When a Legitimate Business Becomes Part of the Money-Laundering Problem

A business does not have to be created for crime to become part of a money-laundering scheme.

A legitimate company can be used to move funds, create financial accounts, provide professional services, or make illicit money appear legitimate. This is why AML controls cannot stop at asking whether a customer is a real, registered business.

A useful example came from a U.S. case in which a business owner used a “virtual CFO” company to create shell companies and fraudulent business bank accounts. These accounts were then used to launder more than $35 million in proceeds from internet fraud.

The important lesson is not simply that shell companies can be misused. It is that legitimate business services can become part of the laundering process when customer activity is not understood and challenged.

KYC Is Not a Lifetime Certificate

A customer may pass onboarding and still become higher risk later.

The business may change its activities, ownership, transaction volumes, counterparties, or geographic exposure. A structure that initially made sense may later become unnecessarily complex or inconsistent with the customer's stated purpose.

This means ongoing monitoring and periodic customer reviews matter just as much as initial KYC.

Look Beyond Whether the Business Exists

A company being registered, having a website, maintaining an office, or having financial statements does not automatically explain where its money comes from.

Compliance teams should consider:

• Does the customer's activity match its stated business?
• Are transaction volumes reasonable for the business?
• Are ownership and control structures transparent?
• Are third parties making or receiving payments without a clear reason?
• Does the source of funds make sense?
• Has the customer's risk profile changed?

The issue is not complexity itself. Some businesses genuinely require complex structures. The concern is unexplained complexity combined with unusual financial activity.

Professional Services Can Also Be Exposed

Lawyers, accountants, company service providers, real estate professionals, and other legitimate service providers can become part of laundering schemes, either knowingly or unknowingly.

Their services may provide access, credibility, corporate structures, or financial expertise that criminals can exploit.

That makes understanding the customer's purpose and the actual individuals behind a structure particularly important.

What Businesses Can Do

AML controls should connect the full picture:

Customer → Ownership → Business Activity → Source of Wealth → Source of Funds → Transactions → Counterparties

When one part of that picture does not make sense, it should trigger further review rather than being dismissed because the customer is an established business.

Management also has a responsibility to ensure compliance teams have the resources, authority, and systems needed to identify these changes.

The biggest AML risk is sometimes not an obviously criminal customer.

It is a legitimate business whose services, accounts, or structure are gradually being used for something they were never intended to support.

References

U.S. Department of Justice (2025) Rhode Island Business Owner Sentenced to Four Years for Money Laundering Conspiracy. Available at: https://www.justice.gov/usao-ma/pr/rhode-island-business-owner-sentenced-four-years-prison-money-laundering-conspiracy-and

Financial Action Task Force (FATF) (2024) Horizontal Review of Gatekeepers’ Technical Compliance Related to Corruption. Available at: https://www.fatf-gafi.org/content/fatf-gafi/en/publications/Fatfgeneral/Gatekeeper-TC-Corruption.html