring
A coordinated network found and shut down before a single dollar crossed borders.
Read the story
Scale
6–8 months
to a bespoke platform
From white label to bespoke
A UK operator outgrew its white-label provider and moved, phase by phase, to its own platform.
Read the story
Scale
10,000+
monthly transfers
Past 10,000 transfers a month
A UK provider broke free of legacy bottlenecks by moving to RemitSo.
Read the storyBuilt by people who have helped MSBs for years.
The risk checks on every online transfer come from what they see every day.
- The person paying isn't the customer
- One bank account, several customers
- A disposable email address
- Sign-in from a high-risk location
- The same person signing up twice
- A name close to a sanctions list