A red flag is an indicator that activity might be suspicious. It is a reason to look closer — not a conclusion.

That distinction matters more than any list. A single red flag usually has an innocent explanation. It is several together, or one the customer cannot explain, that builds genuine suspicion.

Here are the patterns analysts are actually trained to spot, grouped by type.

Cash-related red flags

Cash remains attractive to criminals because it carries no transaction history.

  • Cash deposits inconsistent with the customer's stated income or business
  • Frequent deposits in round-figure amounts
  • Deposits made across multiple branches or ATMs on the same day
  • Cash deposits immediately followed by wire transfers out
  • A customer asking about reporting thresholds before transacting
  • Deposits by third parties into an individual's account

That last one is worth pausing on. Someone else regularly paying money into an account raises the obvious question of whose money it actually is.

Structuring

Structuring — sometimes called smurfing — is deliberately breaking a large amount into smaller transactions to stay below a reporting threshold.

Indicators:

  • Several transactions just below the threshold within a short window
  • Consistent amounts that sit suspiciously close to the limit
  • The same person depositing at different branches on the same day
  • Multiple individuals depositing into one account in similar amounts

The giveaway is not any single transaction — each looks ordinary. It is the consistency of amounts falling just below the limit.

Velocity and flow-through

How quickly money moves is often more revealing than how much.

  • Funds arriving and leaving almost immediately
  • High account turnover with a persistently low balance
  • Incoming funds from many unrelated sources, then a single large outflow
  • Transfers between accounts with no apparent commercial purpose

Accounts showing this pattern are often called funnel or pass-through accounts. The account is being used as a conduit rather than for genuine banking.

Behavioural changes

Monitoring compares a customer against their own history, so departures matter.

  • Sudden activity on a long-dormant account
  • A significant change in transaction size or frequency with no explanation
  • New counterparties or countries appearing abruptly
  • A change of address or contact details shortly before unusual activity
  • Business activity that no longer matches what was declared at onboarding

Dormant accounts deserve particular attention. They are attractive precisely because they have an established history and may attract less scrutiny.

Geographic red flags

  • Transfers to or from high-risk jurisdictions with no business rationale
  • Payments routed through countries unconnected to either party
  • Activity involving jurisdictions on FATF's increased-monitoring list
  • Transactions with secrecy jurisdictions where the customer has no operations

The phrase that matters is no business rationale. Trading with a high-risk country is not inherently suspicious if the customer genuinely trades there. It becomes a flag when there is no reason for the connection to exist.

Customer behaviour

Some of the strongest indicators are not in the data at all.

  • Reluctance to explain the purpose of a transaction
  • Refusal to provide requested documentation
  • Providing information that turns out to be false or inconsistent
  • Unusual concern about reporting requirements or record keeping
  • Pressure on staff to process something quickly or bypass a step
  • A customer who appears to be acting on someone else's instructions

Trade-related red flags

Trade moves value without moving cash, which makes it attractive for laundering.

  • Invoice values that do not match market prices for the goods
  • The same shipment invoiced more than once
  • Goods descriptions that are vague or generic
  • Payment from a third party unrelated to the trade
  • Shipping routes that make no commercial sense
  • Goods that do not match the business the customer claims to operate

Terrorist financing indicators

Terrorist financing often looks different from money laundering, because the amounts can be small and the funds may come from legitimate sources.

  • Small, frequent transfers to individuals in or near conflict zones
  • Funds collected from many small donors then consolidated
  • Activity through non-profit organisations without a clear charitable purpose
  • Transactions where the destination rather than the source is the concern

What to do when you see one

Spotting a red flag is the beginning of the work, not the end.

Do not jump to a conclusion. Assume there may be a legitimate explanation and look for it.

Check the profile first. Is this genuinely inconsistent with what you know about the customer, or does it only look unusual because the file is out of date?

Look at the whole picture. One flag with a plausible explanation is usually fine. Three flags together is a different matter.

Seek information through the proper channel. That might mean internal records, public sources, or a question to the relationship manager — never a direct hint to the customer.

Document everything, including your reasoning if you close the case. A well-reasoned closure that is fully documented is defensible. A correct decision with no explanation is not.

Escalate if it remains unexplained. The standard is reasonable suspicion, not proof.

The mistake to avoid

The most common error among new analysts is treating red flags as a checklist and closing anything that does not match an item on it.

Red flags are prompts for thinking, not substitutes for it. The question is always the same: does this activity make sense for this customer? If you cannot answer yes with evidence, you have something worth escalating — whether or not it appears on any list.