AML Red Flags: The Warning Signs Compliance Teams Watch For

Anti-money laundering, or AML, red flags are facts or patterns that may indicate money laundering, terrorist financing, fraud, sanctions evasion, or related financial crime. A red flag is not proof of wrongdoing. Legitimate customers can have unusual transactions, complex businesses, or privacy concerns. The question for a compliance team is whether the available explanation, evidence, and customer profile make the activity reasonable.

Financial institutions, payment firms, crypto-asset businesses, and other regulated companies use red flags to decide when to conduct further review. The appropriate response depends on the risk, the jurisdiction, the firm’s obligations, and the information already held. No list is exhaustive or legally definitive: criminals adapt, and regulators expect firms to identify risks relevant to their own products, customers, and markets.

What makes an AML red flag meaningful

A single signal may have an innocent explanation. Risk generally increases when several signals appear together, when the customer cannot provide a credible explanation, or when records contradict that explanation. A business that makes frequent international payments, for example, may be entirely normal. Concern rises if it has no apparent overseas operations, uses newly created counterparties, and cannot show contracts, invoices, or shipping records.

Teams should assess red flags in context. This includes the customer’s stated occupation or business, expected account activity, source of funds, source of wealth, geography, beneficial owners, and prior behavior. Source of funds means where the money used in a particular transaction came from. Source of wealth is the broader origin of a customer’s overall assets.

Customer and ownership red flags

Customer due diligence begins with knowing who is using a service and, for a legal entity, who ultimately owns or controls it. The ultimate beneficial owner is the natural person who ultimately owns or controls a company or arrangement, even if that control is exercised through other entities.

• A customer is reluctant to provide required identification, ownership information, or the purpose of an account, or supplies documents that appear altered, incomplete, or difficult to verify.
• Identity details are inconsistent across applications, public records, payment instructions, or supporting documents. Examples include conflicting addresses, dates of birth, business activities, or signatories.
• A company has an unusually complex or opaque ownership structure with no clear commercial rationale, including layers of entities in multiple jurisdictions or frequent unexplained ownership changes.
• The customer’s apparent wealth, transaction volume, or asset purchases do not align with known income, occupation, business revenues, or stated source of wealth.
• A customer uses intermediaries to avoid direct contact, resists ordinary due diligence questions, or appears unfamiliar with the business they supposedly own or manage.

Transaction red flags

Transaction monitoring looks for activity that is unusual for the customer or for the product involved. One common pattern is structuring, sometimes called smurfing: breaking a larger amount into smaller transactions to avoid reporting or recordkeeping thresholds. The concern is not simply that transactions fall below a threshold, but that the timing, values, and pattern suggest deliberate avoidance.

• Funds enter an account and leave quickly, with little commercial purpose or retained balance. This can indicate layering, the movement of money through transactions to obscure its origin.
• Money moves out and returns to the same customer, business group, or apparent source through one or more intermediaries. This round-tripping can create a misleading appearance of legitimate revenue, investment, or trade.
• Payments involve jurisdictions associated with elevated money laundering, terrorist financing, corruption, or sanctions risk, without a clear link to the customer’s business. Geography alone is not proof of risk.
• Activity is inconsistent with the customer profile, such as a dormant company receiving high-value payments, a consumer account processing business-like volumes, or a local retailer sending recurring transfers abroad.
• Multiple accounts make payments to the same beneficiary, or a customer rapidly opens, funds, and closes accounts without a clear operational reason.

Business and trade red flags

Trade-based money laundering uses commercial transactions to move value or disguise illicit proceeds. Review often focuses on whether payment records, contracts, invoices, shipping documents, and the underlying goods or services tell a coherent story. Price differences alone are not conclusive, since markets and logistics can vary, but they may warrant questions.

• Invoices, quantities, descriptions, or prices do not match the goods shipped, services delivered, contract terms, or market conditions.
• A counterparty appears to be a shell company, meaning an entity with little evident operational activity, staff, physical presence, or business purpose beyond holding or moving funds.
• Payments are made by or to unrelated third parties without a documented commercial rationale, especially where the invoiced buyer or seller is not the payer or recipient.
• Goods are shipped through unusual routes, repeatedly resold, or described in vague terms that make their value hard to assess.

What compliance teams should do next

A red flag should lead to a proportionate, timely review rather than an automatic account closure or accusation. Teams may seek clarification from the customer, verify documents independently, review beneficial ownership, examine related accounts and transactions, and compare activity with the expected customer profile. They should also screen relevant parties against applicable sanctions and politically exposed person lists. A politically exposed person, or PEP, is an individual entrusted with a prominent public function and may require enhanced scrutiny because of corruption risk.

The review should be documented clearly: what triggered it, what information was obtained, how it was assessed, and why the firm decided to continue, restrict, exit, or escalate the relationship. Where suspicion remains, regulated firms may need to file a suspicious activity report, or SAR, with the relevant authority. In the European Union and many other jurisdictions, the equivalent report is commonly called a suspicious transaction report, or STR, and is generally filed with the national financial intelligence unit.

Firms must follow local rules on timing, confidentiality, and customer communications. In particular, staff should not disclose that a SAR or STR has been filed, or may be filed, where doing so would amount to unlawful tipping off. Effective AML controls combine trained judgment, reliable records, and escalation processes that distinguish unusual activity from genuinely suspicious conduct.