Your AML monitor flags a transaction pattern, a user has been receiving small inbound transfers from many unrelated parties and quickly forwarding to one external account. Classic mule / smurfing pattern. You file a Suspicious Activity Report (SAR) with the relevant FIU (NFIU in Nigeria, FinCEN in US, etc). The user's funds get FROZEN pending investigation, they can't withdraw, can't transfer, but they're still on your books as a liability you owe them. The freeze itself doesn't move money but it MUST be reflected in your ledger so the compliance team's view of 'frozen funds' matches the operational reality.