Suspicious Activity Indicator

A suspicious activity indicator, commonly called a red flag, is a characteristic of a customer, transaction or pattern of behaviour that may point to money laundering, terrorist financing, fraud, sanctions evasion or another financial crime. Examples include cash deposits kept just below a reporting threshold, money that arrives and leaves an account almost at once, and payments that make no sense for the customer's stated business. An indicator is a reason to look more closely, not proof that a crime has occurred.

Indicators are published by the FATF, national financial intelligence units, supervisors and industry groups, and they underpin both automated monitoring and staff judgement. They are the building blocks of a transaction monitoring scenario, which turns one or more indicators into a rule, and of unusual activity detection more broadly.

A doctor does not diagnose an illness from one symptom. A cough might be a cold, an allergy or something serious. But a cough together with a fever and weight loss is a reason to run tests. Each symptom is a hint, and several hints together build a picture.

Suspicious activity indicators are the symptoms of financial crime. One unusual payment may have an innocent explanation. Several warning signs together, such as a new account, large cash deposits, immediate transfers abroad and a customer who avoids questions, make it more likely that something is wrong, and staff are expected to dig deeper and, if needed, report it.

• Customer behaviour. Reluctance to provide information, inconsistent explanations, unusual concern about reporting rules, or use of many accounts or third parties without reason.
• Transaction patterns. Structuring of cash below thresholds, rapid pass-through of funds, round-figure transfers, or activity far above the expected level for the account.
• Movement of funds. Complex chains of transfers between accounts or companies with no business purpose, as described under layering indicators.
• Geography. Links to high-risk or sanctioned jurisdictions, captured by geographic risk indicators.
• Account use. Many unrelated people paying into one account, a sign of a money mule network, or accounts opened and quickly emptied.
• Trade and business. Over- or under-invoicing, goods that do not match the customer's trade and other signs of trade-based money laundering.

The FATF publishes typology and risk reports listing indicators for topics such as terrorist financing, professional money laundering and virtual assets. FIUs issue their own: FinCEN, for example, publishes advisories and alerts with red flags on topics from human trafficking to sanctions evasion, and asks institutions to use specified key terms in their reports when relevant. Supervisors and industry bodies such as the Wolfsberg Group add sector-specific guidance, and firms develop their own indicators from past cases and the risks identified in their business-wide risk assessments. Fraud teams maintain parallel lists, often organised by fraud typology. Public-private partnerships, such as the United Kingdom's Joint Money Laundering Intelligence Taskforce set up in 2015, let banks and law enforcement develop indicators together for specific threats, which tends to make them more precise than general lists. Indicators drawn from real cases are generally more useful than generic ones, because they describe how a particular scheme actually moved money through accounts.

Indicators serve several purposes inside a compliance programme. They are coded into monitoring rules and models, built into onboarding checks and taught to front-line staff so that they recognise warning signs in person or on the phone. When an alert is raised, investigators assess which indicators are present, gather context, and record their alert disposition. If the explanation is not satisfactory, the case is escalated and may lead to a suspicious activity report, in which the indicators observed help explain the grounds for suspicion. Some jurisdictions also use an unusual activity report for activity that departs from the norm without a formed suspicion.

Because indicators describe behaviour that also has innocent causes, using them mechanically produces many false positives and can lead firms to treat ordinary customers, such as small cash businesses or migrants sending money home, as suspicious. Criminals also learn published indicators and adapt. Effective use therefore depends on context, on combining indicators rather than relying on one, and on regularly updating lists as typologies change. Staff must also avoid revealing their concerns to the customer under the anti-tipping-off rule.