Legitimate versus Illicit Transactions

1. Why This Topic Is Important

When a fraud examiner traces assets, the central challenge is almost never a shortage of transactions; it is an overwhelming volume of them. Bank statements, credit card records, brokerage accounts, wire logs, and real property records contain thousands of entries, the vast majority of which are perfectly ordinary. The examiner's job is to separate the legitimate flow of money (salary, loan proceeds, documented gifts, normal business receipts, inheritances, asset sales) from the illicit flow (embezzled funds, kickbacks, bribes, skimmed cash, laundered proceeds, concealed income). If you cannot make this distinction reliably, you cannot (a) prove that a subject received funds beyond known legitimate sources, (b) identify where stolen assets went for recovery, or (c) withstand cross-examination when defense counsel argues that every suspicious deposit has an innocent explanation.

On the CFE Exam this topic sits within the Investigation section (Tracing Illicit Transactions). Questions test whether you can recognize indicators of illicit activity, understand how legitimate sources are established and eliminated, apply the direct and indirect methods of proof, and avoid common analytical errors. It is a high-yield topic because it connects to money laundering, financial statement analysis, interviewing, and legal elements of fraud.

2. What It Is

A legitimate transaction is a movement of funds or property that has a lawful source, a genuine economic or personal purpose, and documentation that can be independently verified. Examples include payroll deposits matched to W-2s or payslips, mortgage proceeds matched to a closing statement, a documented inheritance, insurance settlements, the sale of a car with a title transfer, or routine business receipts supported by invoices and shipping records.

An illicit transaction is one that either originates from unlawful activity (embezzlement, bribery, theft, tax evasion, drug proceeds) or is structured to conceal the true source, ownership, or destination of funds (money laundering, use of nominees, shell entities, structuring). A transaction can also be illicit even when the underlying money is lawful if the purpose is to evade reporting or deceive, such as deliberately splitting a cash deposit to stay under the currency transaction reporting threshold.

Key concept: the burden on the examiner is to account for legitimate sources first. In the indirect methods of proof, unexplained funds are only meaningful once all known and reasonably possible legitimate sources have been identified, quantified, and eliminated. Failing to do this is the single most common weakness in an asset-tracing case.

3. How It Works

Step 1 — Build a financial profile of the subject. Gather the subject's known income (employment, business ownership, investments), known assets at the start of the period (the opening net worth or starting point), liabilities, and lifestyle. Public records, interviews, tax returns, loan applications, and prior financial statements are primary sources. Loan and credit applications are especially valuable because the subject has already declared assets, income, and liabilities under penalty.

Step 2 — Collect transaction records. Bank statements, cancelled checks, deposit slips and deposit items, wire transfer records, credit and debit card statements, brokerage statements, cash receipts, real estate closing documents, vehicle titles, and business records. Obtain the items behind deposits (copies of checks deposited) because a deposit total alone tells you nothing about source.

Step 3 — Classify each inflow as known legitimate, unknown, or suspected illicit. Match each deposit to a source document. A payroll deposit that matches the employer's pay schedule and net pay is legitimate. A transfer from the subject's own savings account is a non-income transfer (eliminate it so you do not double count). A series of cash deposits with no corresponding source is unknown and requires further work. A check from a vendor who does business with the subject's employer is a red flag for a kickback.

Step 4 — Eliminate transfers and non-income items. Inter-account transfers, redeposited funds, returned checks, loan proceeds, and refunds are not income and must be removed from deposit totals in the bank deposits method.

Step 5 — Apply a method of proof.
- Direct (specific items) method: Trace a specific illicit payment from source to destination (for example, a vendor check that was deposited into the controller's personal account). This is the strongest evidence but requires the documents to exist.
- Indirect methods: Used when records are incomplete or cash is involved. The net worth method compares the change in net worth plus living expenses to known legitimate income; the excess is funds from unknown sources. The expenditures (sources and applications of funds) method compares total spending to known sources. The bank deposits method totals net deposits after eliminating transfers and non-income items and compares them to known legitimate income. In every indirect method the examiner must reasonably eliminate legitimate explanations such as gifts, inheritances, loans, cash hoards, and prior accumulated savings.

Step 6 — Follow the money forward. For funds identified as illicit, trace their disposition: purchases of real estate, vehicles, jewelry, investments, transfers to relatives or shell companies, cash withdrawals, or offshore accounts. This supports asset recovery and demonstrates intent to conceal.

Step 7 — Document and corroborate. Confirm legitimate sources with third parties (employers, banks, relatives who claim to have made gifts) and prepare schedules that show every deposit, its classification, and the supporting evidence.

4. Indicators That a Transaction May Be Illicit

- Cash deposits or withdrawals just under reporting thresholds, or multiple same-day deposits at different branches (structuring).
- Round-dollar amounts with no business rationale.
- Deposits inconsistent with known income or occupation.
- Payments from vendors, contractors, or customers of the subject's employer into personal accounts.
- Rapid movement of funds in and out of an account with little remaining balance (pass-through activity).
- Transfers to or from shell companies, trusts, or nominees with no apparent economic purpose.
- Use of multiple accounts, cashier's checks, money orders, or third-party checks to obscure origin.
- Payments to or from high-risk jurisdictions without a business reason.
- Assets titled in the names of relatives, friends, or entities while the subject retains control or use.
- Lifestyle spending (travel, luxury goods, gambling) that cannot be supported by reported income.
- Missing, altered, or backdated documentation; sequential invoice numbers from a single vendor; vendor addresses that match employee addresses.
- Transactions occurring at unusual times, such as immediately before an audit or right after the subject gained control over a disbursement function.

5. Indicators That a Transaction Is Likely Legitimate

- Documented source confirmed by an independent third party.
- Consistency with the subject's known earning history and pattern.
- Transparent trail: the payer, purpose, and recipient are all identifiable.
- Amounts and timing that match contracts, payroll cycles, or recorded sales.
- No attempt to obscure ownership; assets held in the subject's own name and reported on tax returns and loan applications.

Remember that a single unusual transaction does not establish fraud. The examiner looks for patterns, for the absence of a legitimate explanation after reasonable inquiry, and for corroboration from independent sources.

6. Connection to Money Laundering

Illicit transactions are frequently disguised through the three stages of laundering: placement (getting cash into the financial system, often via structuring or cash-intensive businesses), layering (multiple transfers, shell entities, and conversions to obscure the trail), and integration (returning funds as apparently legitimate assets or income). When tracing assets, the examiner is often working backward through layering to connect integrated assets to the original illicit placement. Recognizing laundering typologies helps you spot which 'legitimate-looking' transactions deserve scrutiny.

7. Exam Tips: Answering Questions on Legitimate versus Illicit Transactions

Tip 1 — Always eliminate legitimate sources first. If a question asks what the examiner must do before concluding that funds are from unknown or illicit sources, the answer involves identifying and ruling out legitimate sources (income, loans, gifts, inheritances, prior cash on hand, transfers between accounts). The exam heavily rewards this principle.

Tip 2 — Know what to remove from deposits. In bank deposits method questions, transfers between the subject's own accounts, redeposits, and loan proceeds are not income. If a question gives you total deposits and a list of items, subtract these before comparing to known income.

Tip 3 — Distinguish direct from indirect methods. Direct (specific items) proves individual illicit transactions with documents. Indirect methods (net worth, expenditures, bank deposits) infer unexplained funds in aggregate. If the scenario involves large cash dealings with no paper trail, think indirect. If the scenario includes a traceable check from a vendor into a personal account, think direct.

Tip 4 — Watch for the 'cash hoard' defense. A common exam scenario has the subject claim that unexplained funds came from cash saved over many years. The correct response is that the examiner should investigate and attempt to refute or confirm this claim (through prior tax returns, loan applications showing low assets, interviews, and lifestyle evidence), not simply accept or dismiss it.

Tip 5 — Structuring is illicit even with clean money. If a question describes deposits deliberately kept below the reporting threshold, recognize it as structuring, a reportable and illegal act regardless of the source of funds.

Tip 6 — Recognize red flags, but do not overreach. Questions may present a single unusual item and ask whether it proves fraud. The best answer is usually that it is an indicator requiring further investigation, not proof. Conversely, if a question lists several converging indicators with no plausible explanation, the appropriate conclusion is that the transactions are likely illicit and should be traced further.

Tip 7 — Loan and credit applications are gold. When asked for the best source to establish a subject's starting net worth or declared income, loan applications and financial statements the subject previously signed are frequently the correct choice.

Tip 8 — Deposit items, not deposit totals. If asked how to determine the source of a deposit, the answer is to obtain the deposited items (copies of checks, cash-in tickets), not merely the statement.

Tip 9 — Third-party corroboration. When a subject offers a legitimate explanation (a gift from a parent, a loan from a friend), the examiner should corroborate with the third party and with documentary evidence. Exam answers that rely solely on the subject's own statement are usually wrong.

Tip 10 — Read for the question's real target. Many items are really asking about one of four things: (1) what must be eliminated or established, (2) which method applies, (3) whether a described pattern is a red flag, or (4) what the next investigative step should be. Identify which type you are facing before choosing an answer, and prefer the choice that is methodical, document-based, and independently verifiable.

8. Quick Review Summary

- Legitimate: lawful source, genuine purpose, independently verifiable documentation.
- Illicit: unlawful source or deliberate concealment of source, ownership, or destination.
- Core discipline: build a financial profile, classify every inflow, eliminate transfers and legitimate sources, then apply a method of proof.
- Red flags: structuring, round amounts, pass-through activity, nominees and shells, lifestyle inconsistent with income, vendor payments to personal accounts.
- Indirect methods only work after legitimate sources, including the cash hoard claim, have been reasonably ruled out.
- Corroborate with third parties and documents; never rely on the subject's explanation alone.

Master these principles and you will be able to handle both straightforward recall questions and scenario-based items on legitimate versus illicit transactions with confidence.