AML red flags are the early warning signals that something in a customer relationship or transaction pattern deserves a second look. They surface as unusual transaction activity, suspicious customer behavior, or inconsistencies in the documentation a customer provides. Spotting them is not about mechanically ticking a compliance box: it is the frontline work that protects your institution and the wider financial system from being used to move illicit funds. The ten patterns that follow are the ones experienced investigators return to again and again.
Chapter 1 of 3 · 4 min · 1 copyable asset
What are the most common transaction-based AML red flags?
Learn to spot round-dollar transactions, high-cash activity, rapid fund movement, and mismatched customer profiles as core AML red flags.
TL;DW
Four transaction-level red flags open the list: round-dollar amounts near reporting thresholds, frequent high-cash activity inconsistent with a customer's business, rapid in-and-out fund movement suggesting layering, and transactions that do not match the customer's declared occupation or purpose.
TRANSACTION MONITORING
10 AML Red Flags Every Investigator Should Know
Watch for transactions that consistently land on suspiciously even amounts, five thousand dollars, ten thousand dollars, rather than the irregular figures you would expect from ordinary commercial activity. Round, repeated amounts can indicate structuring: a deliberate attempt to keep individual transactions below a reporting or scrutiny threshold. Transaction monitoring systems are generally good at flagging this pattern automatically, since it is a numeric anomaly, but it is the investigator's job to confirm whether the roundness reflects genuine business practice or deliberate evasion.
Look closely at customers depositing or withdrawing large amounts of cash on a frequent basis. Cash remains one of the hardest mediums to monitor because it is anonymous and difficult to trace back to its origin. Frequent, high-cash activity is not automatically suspicious, but it becomes a genuine red flag when the volume or frequency is inconsistent with what you would expect from the customer's stated profile or the nature of their declared business.
Look for accounts where money arrives and leaves again almost immediately, often moving on to unrelated or short-lived accounts. Picture a bucket with a hole in the bottom: funds barely settle before draining away toward destinations with no clear business purpose. This rapid pass-through pattern is one of the strongest signatures of layering, the stage of money laundering where launderers deliberately create distance between illicit funds and their original criminal source.
Compare the customer's transactions against their stated occupation, income, or declared business purpose from onboarding. A retiree suddenly transferring millions of dollars overseas is a glaring inconsistency that should immediately raise questions about the true source and purpose of the funds. Digging into these mismatches often surfaces patterns that would otherwise go unnoticed, and connecting them early can be the difference between catching a financial crime and missing it.
Transaction red flag triage checklist
- Are amounts suspiciously round or repeated near a reporting threshold
- Is cash volume consistent with the customer's declared business type
- Do funds pass through the account quickly to unrelated destinations
- Does the transaction pattern match the customer's declared occupation and income
- Is there a documented, plausible business rationale on file for each anomaly
- Decision: monitor, request explanation, or escalate
Key terms
- Structuring
- Deliberately breaking transactions into smaller amounts, or keeping them just under a reporting threshold, to avoid triggering regulatory scrutiny.
- Layering
- The stage of money laundering where illicit funds are moved through multiple accounts or entities to obscure their criminal origin.
- Transaction monitoring system
- Software that screens customer transactions against rules or behavioral models to flag activity that may indicate financial crime.
- KYC profile
- The documented picture of a customer's occupation, income, and expected activity, established during onboarding and used as a baseline for future comparison.
Key takeaways
- Red flags earn a closer look, they do not on their own prove money laundering.
- Round, repeated transaction amounts near a reporting threshold can signal deliberate structuring.
- Rapid in-and-out fund movement to unrelated accounts is a classic signature of layering.
- A customer's transaction pattern should always be checked against their declared occupation and business purpose.
Watch out
- Rapid fund movement is only a red flag when combined with an unrelated destination and no clear business purpose; some legitimate businesses pass funds through quickly as normal practice.
Check your understanding
A retired customer with a modest declared pension begins sending six-figure international wire transfers with no explanation on file. Which red flag does this illustrate, and what should the investigator do?
This is a mismatched customer profile: the transaction activity is inconsistent with the customer's declared occupation and income. The investigator should request documentation or an explanation for the source and purpose of the funds and escalate if no credible explanation is provided.
Unlocks when you finish the chapter.