Chapter 2 of 4 · 3 min

How AML rules detect unusual spending patterns, merchant collusion, and disproportionate fund flow

Learn how to design AML rules for unusual customer spending patterns, low buyer diversity in merchant accounts, and disproportionate credit-to-debit ratios.

TL;DW

Unusual spending rules compare account activity against customer profile attributes rather than static thresholds, making rule clusters more effective than single rules. Low buyer diversity targets merchant accounts where funds cycle between a limited group of counterparties, a hallmark of collusion. Disproportionate flow-through alerts when credit and debit totals are suspiciously close, which is unusual for most business account types.

Watch: 10 AML Rules that Every Transaction Monitoring Team Should Consider

▶ Watch this chapter on YouTube from 4:02

Lesson · 3 parts

Unusual spending pattern rules compare account activity against profile attributes specific to each customer: their reported income, occupation, and typical transaction history. A student generating large regular cash deposits, or a retiree suddenly making frequent international transfers, would both trigger this type of rule. Because no single pattern captures all variations, rule clusters that combine multiple behavioral signals typically outperform individual rules by a significant margin. The strength of each detection depends directly on the quality and completeness of the underlying customer profile data in your system.

On any platform where a seller typically receives payments from many buyers, an account that consistently receives payments from the same small group of counterparties presents a concentration risk. This rule is designed for merchant and marketplace accounts. It identifies when buyer diversity falls below a threshold appropriate for the platform type, which can indicate funds circulating within a controlled group. The diversity score should be calculated over a rolling window, not at a single point in time, to capture sustained patterns rather than temporary buyer concentrations.

A flow-through rule monitors the ratio between total incoming and total outgoing funds within a period. When a business account shows credit and debit totals that are almost equal, it suggests money is moving through rather than being retained for operations. The most relevant context is marketplaces and payment platforms that primarily collect customer payments, where a near-zero net balance across the full period has no obvious commercial explanation. For consumer accounts, a minimum net activity threshold prevents the rule from flagging legitimate shared household payment patterns that have a clear recurring purpose.

Study notes

Part 1 of 3 · 4:02 to 4:54

Rule 3: Unusual spending patterns

Concept An unusual spending rule requires you to define what is usual for each customer. That means your monitoring system needs a profile including income band, occupation category, and expected transaction behavior. The rule then compares observed transactions against that individual baseline. Without a meaningful profile, the rule reduces to a simple amount threshold, which is far less effective at identifying genuine anomalies and far more likely to generate noise.

Example A compliance team reviewing alerts may see a flagged account for a customer listed as a homemaker with a declared annual income of $28,000 who has received six deposits of $4,000 each over two months. No single transaction exceeds a reporting threshold. But the cumulative amount, combined with the customer profile, produces a strong anomaly signal that merits a suspicious activity review and possibly a SAR filing.

Try it Audit one occupation-based rule cluster in your current monitoring program. Identify which profile attributes it uses to define expected behavior, and check whether those attributes are actually populated in your customer data. Many institutions discover that profile fields are poorly maintained, which significantly reduces the effectiveness of behavior-based detection rules before they even run.

Part 2 of 3 · 4:54 to 6:08

Rule 4: Low buyer diversity in merchant accounts

Concept Collusion in payment networks often leaves a structural fingerprint: a small number of counterparties repeatedly transacting with each other. In a legitimate marketplace, a seller's buyer base should grow and diversify over time. When it does not, and when the same small group keeps sending funds, the pattern is consistent with circular fund movement rather than genuine commerce between independent parties.

Why it matters Financial institutions that operate payment platforms, including peer-to-peer services, gig economy apps, and e-commerce marketplaces, are particularly exposed to collusion-based laundering. The rule works by calculating a buyer diversity score for each active merchant account. Accounts consistently below the diversity threshold, after adjusting for legitimate factors such as niche markets or long-term repeat customers, should be escalated for a deeper review of the underlying business relationship.

Pitfall New merchants will naturally have low buyer diversity simply because they have not had time to build a customer base. Applying this rule without an account-age filter will generate high false positives against legitimate new sellers. Consider excluding accounts that are fewer than 90 days old, or applying a reduced sensitivity threshold during a defined ramp-up period, before the full detection logic activates.

Do this

Apply low buyer diversity rules only to accounts older than a defined threshold, such as 90 days, to reduce false positives from new merchant accounts.

Part 3 of 3 · 6:08 to 6:44

Rule 5: Disproportionate flow-through

Concept Flow-through becomes suspicious when there is no business rationale for almost all incoming funds leaving the account within the same period. For a payroll company or a pass-through entity, equal credits and debits might be structurally expected. For a marketplace seller or a merchant, retaining some funds for operations, supplier payments, or profit is the norm. Equal ratios without a corresponding business explanation suggest the account is being used as a conduit.

Example A business account receives $50,000 in customer payments over 30 days and then sends $49,800 to a single counterparty. The account retains almost nothing. Without a clear invoice trail, a supplier relationship, or a documented business purpose for the transfer, this pattern is consistent with an account used purely to move funds while creating a layer between the source and the ultimate recipient.

Key terms

Unusual spending pattern: A deviation from an account's expected transaction behavior based on profile attributes such as income, occupation, or historical activity.
Rule cluster: A group of related AML rules that each detect one component of a broader scheme, used together to increase detection precision and reduce false negatives.
Low buyer diversity: An AML flag for merchant accounts that receive payments from an unusually small number of buyers, consistent with fund circulation or collusion among a controlled group.
Flow-through: The proportion of incoming funds that passes through an account quickly rather than being retained for legitimate business purposes, suggesting the account is used as a conduit.

Key takeaways

Unusual spending rules are most powerful when tied to customer profile attributes like income level and occupation, not just absolute transaction amounts.
Low buyer diversity rules should exclude new merchants in a ramp-up period to avoid penalizing legitimate business growth.
Disproportionate flow-through is especially suspicious for business accounts that primarily collect payments, where high debit totals have no obvious commercial explanation.

Watch out

A single unusual spending rule is rarely sufficient. Criminals adapt. A cluster of rules that each target a different behavioral dimension provides more resilient coverage against evolving patterns.
Flow-through rules applied to individual consumer accounts need careful calibration. Some customers legitimately pass funds through an account to pay shared household bills or reimburse group expenses.

Check your understanding

Why does a single AML rule typically underperform a rule cluster for detecting unusual spending patterns?

A single rule targets one specific behavioral dimension, such as transaction amount, and cannot account for the full complexity of what constitutes unusual behavior for a given customer. A rule cluster combines multiple rules, each targeting a different attribute such as amount, frequency, counterparty type, or geographic pattern, and produces more actionable alerts when several signals are present simultaneously. This reduces false positives and improves investigator confidence in each alert.

What is the primary false positive risk of a low buyer diversity rule without an account-age filter?

High false positive rates against legitimate new merchants who have not yet built a broad customer base. Every merchant starts with a small number of buyers. Without a minimum account age or a ramp-up period threshold, the rule will flag new sellers who are behaving entirely normally, which wastes investigator time and can damage relationships with legitimate customers.

How AML rules detect unusual spending patterns, merchant collusion, and disproportionate fund flow

01 4:02 Concept Rule 3: Unusual spending patterns ▾

02 4:54 Concept Rule 4: Low buyer diversity in merchant accounts ▾

03 6:08 Note Rule 5: Disproportionate flow-through ▾