Link Analysis in Money Laundering Investigations: Uncovering Hidden Financial Networks
Money laundering rarely becomes intelligible through a single transaction, account or customer relationship. Link analysis can expose connections between accounts, people, companies, beneficial owners, counterparties and financial flows that reveal a wider laundering architecture, but the investigative value lies not in drawing the network: it lies in establishing what those relationships mean.
In This Article
- Introduction
- The Investigative Problem: Transactions Reveal Movement, Not Necessarily Structure
- What Link Analysis Adds to a Money-Laundering Investigation
- From Suspicious Activity to Laundering-Network Assessment
- Model 1 — F.I.L. Link-to-Laundering Investigation Model
- UK Case Study: Following the Money Beyond the First Mule Account
- Mapping the Laundering Architecture
- Model 2 — F.I.L. Laundering Network Map
- Corporate Relationships Can Connect Financial Flows to Control
- Temporal Sequencing: A Laundering Network Is Also a Timeline
- Information Sharing Can Reveal Networks That One Institution Cannot See
- EU Case Study: Following the Financial Trail
- US Case Study: Networks Across Companies, Crypto assets and Banking
- Discovery, Interpretation and Attribution Are Different Analytical Stages
- The F.I.L. Money-Laundering Relationship Test
- Model 3 — F.I.L. Money-Laundering Relationship Test
- Alternative Explanations and Evidential Challenge
- From Network Discovery to Better AML Controls
- Practitioner Guide
- Conclusion
- Methodology and Evidential Note
- Primary and Official Sources
Key Points
- Link analysis allows money-laundering investigators to move from isolated transactions towards the relationships through which suspected illicit value may be received, transferred, dispersed, converted or ultimately controlled.
- Financial flows should be examined alongside corporate, identity and temporal relationships because the account moving the money may not identify the person controlling or benefiting from it.
- Recent FCA analysis demonstrates why investigators should look beyond the initial mule account towards successive accounts, recurring destinations, linked entities and cash-out behaviour.
- A network connection is not proof of money laundering. Its evidential weight depends on provenance, timing, financial directionality, independent corroboration, control, benefit and credible alternative explanations.
- Link analysis becomes an intelligence capability when confirmed and refuted network hypotheses improve future investigation, transaction monitoring and control calibration.
Source: Fraud Intelligence Lab (F.I.L.) original illustrative diagram. It is an analytical representation for explanatory purposes and does not depict a specific money-laundering case, mandatory laundering sequence, regulatory model or evidential finding.
Introduction
Money-laundering investigations frequently begin with something considerably smaller than the structure the investigator ultimately needs to understand. It may be a suspicious transaction, an account receiving fraud proceeds, unexplained cash deposits, an unusual international transfer or a business account whose activity appears inconsistent with its stated purpose. Examined individually, the event may establish an anomaly without explaining where the value came from, where it is going, who controls its movement or whether apparently unrelated entities form part of the same activity. The investigative problem is therefore not simply whether a transaction appears suspicious, but what relationships give that transaction meaning. Link analysis provides a method for moving from the isolated event towards that wider relational picture.
Those relationships may connect customers, accounts, companies, directors, beneficial owners, beneficiaries, merchants, crypto asset wallets, addresses, devices and other infrastructure where the information is relevant and lawfully available. A payment that appears unremarkable in isolation may assume greater significance when several apparently unrelated accounts send funds towards a common beneficiary or when an entity repeatedly appears across otherwise separate investigations. The reverse is equally important: enrichment may establish that an apparently suspicious connection has a credible legitimate explanation. Link analysis therefore creates investigative context rather than automatic conclusions. A network can be discovered before it can be interpreted, and it can be interpreted before responsibility can defensibly be attributed.
The contemporary evidence makes this distinction operationally important. The FCA's September 2026 examination of money-mule activity and cashing out traced fraud proceeds through successive accounts, demonstrating the additional visibility obtained when analysis moves beyond the initial recipient. FATF's September 2026 work on professional money laundering, underground banking and hawala similarly illustrates why following money can require investigators to understand relationships and value-transfer structures rather than transactions alone. The central proposition of this article is therefore that money laundering is a relational problem as much as a transactional one. A suspicious transaction can reveal movement of value; link analysis can expose the accounts, people, companies and infrastructure through which that value moves; evidence must then determine what those connections actually establish.
The Investigative Problem: Transactions Reveal Movement, Not Necessarily Structure
Transaction monitoring usually presents an investigator with a bounded event or series of events. A rule, scenario, model or other control has identified activity requiring assessment, but the structure surrounding that activity may extend far beyond the account that generated the alert. As The Alert Is Not the Investigation examines, detection identifies a starting point for enquiry rather than establishing what the detected behaviour means. One recipient can disperse funds among several accounts, those accounts can transfer value onwards, and apparently separate branches can subsequently converge on common beneficiaries or cash-out mechanisms. Treating each account as a self-contained investigation therefore risks fragmenting what may operationally be one laundering structure.
The problem becomes more acute when different participants perform different functions. One account may receive suspected criminal proceeds, another may aggregate funds, a company may provide apparent commercial legitimacy, another participant may facilitate conversion into cash or cryptoassets, and a separate entity may receive the ultimate economic benefit. Some participants may act knowingly, while others may be deceived, coerced, compromised or unaware of the wider structure. Network membership therefore does not establish equivalent culpability among connected actors. Investigators must distinguish the function an entity appears to perform from the knowledge, control or intent that the available evidence can actually establish.
This is also why a money-laundering red flag and a laundering finding perform fundamentally different analytical functions. Money Laundering Red Flags in 2026: From Static Indicators to Typology-Led Detection examines the need to move beyond static indicators towards contextual and typology-led assessment. Link analysis extends that reasoning by asking whether apparently separate indicators converge around common entities, beneficiaries, infrastructure or financial pathways. The resulting relational picture can support a testable laundering hypothesis, but that hypothesis still requires corroboration or refutation before it becomes a defensible finding. In practical terms, the progression is Red Flag → Relational Enrichment → Network Hypothesis → Corroboration / Refutation → Evidential Assessment.
That progression also reinforces the principle developed in Fraud Indicators Are Not Evidence: How Investigators Turn Red Flags into Defensible Findings: an indicator should generate investigative questions rather than predetermine the answer. Link analysis applies the same discipline to relationships. An association between entities can increase or reduce the plausibility of a hypothesis depending on its nature, timing and surrounding evidence. The graph does not transform an indicator into proof merely by placing it beside other indicators. Its value lies in helping investigators identify which relationships require explanation.
What Link Analysis Adds to a Money-Laundering Investigation
At its simplest, link analysis represents entities and the relationships between them. Its investigative value comes from allowing different information types to be examined within a common analytical picture rather than from the technical vocabulary of nodes, edges or graphs. A customer may connect to several accounts, an account to multiple transactions, a company to directors and beneficial owners, and payments to recurring beneficiaries or counterparties. When those relationships are examined together, structures can emerge that would be difficult to identify from separate case records. The network becomes a representation of what is known, what is suspected and what remains unexplained.
Financial directionality is particularly important because a connection without direction can conceal the behaviour under investigation. Investigators need to establish whether value moved from A to B, from B to A, through an intermediary, repeatedly in both directions or towards a common destination. Amount, frequency, velocity and sequencing can materially change the interpretation. Ten accounts sending apparently unrelated payments towards one beneficiary create a different hypothesis from ten customers independently paying the same legitimate service provider. Link analysis must therefore preserve transactional context rather than reduce every relationship to an identical line.
Corporate and identity relationships add further dimensions. Companies can share directors, beneficial owners, addresses, professional intermediaries or counterparties, while individuals may be associated with multiple accounts, businesses or other relevant identifiers. FATF's Guidance on Beneficial Ownership of Legal Persons emphasises the importance of adequate, accurate and up-to-date information about the natural persons who ultimately own or control legal persons. The investigator's question is therefore not merely whether two companies are formally connected, but whether the relationship helps explain movement, control or benefit relevant to the suspected laundering activity. Corporate relationships become analytically valuable when tested alongside financial and other independently derived evidence.
From Suspicious Activity to Laundering-Network Assessment
The investigation changes when the practitioner moves beyond asking why a particular transaction is suspicious and begins asking what relationships could explain the movement of value. That change should alter the scope of enrichment, bringing relevant counterparties, linked accounts, companies, beneficiaries, corporate officers and other material identifiers into consideration where justified. Expansion should remain proportionate and hypothesis-led because unrestricted graph expansion can rapidly produce large numbers of weak or irrelevant associations. Each additional node should answer an investigative question or generate a defensible line of enquiry. A useful network is not the network with the greatest number of connections; it is the network that improves the investigative explanation.
Fraud Intelligence Lab proposes the F.I.L. Link-to-Laundering Investigation Model to structure this transition. The model deliberately places network formation between enrichment and hypothesis testing rather than treating discovery of a network as the investigative conclusion. Each stage should sharpen understanding while preserving the distinction between observed fact and inferred meaning. The framework is tool-agnostic because the reasoning should remain defensible whether relationships are identified through graph technology, analytical platforms, spreadsheets or manually constructed link charts. Technology can accelerate discovery, but it cannot determine evidential weight without contextual assessment.
Model 1 — F.I.L. Link-to-Laundering Investigation Model
Source: Fraud Intelligence Lab (F.I.L.) original analytical framework. It is not a statutory test, regulatory model, evidential rule or law-enforcement investigation standard.
Investigative challenge points
The model prevents “network detected” from becoming synonymous with “money laundering established”. A cluster of connected accounts can justify further investigation without proving the knowledge or intent of each account holder. Movement through several entities may be consistent with concealment or layering while still requiring evidence concerning the source of funds, economic purpose, control and circumstances of the participants. The investigator should therefore preserve the distinction between a laundering hypothesis and a laundering finding throughout the enquiry. That distinction becomes particularly important when analytical conclusions inform account restrictions, suspicious activity reporting, intelligence dissemination or referral for criminal investigation.
UK Case Study: Following the Money Beyond the First Mule Account
The FCA's September 2026 review of money-mule activity and cashing out provides unusually strong contemporary evidence for a network approach. The regulator surveyed 35 firms and established a public-private cell involving 22 regulated firms, which examined 140 cases across seven fraud types. Participants traced the highest-value payments through successive accounts and pooled intelligence concerning subsequent movement and cash-out. The exercise therefore examined chains of activity rather than treating the initial recipient as the end of the enquiry. That is precisely the analytical transition link analysis is designed to support.
The findings demonstrate why later generations matter. The FCA found that fraud proceeds could travel through successive mule accounts, with cash-out activity concentrated mainly between the second and fifth accounts and the greatest concentration at the second. Funds were often split into smaller payments as they progressed through the chain, while some accounts appeared repeatedly across different fraud types. That pattern can expose infrastructure that is difficult to identify when cases are examined solely at first-recipient level. An investigation confined to the initial mule may therefore identify suspected muling without reconstructing the wider financial architecture.
This is where the network perspective intersects with The Mule Economy: Deconstructing the Financial Architecture Behind the Laundering of Fraud Proceeds. Identifying an individual mule answers only part of the investigative question if the account is one component of a repeatable infrastructure for receiving, moving, aggregating or cashing out proceeds. Link analysis can expose recurring intermediaries, convergence points and destinations across apparently separate cases. Those relationships can generate a hypothesis about reusable laundering infrastructure without establishing that every participant occupies the same role or possesses the same knowledge. The analytical shift is from identifying a mule to reconstructing the architecture within which the mule account operates.
The FCA's review of the National Fraud Database and money-mule detection tools provides an additional evidential safeguard. The regulator examined tools capable of tracing fraud proceeds through Faster Payments and visualising movements between accounts. Several firms found alerts more effective when corroborated with additional supporting information rather than treating the alert alone as a clear indicator of muling. This distinction is significant because technology can improve network visibility without eliminating the need for investigative judgement. A technically valid connection still requires interpretation within the customer, transactional and evidential context.
Mapping the Laundering Architecture
Following financial flows is essential, but a complete link analysis often requires more than a transaction graph. The same movement can involve distinct roles: an initial recipient, intermediary accounts, companies providing apparent commercial legitimacy, facilitators, conversion mechanisms and persons ultimately exercising control or receiving benefit. Those roles should not be inferred solely from visual prominence. The account processing the largest amount may not belong to the organiser, while the person with the greatest number of relationships may not be the ultimate beneficiary. Network position and criminal role are different propositions.
Fraud Intelligence Lab's second model therefore separates the financial pathway from the relationship infrastructure surrounding it. This distinction matters because value can change form while relevant relationships remain analytically visible. Bank transfers may become cash, crypto assets, trade payments, goods, property or other assets, while companies, controllers and counterparties provide potential relational continuity across those transformations. Conversely, an apparently strong relationship may be legitimate and unrelated to the suspected laundering. Financial movement and entity relationships should therefore be examined together without treating either as conclusive alone.
Model 2 — F.I.L. Laundering Network Map
Source: Fraud Intelligence Lab (F.I.L.) original analytical framework. It is an investigative analytical construct and does not represent a mandatory laundering sequence or regulator-issued model.
Suspected Illicit Value / Potential Criminal Property
↓
Entry Accounts / Initial Recipients
↓
Intermediary Accounts / Other Value-Transfer Nodes
↔ People / Customers / Potential Controllers
↔ Companies / Directors / Beneficial Owners
↔ Relevant Shared Infrastructure / Identifiers
↓
Convergence / Aggregation
↔ Dispersal / Further Movement
↓
Cash-Out / Cryptoassets / Trade / Assets / Cross-Border Value Transfer
↓
Potential Controllers / Facilitators / Ultimate Beneficiaries
Starting with suspected illicit value or potential criminal property is deliberate. At the investigative stage, the source or legal character of the funds may still require proof, and an analytical model should not assume the conclusion that the investigation is intended to test. The model also avoids treating placement, layering and integration as a rigid sequence that every investigation must reveal. FATF's 2026 work on professional money laundering, underground banking and hawala examines decentralised and informal value-transfer structures relevant to this problem. Link analysis therefore needs to remain capable of following value even when its mechanism or form changes.
Corporate Relationships Can Connect Financial Flows to Control
Companies can become critical analytical bridges because the named counterparty in a transaction may not reveal the natural person ultimately owning or controlling the entity. This extends the analytical problem examined in Investigating Corporate Networks: Companies House Records, Relationships and Evidential Weight. Corporate registry relationships can identify directors, beneficial owners, addresses and other associations, but those connections acquire greater investigative significance when tested against independent financial, temporal and behavioural evidence. In a money-laundering investigation, link analysis can connect the corporate structure to the movement of value and potential economic benefit. The question therefore shifts from whether companies are connected to what that connection helps establish about control, purpose or benefit.
The HMRC Trade-Based Money Laundering Handbook provides a useful UK illustration through Operation A, an investigation into an organised crime group whose subjects were successfully prosecuted. HMRC describes cash being collected and deposited into UK business bank accounts controlled by suspects before electronic transfer to the United Arab Emirates. The method was repeated across other corporate entities and business accounts. Investigators examined the corporate footprint surrounding the principal suspect rather than treating the formal company structure as the complete explanation. Financial and corporate relationships were therefore capable of being examined together when testing possible control.
The investigation also tested the apparent commercial explanation against independent information. In the HMRC account of how customs data was used in Operation A, eight companies and associated directors and addresses were examined against customs information. HMRC found that the companies had neither applied for the relevant EORI numbers nor made import declarations, providing evidence relevant to whether the purported goods movements had occurred. This matters analytically because investigators did not infer fictitious trade merely from suspicious banking activity or corporate associations. They sought an independent dataset capable of corroborating or refuting the network hypothesis.
Temporal Sequencing: A Laundering Network Is Also a Timeline
A static network can show who or what is connected while concealing when the relationship became relevant. Timing matters because money laundering is behavioural and sequential as well as relational. An account receiving funds and transferring them minutes later presents a different investigative question from the same accounts conducting occasional transactions over several years for an identifiable commercial purpose. Companies can change ownership, directors can be appointed or removed, and addresses or identifiers can be reused at different periods. A network that collapses time can therefore make relationships appear contemporaneous even when they were not operationally relevant at the same moment.
Chronology can also convert apparently weak relationships into a more coherent hypothesis. Investigators can compare account openings, incoming payments, onward transfers, corporate changes, cash withdrawals, documents and other events to determine whether they form a repeatable sequence. HMRC's prosecution account of Operation A describes the development of a chronological timeline connecting financial and documentary events relevant to the case. Chronology in that context performed analytical work rather than merely organising dates. It helped place individual pieces of evidence within the sequence against which the investigators' explanation could be tested.
This creates a practical distinction between network proximity and temporal relevance. Two entities may sit beside each other in a graph while the underlying relationship predates or postdates the suspected laundering activity by years. Conversely, apparently distant nodes can become significant when value moves through them in rapid succession or the same sequence recurs around multiple events. Investigators should therefore be able to reconstruct the network at relevant points in time rather than relying solely on an aggregated view. The question is not simply who is connected, but who was connected when the material activity occurred.
Information Sharing Can Reveal Networks That One Institution Cannot See
Some laundering relationships remain invisible because no single institution holds the complete transaction chain. One firm may see the originating account, another the intermediary and another the eventual beneficiary, with each institution assessing only the fragment visible within its own systems. The UK Government's guidance on information-sharing measures under the Economic Crime and Corporate Transparency Act 2023 explains the framework through which qualifying AML-regulated firms can share relevant information subject to applicable conditions. Cross-institutional information can therefore expand the view of relationships that would otherwise appear unrelated. Network visibility can depend as much on lawful information exchange as on analytical software.
That does not make unrestricted information exchange an investigative virtue. Information sharing remains subject to statutory conditions, data-protection requirements and organisational controls. Link analysis should therefore not become an argument for indiscriminately collecting or distributing every available relationship. Investigative relevance, lawful authority, data quality and provenance remain part of the analytical control environment. A network built from poorly governed information may be visually sophisticated while remaining evidentially unreliable.
The National Crime Agency's explanation of Suspicious Activity Reports also illustrates why information can acquire additional intelligence value when combined with other holdings. A SAR concerning one customer may assume different significance when law enforcement can relate it to other accounts, entities, transactions or reports. Multiple reports do not independently prove the underlying activity merely because they repeat similar suspicions. Investigators should preserve provenance when determining whether apparently separate observations provide genuine corroboration. Repetition of suspicion is not the same thing as independent evidence.
EU Case Study: Following the Financial Trail
Europol's February 2026 account of Operation POZZO provides a direct illustration of the transition from suspicious financial movements to a wider network investigation. Europol reported that suspicious financial activity led investigators towards an alleged laundering system said to have serviced members of the Camorra and 'Ndrangheta. Investigators identified shell companies, false invoicing, luxury investments, cryptoassets and corporate structures spanning jurisdictions. Seven suspects were arrested during coordinated action across France, Italy, Belgium and Switzerland. Because relevant parts of the case concern alleged conduct, those allegations should not be converted into findings of guilt.
The practitioner significance lies in the direction of the investigation. Suspicious movements were not treated as a self-contained financial anomaly; following the financial trail generated a wider picture involving companies, individuals, assets and suspected predicate criminality. Europol reported that its support included advanced criminal and financial analysis and assistance in developing a shared operational picture. The network therefore functioned as an intelligence structure connecting financial information with other investigative material. That is a more useful practitioner conception of link analysis than treating it merely as visualisation.
The case also exposes the limitations of relying too heavily on the familiar placement-layering-integration vocabulary as an investigative map. Those concepts can describe broad laundering functions, but they do not identify which account, company, facilitator or controller performed them in a particular case. Investigators need to connect suspected value with the entities through which it moved and the evidence bearing on control, knowledge and benefit. That requires financial, corporate, asset and other relevant intelligence to be considered relationally. The typology describes a possible mechanism; link analysis helps reconstruct the actors and infrastructure through which that mechanism may operate.
US Case Study: Networks Across Companies, Crypto assets and Banking
The April 2026 sentencing of Maximilien de Hoop Cartier provides a useful US example because the proceedings had moved beyond allegation to conviction and sentencing. The US Department of Justice sentencing announcement states that Cartier was sentenced to eight years' imprisonment for his role in an international money-laundering network that laundered hundreds of millions of dollars in illicit proceeds. DOJ said he operated an unlicensed over-the-counter cryptocurrency exchange and used US shell companies and bank accounts in the laundering operation. According to the sentencing announcement, the operation laundered more than $470 million. The case provides a stronger evidential basis than an indictment-only example because conviction and sentencing had occurred.
The relational structure is particularly instructive because the activity connected crypto assets, shell companies, bank accounts, documentation, cross-border transfers and individuals. A laundering investigation that treated each channel as a separate information silo could miss the relationships through which value changed form. Link analysis instead asks which entities connect the channels, where conversion occurs, which accounts provide access to conventional finance and who exercises control over the infrastructure. The relevant network is therefore not necessarily confined to bank transactions. Cross-channel visibility becomes part of following the value.
FinCEN's 2025 analysis of suspected Chinese money-laundering networks provides a broader financial-intelligence perspective. FinCEN analysed 137,153 Bank Secrecy Act reports filed between January 2020 and December 2024 associated with suspected network-related activity, representing approximately $312 billion in suspicious transactions. Its analysis identified activity involving methods and mechanisms including trade-based money laundering, money mules and shell companies. Those figures concern suspicious transactions reported under the BSA rather than $312 billion of judicially established money laundering, and that distinction is material. For investigators, the broader lesson is that multiple laundering methods can coexist within suspected networks and may need to be assessed across channels rather than within a single typology.
Discovery, Interpretation and Attribution Are Different Analytical Stages
A central weakness in network investigation occurs when discovery and attribution collapse into a single analytical step. Network discovery establishes that relevant entities or activities appear connected, while network interpretation asks what those relationships may mean within the investigative context. Network attribution goes further by assessing who controlled, knew, facilitated or benefited from the relevant conduct. Finally, evidential disposition determines what the available evidence supports and what remains unresolved. Each stage demands more than the stage before it.
This distinction protects the investigation from the persuasive power of the visual network. A transfer between two accounts may establish movement of value within the limits of the records, but it does not automatically establish why the transfer occurred or what either account holder knew. A shared address can connect companies without proving common beneficial ownership, and a shared identifier may strengthen a common-control hypothesis while still requiring validation. Investigators should therefore be able to explain what each material connection establishes before explaining what they infer from it. A network can be discovered before it can be interpreted, interpreted before responsibility can be attributed, and attributed only to the extent supported by evidence.
The F.I.L. Money-Laundering Relationship Test
Fraud Intelligence Lab proposes the F.I.L. Money-Laundering Relationship Test to make the assessment of individual connections explicit. The model avoids numerical scoring because a precise-looking number could imply an evidential certainty that the underlying relationships do not support. Instead, it asks investigators to examine the dimensions that determine whether a connection materially strengthens or weakens a laundering hypothesis. This becomes particularly important where automated analytics generate large numbers of technically valid but contextually different associations. Network density should not be mistaken for evidential weight.
Model 3 — F.I.L. Money-Laundering Relationship Test
Source: Fraud Intelligence Lab (F.I.L.) original analytical framework. It is not a statutory evidential test, regulatory model or law-enforcement investigation standard.
| Dimension | Investigative question |
|---|---|
| Connection | What relationship has actually been established? |
| Relationship type | Is it financial, corporate, identity-based, digital, geographic or another relevant association? |
| Data provenance | Which source produced the relationship, and what are its limitations? |
| Temporal relevance | Did the relationship exist during the period material to the suspected laundering? |
| Source independence | Are supporting observations genuinely independent? |
| Financial directionality | Where did value originate, move, converge, disperse or terminate? |
| Control | What evidence indicates who exercised effective control over the relevant account, company or asset? |
| Benefit | Who appears to have obtained economic or other benefit? |
| Economic purpose | Is there a credible lawful explanation for the activity? |
| Alternative explanation | What non-criminal explanation could reasonably produce the same network? |
| Evidential weight | What can defensibly be concluded, and what remains an investigative hypothesis? |
One consequence is that individually weak relationships can become significant through independent convergence. A shared address may initially carry limited weight, but its significance can change if the same entities also share relevant counterparties, financial destinations, controlling persons and contemporaneous behaviour. Conversely, numerous database hits can provide little additional evidential weight if they all reproduce the same originating information. Investigators should therefore distinguish multiple observations from independent corroboration. Source provenance is part of the evidential analysis rather than administrative metadata surrounding it.
Alternative Explanations and Evidential Challenge
Link analysis can intensify confirmation bias because once a network appears suspicious, every new connection can be interpreted through the same narrative. An onward transfer becomes “layering”, a connected company becomes a “shell”, and a shared identifier becomes “common control” before those propositions have been tested. The safeguard is not to abandon network analysis but to make competing explanations part of the investigative method. Each material connection should generate a proposition capable of corroboration or refutation. The investigator should be able to explain what evidence would materially change the assessment.
Legitimate circumstances can produce patterns superficially resembling laundering relationships. Companies may share professional advisers or registered addresses, households may share financial or digital infrastructure, and businesses can legitimately receive and rapidly redistribute funds as part of their operating models. Even a recognised money-laundering indicator should therefore be assessed against customer context, economic purpose, transaction history and other relevant evidence. The question is not whether a legitimate explanation can be imagined after the event, but whether it remains credible when tested against the totality of available information. Alternative explanation is an investigative test, not a presumption of innocence or guilt.
Negative evidence can also have analytical significance. If the hypothesis is that one person controls several apparently independent companies, investigators can identify relationships or behaviours that would reasonably be expected if that proposition were correct. Their absence does not automatically refute common control because datasets may be incomplete and deliberate separation may itself form part of concealment. Nevertheless, missing expected evidence should affect the weight attached to the hypothesis and identify an intelligence gap requiring further enquiry. A defensible network analysis records what should reasonably have been found as well as what was found.
From Network Discovery to Better AML Controls
Link analysis should influence control design rather than remain an investigative visualisation used only after significant suspicion has developed. The FCA's 2026 work demonstrates why: repeat accounts appeared across different fraud types, funds moved through successive generations, and cash-out behaviour became clearer when firms pooled intelligence and followed payments beyond the initial recipient. An entity-centric control may therefore miss risk whose significance exists primarily in relationships between entities. Network analysis can supplement conventional monitoring by identifying recurrence, convergence, dispersal and relationships with previously identified infrastructure. The analytical advantage is therefore relational visibility, not automatic attribution.
This does not mean that every network relationship should become another alert rule. A control that detects more associations but generates large volumes of weak, unexplainable cases may increase investigative workload without improving outcomes. The FCA's work on mule-detection tools is particularly relevant because firms reported greater usefulness when alerts were corroborated with additional information. Detection performance should therefore be assessed alongside investigative interpretation and downstream outcomes. More detected relationships do not necessarily mean better detection.
Investigative outcomes should then feed back into detection and control calibration. Confirmed cases can identify combinations of relationships that were genuinely informative, while refuted hypotheses can expose legitimate behaviour producing false associations. Investigators should record why a relationship mattered, what additional evidence altered its weight and which connection changed the disposition. That learning can support better enrichment and prioritisation without assuming that every historic pattern will recur identically. Link analysis becomes an intelligence capability when investigative learning changes what the organisation looks for next.
Practitioner Guide
For investigators, the starting point should remain the activity that generated concern, but the assessment should not remain confined to it. The investigator should define the triggering behaviour, identify materially relevant entities and reconstruct where value originated, where it moved, where it converged and where it was ultimately dispersed or converted. Each network expansion should answer an investigative question rather than merely increase the number of visible connections. Material relationships should retain their source, date and context so that weak associations are not inadvertently presented as established facts. The resulting case record should distinguish observed relationships, analytical inferences, unresolved hypotheses and findings supported by corroborated evidence.
Investigators should then test the network across multiple dimensions. Financial directionality can reveal whether apparently separate accounts participate in a common flow, while chronology can establish whether relationships existed during the material period. Corporate analysis can help identify formal and potential effective control, while beneficial-ownership information may reveal natural persons behind legal entities. Where lawful and proportionate, other identifiers can assist in testing whether accounts or entities share relevant infrastructure. No single dimension should automatically determine the conclusion while credible alternative explanations remain.
MLROs and control owners should focus on whether network-generated alerts are explainable and operationally useful. Analysts need to understand which relationships caused an alert and why the system regards them as relevant, particularly where automated analytics or third-party datasets are involved. Investigative outcomes should be reviewed to identify which relationships consistently improve detection and which generate false positives or weak associations. Information-sharing mechanisms can materially extend visibility across institutions, but shared suspicion should retain its provenance and should not be misrepresented as independent corroboration. The objective is not maximum connectivity; it is better identification of relationships that materially improve the assessment of suspected money laundering.
Disposition rationale is equally important. A network investigation should explain why particular relationships were given greater or lesser evidential weight and what information remained unavailable. Where suspicion remains, the case record should identify the behaviour and relationships supporting that assessment rather than relying on the existence of a network diagram. Where the hypothesis is refuted or weakened, the explanation should record what evidence changed the assessment so that the outcome can inform future control calibration. This creates a defensible audit trail and preserves organisational learning after the individual case closes.
Conclusion
Money-laundering investigations become difficult because relevant evidence is often fragmented across transactions, accounts, institutions, companies, payment channels and jurisdictions. Link analysis provides a method for reconstructing relationships between those fragments so that investigators can move beyond the transaction that first generated suspicion. The FCA's findings show why following value beyond the first mule account can reveal repeat infrastructure and cash-out behaviour, while HMRC, Europol and US enforcement material demonstrate the importance of connecting financial flows with companies, assets, individuals and cross-border activity. The comparative lesson is not that laundering networks follow one structure, but that their significance often becomes visible only when relationships are examined together. Link analysis provides the means to make that relational structure investigable.
The analytical challenge begins after those relationships are discovered. A network connection can establish association or movement without establishing criminal purpose, knowledge, common control or ultimate benefit. Funds-flow analysis, chronology, beneficial-ownership research, corporate analysis, provenance and independent corroboration therefore perform complementary functions in determining what the network actually means. Credible alternative explanations should be tested rather than acknowledged superficially, while missing expected relationships should remain visible as evidential or intelligence gaps. The strength of a laundering hypothesis depends less on the number of lines in the graph than on the defensibility of the explanation attached to them.
For investigators, MLROs and financial-crime control owners, this changes the purpose of link analysis. The objective is not to produce the largest possible network or substitute automated associations for professional judgement, but to identify relationships that materially improve decisions about where suspected value moved, what infrastructure enabled that movement, who may have exercised control or obtained benefit, and what evidence is still required. The three F.I.L. models provide complementary structures for moving from suspicious activity through network discovery to evidential assessment without collapsing those stages into one another. The value of link analysis is not that it proves money laundering by connecting the dots; it is that it reveals which dots may belong to the same financial network and what investigators must establish before those connections become defensible findings.
Methodology and Evidential Note
This article draws on official, regulatory, intergovernmental, law-enforcement and primary case material from the United Kingdom, European institutions, FATF and the United States. The principal evidence base includes FCA reviews of money-mule activity and detection tools, HMRC's Trade-Based Money Laundering handbook, UK economic-crime information-sharing material, FATF work on beneficial ownership and professional money laundering, Europol operational reporting, FinCEN financial-intelligence analysis and a US Department of Justice sentencing case. These sources perform different evidential functions and are not treated as interchangeable. Regulatory findings, intelligence analysis, investigative allegations, official guidance, prosecutions and judicial outcomes remain distinct evidential categories. Where an authority describes suspected or alleged conduct, this article preserves that status rather than converting the allegation into an established fact.
The F.I.L. Link-to-Laundering Investigation Model, F.I.L. Laundering Network Map and F.I.L. Money-Laundering Relationship Test are original Fraud Intelligence Lab analytical constructs. They are not FATF models, regulatory requirements, statutory tests, judicial evidential standards or law-enforcement investigation frameworks. The models are intended to organise investigative reasoning and preserve the distinction between network discovery, interpretation, attribution and evidential disposition. Examples involving accounts, companies, devices, addresses and other identifiers are analytical illustrations unless expressly connected to an official case. Application to actual investigations remains subject to relevant legal, regulatory, privacy, disclosure, information-sharing and evidential requirements.
