Red Flags for Money Laundering: 15 Warning Signs Every Banker Should Know
5/7/2026
Red flag lists are easy to publish and hard to use. Most of them name an indicator, offer no context, and leave the reader unable to tell the difference between a genuinely suspicious pattern and a customer having an unusual week.
This list is organized differently. For each flag: what it actually looks like, why launderers do it, and what a banker should do. Nothing here is a rule — every one of these has innocent explanations, and the skill is in the follow-up, not the spotting.
Customer Behavior
1. Reluctance to provide identification or information
The customer resists standard onboarding questions, becomes irritated by requests for identification, or asks whether the information is really required.
Why it matters: Anonymity is the objective of nearly every laundering scheme. Someone who does not want to be identifiable at account opening is telling you something.
What to do: Follow CIP procedures without exception, note the interaction, and escalate if identification cannot be completed. A refusal at the point of a reportable transaction is itself escalation-worthy.
2. Unusual knowledge of reporting thresholds
The customer asks what amount triggers a report, or asks whether a transaction "has to be reported," and then adjusts the amount downward.
Why it matters: This is the clearest behavioral indicator of structuring intent. Ordinary customers rarely know the threshold and almost never restructure a transaction on learning it.
What to do: Answer factually if asked — the requirement is public — but never advise on how to avoid it. Complete the transaction as presented and escalate immediately.
3. A third party directing the transaction
The accountholder is present but another person is answering questions, providing amounts, or handling the funds. Or the accountholder appears coached, confused, or nervous.
Why it matters: Funnel accounts, money mules, and elder financial exploitation all present this way. The person on the account may not be the person in control of the money.
What to do: Where safe, separate the parties and speak with the accountholder alone. Document the interaction. Consider both a SAR and, for a vulnerable adult, any applicable reporting obligation.
Transaction Patterns
4. Structuring
Multiple currency transactions just below $10,000, across days, branches, or accounts — often in round amounts like $9,000 or $9,500.
Why it matters: It is a federal crime independent of the source of funds, and it is the single most commonly reported pattern.
What to do: File the CTR if aggregation requires it, and file a SAR on the structuring itself. Never coach the customer.
5. Activity inconsistent with the stated business
A landscaping company depositing $60,000 a week in currency through the winter. A consultancy receiving dozens of small inbound wires from unrelated individuals.
Why it matters: The mismatch between the profile and the activity is the core of nearly all monitoring. It is only visible if the profile was captured properly at onboarding.
What to do: Compare against the expected activity recorded at account opening, ask ordinary relationship questions, and escalate if the explanation does not account for the pattern.
6. Rapid movement of funds — in and straight out
Deposits followed within hours or days by withdrawals or wires of substantially the same amount, leaving little balance behind.
Why it matters: This is the layering stage. The account is being used as a conduit, not as a place to hold money, and the near-zero average balance is the tell.
What to do: Look at balance behavior over time rather than at individual transactions. Conduit accounts look unremarkable transaction by transaction.
7. Funnel account activity
Cash deposited into one account at multiple branches, often in different cities or states, and withdrawn in a single location.
Why it matters: It moves value geographically without moving currency, and it is heavily associated with narcotics and human trafficking proceeds.
What to do: Cross-branch aggregation reporting is what surfaces this. If your monitoring is branch-scoped, you will not see it.
8. Round-number and repetitive transactions
A steady stream of transactions in identical or suspiciously tidy amounts, with no relationship to any commercial cycle.
Why it matters: Real commerce is messy. Invoices have odd cents; payroll varies; sales fluctuate seasonally. Uniformity suggests the amounts are being generated rather than earned.
9. Transactions with no apparent business purpose
Payments between related entities with no visible commercial relationship, loans that are repaid immediately in cash, or purchases of monetary instruments with no explanation.
Why it matters: The statutory SAR standard explicitly includes transactions with no business or apparent lawful purpose after examining the available facts.
Products and Instruments
10. Cash purchases of monetary instruments
Cashier's checks, money orders, or traveler's checks bought with currency, particularly in amounts below recordkeeping thresholds or by non-customers.
Why it matters: It converts currency into a negotiable instrument that moves more easily and attracts less attention downstream.
What to do: Maintain the monetary instrument log accurately. The log is a recordkeeping requirement and a monitoring input.
11. Wire activity to or from higher-risk jurisdictions
Wires to countries subject to sanctions, identified as higher risk, or with no evident connection to the customer's business or family.
Why it matters: Cross-border movement adds jurisdictional opacity, and some corridors carry specific typologies.
What to do: Screening catches sanctioned parties; it does not assess business rationale. That judgment is the analyst's.
12. Sudden use of dormant accounts
An account inactive for a long period suddenly receiving significant deposits or wires.
Why it matters: Dormant accounts are attractive to takeover schemes and to launderers seeking an account with history.
What to do: Verify that the accountholder actually initiated the activity, using an independently verified contact method rather than one recently changed.
13. Cash-intensive businesses with implausible economics
A business whose currency deposits do not square with its size, staffing, location, or hours — an eight-seat restaurant depositing what a large one would.
Why it matters: Commingling illicit proceeds with legitimate revenue is the classic placement technique, and cash-intensive businesses are the vehicle.
What to do: These customers are legitimate and bankable; they simply require enhanced due diligence, documented expectations, and monitoring calibrated to them.
Structural and Relationship Indicators
14. Complex or opaque ownership
Layered entities, nominee officers, frequent ownership changes, or entities registered in jurisdictions with strong secrecy protections and no operational connection to the business.
Why it matters: Complexity that serves no tax, liability, or operational purpose usually serves concealment.
What to do: Work the beneficial ownership chain rather than accepting the first layer. Structures that resist explanation are themselves the finding.
15. Negative news or law enforcement interest
Adverse media on the customer or its principals, a 314(a) match, a subpoena, or a law enforcement inquiry.
Why it matters: External information changes the risk profile, and the institution is expected to act on what it learns.
What to do: Re-rate the customer, review historical activity with the new information in hand, and remember that a 314(a) match does not itself require a SAR — but it should prompt a review that may lead to one.
How to Use a List Like This
Three cautions.
No single flag proves anything. Nearly every indicator here has ordinary explanations. A business genuinely does deposit more in season; a customer genuinely does receive an inheritance. Suspicion comes from combinations and from activity that resists explanation.
Document the resolution either way. An investigation that concludes with a legitimate explanation is a good outcome — provided the file records what was reviewed and why the conclusion was reached.
Escalate rather than adjudicate. Front-line staff are not expected to decide whether to file. They are expected to notice and report internally. A program where tellers decide what is worth mentioning has already failed.
Role-specific training is what turns a list into judgment. Our AML compliance training covers typologies by function, and BSA training covers the reporting mechanics that follow.
Building Red Flags Into the Program
A list on an intranet page changes nothing. Red flags produce results only when they are embedded in three specific places, and the difference between institutions that detect activity and institutions that do not is almost entirely about this embedding rather than about the quality of anyone's list.
In the monitoring rules. Every flag that can be expressed as a data pattern should be. Structuring, funnel activity, rapid in-and-out movement, dormant account reactivation, and round-number repetition are all detectable by rule. The tuning question is where the thresholds sit, and the answer should come from the institution's own data — running the proposed rule against twelve months of history and looking at what it would have generated — rather than from vendor defaults. A rule producing 400 alerts a month at an institution with two analysts is a rule that will be cleared mechanically.
In role-specific training. Behavioral flags cannot be detected by systems at all. Reluctance to provide identification, third-party direction, apparent coaching, and threshold questions are observable only by a person, and only by a person who has been told what to watch for and given a frictionless way to report it. The referral mechanism matters as much as the training: if reporting a concern requires filling out a form and explaining oneself to a supervisor, front-line referrals will approach zero.
In the periodic review process. Some flags emerge only over time — a customer whose activity has drifted steadily from its profile, or an ownership structure that has become more complex across successive updates. Periodic review is where these surface, provided the reviewer is comparing against the original expectation rather than against last quarter.
Finally, treat your own filing history as a source. The typologies that actually appear at your institution — visible in prior SARs, in law enforcement inquiries, and in 314(a) matches — are better predictors of what you will see next than any generic list. Reviewing filed SARs annually for recurring patterns, and feeding those patterns back into rules and training, is the single most effective way to make detection specific to the institution rather than generic to the industry.
One last framing worth giving to new staff. The purpose of noticing a red flag is not to catch a criminal — it is to create a record. Most flagged activity turns out to be explicable, a meaningful share is never resolved either way, and the institution rarely learns what happened next. That can feel unsatisfying, and it leads some staff to stop reporting things they cannot prove. The correct standard is far lower than proof: notice, escalate, and let the process do the rest.
Frequently Asked Questions
What is the most common money laundering red flag in retail banking?
Structuring — currency transactions arranged to stay below the $10,000 reporting threshold. It is common because it is simple, and it is detectable because it produces a statistical pattern that ordinary activity does not: repeated amounts clustered just under a round number.
Does one red flag mean I have to file a SAR?
No. A red flag is a prompt to investigate, not a conclusion. The filing standard is knowing, suspecting, or having reason to suspect after examining the available facts. Many flagged transactions resolve with a legitimate explanation, and documenting that resolution is part of a functioning program.
What should a teller do when they notice a red flag?
Complete the transaction as presented if it is lawful, avoid alerting the customer, and escalate internally through the institution's referral procedure. Tellers should never confront a customer, never advise on avoiding reporting, and never decide independently whether the activity warrants a report.
Are cash-intensive businesses automatically suspicious?
No. Restaurants, car washes, convenience stores, and similar businesses are legitimate customers whose activity is genuinely cash-heavy. They warrant enhanced due diligence, a documented expectation of normal volume, and monitoring calibrated accordingly — not exclusion.
What is a funnel account?
An account that receives cash deposits in multiple geographic locations, frequently below reporting thresholds, with funds withdrawn in a different location. It moves value across distance without physically transporting currency, and it is strongly associated with narcotics trafficking and human trafficking proceeds.
How do we avoid alerting a customer during an investigation?
Limit knowledge of the investigation to those with a need to know, restrict customer contact to ordinary account servicing questions routed through a defined process, and never reference the review or a potential filing in any customer communication. Disclosing the existence of a SAR is prohibited by statute.
