What a typology is
A typology is a named pattern of financial crime, written down precisely enough that two people looking at the same case reach the same view about whether it fits.
Structuring, layering, mule activity, mixer exposure. These are typologies: recognised shapes that criminal money tends to take, each described well enough to be matched against a case in front of you.
They exist because the alternative is every analyst carrying their own private sense of what looks wrong. A typology makes that sense explicit, which means it can be taught to a new starter, argued with by a colleague and pointed at in a filing.
What a good one contains
A name and a paragraph is a label. The ones that hold up under review carry five things.
- Regulatory anchors
Which guidance or legislation treats this as a concern, by name. Without it you have an opinion about what looks odd rather than a reason anybody is obliged to act.
- Signature patterns
What it looks like when it is happening. Specific enough to recognise, which usually means naming the behaviour rather than the category.
- What to look for in transfer history
Where to go and in what order. This is the difference between a definition and something an analyst can act on.
- Threshold heuristics
Rough magnitudes and frequencies that make the pattern more or less likely. A typology that presents them as rules is overclaiming.
- Common false-positive cases
The innocent explanations that produce the same shape. The most valuable section and the one most often missing.
Three of the patterns this section covers. Every card carries the same parts: the pattern, what it is, and the indicators that make it recognisable.
Typologies change, so they carry versions
Criminal methods adapt, guidance gets updated, and a service that was a red flag in 2022 may be unremarkable now or sanctioned outright. A typology that is not versioned cannot be audited, because nobody can establish which description was in force when a decision was made.
That matters more than it sounds. If a case was closed against version 0.1 of a typology and the description has since changed, a reviewer needs to judge the decision against what it said at the time. Jurisdiction matters for the same reason: the same behaviour can carry different obligations in different places, so a typology should say where it applies.
How to use one on a case
- 1
Read the false-positive section first
Before you look for the pattern, look at what else produces it. Reading the signatures first primes you to find them.
- 2
Check the signatures against what you have
Which are present, which are absent, and which you cannot establish either way. The third group is usually the largest and it is the one people forget to record.
- 3
Record the typology and its version in your reasoning
Not just that it matched, but which signatures carried the match. A reviewer should not have to guess which part of the description you relied on.
A typology that never produces a non-match is not doing its job. If every case fits, the description is too loose to carry any weight in a filing.
Related
What KYT is
Know your transaction screens onchain activity against categories of concern. It tells you about the money an address has touched, and nothing at all about the person holding it.
How the agent recommends an outcome
The agent proposes an outcome and names the findings behind it. It never inherits a decision from an earlier case.
How to run a case
How to scope an investigation, what order to establish facts in and how to tell when you have enough.
Last checked against the product on .