Coordinated Shell-Layering Campaign Targeting National Financial Intelligence Units

Across three separate AML engagements this quarter, our investigators identified a shared operational pattern: dozens of shell accounts opened using synthetic identities, funded within hours of opening, and used to layer funds across two or more jurisdictions before any single transaction crossed a reporting threshold.

What distinguishes this cluster from routine structuring is speed and coordination — account creation, initial funding, and the first layering transfer typically complete within 72 hours, well inside the window most manual review processes are tuned to catch. We're tracking this activity as CLUSTER-19 pending further attribution.

Entity-resolution systems that only evaluate individual accounts in isolation are largely blind to this pattern; it only becomes visible when the ownership graph across the shell accounts is resolved and the timing correlation across jurisdictions is surfaced as a single case.

We've shared indicators with the financial intelligence units we work with directly. Organizations running their own AML programs should specifically test whether their entity-resolution layer can correlate account-opening velocity across jurisdictions, not just within a single institution.