Skip to content

Chapter 3 of 3 · 3 min · 1 copyable asset

What do client non-cooperation, large wire transfers, and threshold structuring reveal?

Learn how client non-cooperation, large wire transfers, and threshold structuring reveal money laundering risk, and how to separate signal from noise.

TL;DW

The final three red flags: a customer's reluctance to cooperate treated as a standalone signal, wire transfers judged by pattern and counterparty rationale rather than size, and threshold structuring detected by aggregating transactions over time rather than reviewing them individually.

TRANSACTION MONITORING

10 AML Red Flags Every Investigator Should Know

3 chapters · 9 min · Beginner · Certificate

Lesson · 3 parts

Treat a customer's unwillingness to explain their commercial activity or where their money originates as a red flag in its own right, separate from whatever underlying activity first prompted the request. Hesitation, evasive answers, or an outright refusal to hand over documentation is a meaningful signal of risk on its own, even before you know what the customer might be avoiding. Log every instance of this kind of stonewalling carefully, and consider escalating relationships where openness remains persistently absent despite repeated, clearly worded requests.

Frequent international wire transfers, especially to parties with no clear relationship to the customer, can indicate money laundering, fraud, or other financial crime. Plenty of international wire activity is entirely legitimate, particularly when it aligns with the customer's declared profile and business purpose, so size alone should never be the trigger for suspicion. Focus your attention on patterns or inconsistencies instead: unexplained connections to high-risk jurisdictions, or transfers that lack any clear business rationale linking the sender and the recipient together.

Watch for customers structuring transactions to sit just below a reporting limit, for example a string of 9,999-dollar transfers instead of a single 10,000-dollar one. This pattern often signals a deliberate attempt to evade reporting requirements rather than an innocent coincidence of round numbers. Transaction monitoring systems should be configured to catch this behavior even across multiple transactions over time, flagging customers who consistently stay just under monthly limits through several structured transfers. Given how many false positives these systems generate, investigative judgment is still what ultimately separates genuine red flags from ordinary background noise.

Non-cooperation and structuring review checklist

  • How many requests has the customer been evasive on, and over what time period
  • Is wire activity consistent with the customer's declared business and counterparties
  • Are transfer amounts clustering just under a reporting threshold
  • Have related transactions been aggregated across days or weeks, not reviewed in isolation
  • Is the alert a known false-positive pattern for this customer type
  • Decision: close with rationale, request more information, or escalate

Key terms

Non-cooperation
A customer's reluctance or refusal to provide requested information or documentation, treated as an independent AML red flag.
Wire transfer
An electronic transfer of funds between banks or financial institutions, often used in cross-border transactions and a common vehicle for AML red flags when patterns are unexplained.
Threshold structuring
Deliberately keeping individual transactions just under a reporting threshold, such as $9,999 instead of $10,000, to avoid triggering mandatory reporting.
SAR (Suspicious Activity Report)
A formal report filed with a financial intelligence unit when an institution suspects a transaction or relationship is linked to money laundering or other financial crime.

Key takeaways

  1. A customer's reluctance to provide information is a red flag on its own, independent of the activity that prompted the request.
  2. Wire transfer red flags depend on pattern and counterparty rationale, not on transaction size alone.
  3. Structuring near a reporting threshold requires monitoring that aggregates transactions over time, not just single transactions.

Watch out

  • Threshold-based monitoring rules generate a high volume of false positives; investigative judgment is what separates genuine structuring from coincidence.

Check your understanding

A customer sends six transfers of 9,900 dollars each to the same recipient over three weeks, each falling just under a 10,000 dollar reporting threshold. What should an investigator do?

This pattern is consistent with threshold structuring: breaking a larger sum into amounts that individually avoid triggering mandatory reporting. The investigator should aggregate the related transfers, assess whether they collectively match the customer's profile, and escalate if there is no credible explanation for the pattern.