Money Laundering Red Flags

AML suspicious activity

This post has already been read 5204 times!

Money Laundering Red Flags
Money Laundering Red Flags


The following are examples of potentially suspicious activities, or “red flags” for both money laundering and terrorist financing. Although these lists are not all-inclusive, they may help banks and examiners recognize possible money laundering and terrorist financing schemes.

In order to assist law enforcement in its efforts to target these activities, FinCEN requests that banks check the appropriate box(es) in the Suspicious Activity Information section and include certain key terms in the narrative section of the SAR.


The advisories and guidance can be found on FinCEN’s website. Management’s primary focus should be on reporting suspicious activities, rather than on determining whether the transactions are in fact linked to money laundering, terrorist financing, or a particular crime.

The following examples are red flags that, when encountered, may warrant additional scrutiny. The mere presence of a red flag is not by itself evidence of criminal activity.

Jump to specific red flag sections

Funds Transfers

Clearing House Transactions

Inconsistent Business Activities

Trade Finance,

Private ATMs,


Shell Companies,

Embassy accounts,

Employee suspicions,

Other customer suspicions,

Terrorist Financing.

Potentially Suspicious Activity That May Indicate Money Laundering

AML suspicious activity
AML suspicious activity
  • Customers Who Provide Insufficient or Suspicious Information
  • A customer uses unusual or suspicious identification documents that cannot be readily verified.
  • A customer provides an individual taxpayer identification number after having previously used a Social Security number.
  • A customer uses different taxpayer identification numbers with variations of his or her name.

Contact us to help train your AML team.

  • A business is reluctant, when establishing a new account, to provide complete information about the nature and purpose of its business, anticipated account activity, prior banking relationships, the names of its officers and directors, or information on its business location.
AML landline
  • A customer’s home or business telephone is disconnected.
  • The customer’s background differs from that which would be expected on the basis of his or her business activities.
  • A customer makes frequent or large transactions and has no record of past or present employment experience.
  • A customer is a trust, shell company, or Private Investment Company that is reluctant to provide information on controlling parties and underlying beneficiaries. Beneficial owners may hire nominee incorporation services to establish shell companies and open bank accounts for those shell companies while shielding the owner’s identity.

Improve your record keeping and audit process. Talk to us.

  • Efforts to Avoid Reporting or Recordkeeping Requirement
AML Report filing
AML Report filing
  • A customer or group tries to persuade a bank employee not to file required reports or maintain required records.
  • A customer is reluctant to provide information needed to file a mandatory report, to have the report filed, or to proceed with a transaction after being informed that the report must be filed.
  • A customer is reluctant to furnish identification when purchasing negotiable instruments in recordable amounts.
  • A business or customer asks to be exempted from reporting or recordkeeping requirements.
  • A person customarily uses the automated teller machine to make several bank deposits below a specified threshold.
Cash Deposits
Cash Deposits
  • A customer deposits funds into several accounts, usually in amounts of less than $3,000, which are subsequently consolidated into a master account and transferred outside of the country, particularly to or through a location of specific concern (e.g., countries designated by national authorities and Financial Action Task Force on Money Laundering (FATF) as noncooperative countries and territories).
  • A customer accesses a safe deposit box after completing a transaction involving a large withdrawal of currency, or accesses a safe deposit box before making currency deposits structured at or just under $10,000, to evade CTR filing requirements.

Funds Transfers

Go to top

  • Many funds transfers are sent in large, round dollar, hundred dollar, or thousand dollar amounts.
AML funds transfers
Funds transfers
  • Funds transfer activity occurs to or from a financial secrecy haven, or to or from a higher-risk geographic location without an apparent business reason or when the activity is inconsistent with the customer’s business or history.
  • Funds transfer activity occurs to or from a financial institution located in a higher risk jurisdiction distant from the customer’s operations.
  • Many small, incoming transfers of funds are received, or deposits are made using checks and money orders. Almost immediately, all or most of the transfers or deposits are wired to another city or country in a manner inconsistent with the customer’s business or history.

Help to Identity suspicious actions and what to do about them.

  • Large, incoming funds transfers are received on behalf of a foreign client, with little or no explicit reason.
  • Funds transfer activity is unexplained, repetitive, or shows unusual patterns.
Unusual activity
Unusual activity
  • Payments or receipts with no apparent links to legitimate contracts, goods, or services are received.
  • Funds transfers are sent or received from the same person to or from different accounts.
  • Funds transfers contain limited content and lack related party information.

Automated Clearing House Transactions

Go to top

  • Large-value, automated clearing house (ACH) transactions are frequently initiated through third-party service providers (TPSP) by originators that are not bank customers and for which the bank has no or insufficient due diligence.
Third Party
Third Party
  • TPSPs have a history of violating ACH network rules or generating illegal transactions, or processing manipulated or fraudulent transactions on behalf of their customers.
  • Multiple layers of TPSPs that appear to be unnecessarily involved in transactions.
  • Unusually high level of transactions initiated over the Internet or by telephone.
  • NACHA — The Electronic Payments Association (NACHA) information requests indicate potential concerns with the bank’s usage of the ACH system.

Activity Inconsistent with the Customer’s Business

Go to top

  • The currency transaction patterns of a business show a sudden change inconsistent with normal activities.
Odd ATM behaviour
Odd ATM behaviour
  • A large volume of cashier’s checks, money orders, or funds transfers is deposited into, or purchased through, an account when the nature of the accountholder’s business would not appear to justify such activity.
  • A retail business has dramatically different patterns of currency deposits from similar businesses in the same general location.
  • Unusual transfers of funds occur among related accounts or among accounts that involve the same or related principals.
  • The owner of both a retail business and a check-cashing service does not ask for currency when depositing checks, possibly indicating the availability of another source of currency.
  • Goods or services purchased by the business do not match the customer’s stated line of business.
  • Payments for goods or services are made by checks, money orders, or bank drafts not drawn from the account of the entity that made the purchase.

Go to part two for red flags with Trade Finance, Private ATMs, Insurance, Shell Companies, Embassy accounts, Employee suspicions, other customer suspicions, Terrorist Financing.

Go to top

Register for our newsletter today


Register for our newsletter today