AML: the shape of suspicion

Nothing here is illegal, one transaction at a time

Money laundering has a frustrating property from a detection standpoint: looked at one transaction at a time, almost none of it is illegal. A cash deposit is not a crime. A transfer between accounts is not a crime. Moving money through several entities is how ordinary commerce works. The launderer is not doing illegal things. They are doing legal things in an arrangement, and the arrangement is the crime. Placement, layering, integration: get cash into the system, move it through enough hops to obscure its origin, bring it back out looking clean. Each hop is unremarkable. The sequence is the signal.

This changes what an AML rule has to be. It cannot be a single threshold on a single transaction, because no single transaction crosses a line that matters. It has to recognize a shape across many. That is why anti-money-laundering detection is built from combinations: not "this transaction is suspicious" but "these transactions, together, form a pattern that suspicion attaches to."

The pattern as a rule

Take structuring, the most familiar example. Many jurisdictions require a report for cash transactions above a threshold. So a launderer breaks a large sum into several deposits, each deliberately just below the line, to stay under the reporting requirement. No individual deposit is reportable. The pattern of them is the red flag, and it is a flag precisely because it looks engineered to avoid one.

{
  "rule_id": "AML-STRUCT-001",
  "title": "Possible structuring: multiple cash deposits below the reporting threshold",
  "source": "FATF Recommendations; structuring typology",
  "severity": "review",
  "expected_outcome": {
    "action": "review",
    "message": "Several cash deposits just below the reporting threshold within a short window, aggregating well above it. Pattern consistent with structuring. Review and consider a suspicious activity report."
  },
  "conditions": [
    { "type": "conditional_logic", "operator": "AND", "clauses": [
      { "type": "count_over_window", "path": "account.cash_deposits", "window_days": 10, "min_count": 3 },
      { "type": "each_below", "path": "account.cash_deposits[].amount", "value": 10000 },
      { "type": "sum_over", "path": "account.cash_deposits[].amount", "window_days": 10, "value": 25000 }
    ]}
  ],
  "deterministic": true,
  "validation_status": "expert_reviewed"
}

Three conditions, combined, none of them damning alone. Several deposits, each below the line, summing to well above it, inside a short window. The rule is the conjunction. This is the FATF typologies turned into logic: the published red-flag patterns that money launderers exhibit, encoded as combinations of conditions rather than single tests. Some of those patterns are crisp, like structuring near a numeric threshold. Others are softer and need a model to recognize, like an unusual narrative in a payment reference, and those run as semantic checks, flagged as such, with their uncertain calls sent to a person.

Suspicion is not a verdict

AML has a feature that sets it apart from a hard compliance check: the output is almost never an automatic block. It is a flag for human judgment, because the thing being detected is suspicion, not proof. A structuring pattern is a reason to look, not a finding of guilt. The decision that follows, whether to file a suspicious activity report, is a regulated human judgment that the system informs but does not make.

So an AML rule is advisory by design. It surfaces the shape, cites the typology, assembles the evidence, and routes it to an investigator. The engine is not deciding that money was laundered. It is deciding that a pattern worth a human's attention is present, and making sure the human sees it with the contributing transactions and the typology attached. The verdict stays with the person, where the law puts it.

Fail closed, in the direction of looking

The conservative direction in AML is to surface rather than suppress. When the data is incomplete, when transactions cannot be fully aggregated, the rule does not conclude that no pattern exists. Absence of a detected pattern in incomplete data is not evidence of innocence, and treating it that way is how a launderer benefits from gaps. So a partial view that cannot be resolved is itself a reason to flag for review, not a reason to clear.

The point

AML is the domain that proves a rule does not have to be a single threshold. The signal lives in the combination, because the individual acts are legal and only the arrangement is not. Encoding it means encoding shapes: conjunctions of conditions that together describe a typology, crisp where the regulation is crisp, semantic where it requires reading, and always advisory, because suspicion is a reason to investigate and the verdict belongs to the investigator. The shape is what you detect. The judgment is what a person does with it.