Shadow money flows in the current international geopolitical situation cause enormous damage to the economies of developed countries. It is impossible not to take into account the negative aspect of the existence of money masses in shadow, including criminal structures. In this regard, the issue of methodological security of the economic system of our country remains relevant. In Russia, there is a generally accepted risk-based AML / CFT system implemented by Rosfinmonitoring services in cooperation with law enforcement agencies. But as law enforcement practice shows, causing significant damage when committing fraudulent actions continues to be the norm for the criminal community. As a result, for example, significant cash flows appear in the compositions of cybercrimes, which make it possible to extract illegal economic benefits, until the state regulatory authorities become aware of the facts of shadow enrichment of interest. In addition, there is a discrepancy between the methods of preliminary monitoring of possible cash flow, in order to prevent it, and the methods of retrospective monitoring, the main purpose of which is not to prevent, but to identify the entire chain of shadow business entities, in order to stop their illegal activities as a whole, and not for a separate transaction or a group of interrelated banking operations. The article presents a methodology for monitoring the shadow cash flow, based on the scientific provisions of the theoretical and methodological approach, the key task of which is to improve the quality of assessment of the state of economic security of Russia. By illustrating the sequential steps of monitoring on the example of a specific case, the author’s research results are systematized and the most pronounced aspects of monitoring the shadow cash flow are identified.