Red flags: what reviewers actually look for
214 indicators drawn from the 35 techniques in the catalog, grouped by the channel the money moves through. Each one links back to the page that explains the mechanism and cites its sources.
A red flag is not evidence. It is a feature that is ordinary in laundering and unusual in legitimate business, which makes it a reason to look closer. Taken alone, almost every indicator below has an innocent explanation: cash-intensive businesses really do deposit cash, and exporters really do round their invoices. What moves a file from routine to reviewed is clustering, several unrelated indicators appearing in the same customer at once, and persistence, the same pattern holding for months.
These are published so that the people now required to notice them can recognise what they are seeing. Since Australia's regime expanded in July 2026, and under equivalent rules elsewhere, estate agents, accountants, lawyers and dealers in precious metals carry reporting duties that used to sit only with banks. The obligation is to report suspicion to the national financial intelligence unit, never to confront a customer or investigate independently. How that reporting chain works is covered in reporting and suspicious activity.
Cash
Bulk cash smuggling
Placement
- A traveler carrying or requesting large amounts of foreign currency, or many high-denomination notes, with no plausible explanation
- Cash that is declared only after the traveler is stopped, or a first denial followed by a declaration on behalf of a third party
- Illogical travel: very short trips, trips to non-tourist destinations, tickets bought with cash at short notice or by someone other than the traveler, little or no luggage
- Several travelers with similar itineraries and inconsistent stories, or travel patterns that mirror known drug or human-trafficking routes
- Cargo, mail, or freight shipments whose declared contents do not fit the shipper, the route, or the weight and packaging
- A bank customer, often an exchange house, whose physical dollar deposits or shipments are far larger than its business could plausibly generate
Cash-intensive front businesses
PlacementIntegration
- Revenue or margins far out of line with comparable businesses in the same sector and location
- A cash-to-card payment ratio much higher than the industry norm
- Sales that stay flat or grow steadily regardless of season, weather, or foot traffic
- Supplier purchases too small to support the claimed sales volume: a restaurant billing 500 covers a night on 100 covers' worth of food
- Deposits that arrive in tidy, regular amounts rather than the ragged pattern of genuine retail takings
- Owners with unexplained wealth, criminal associations, or several small cash businesses across town
Structuring (smurfing)
Placement
- Repeated cash deposits just under the reporting threshold: $9,000–$9,900 amounts recurring over days or weeks
- The same customer depositing at several branches on the same day
- Many unrelated people making cash deposits into a single account
- Deposits timed to stay under the threshold within a 24-hour window, then resuming
- A customer who asks a teller how much cash can be deposited before it gets reported
- Round-figure cash withdrawals that shrink to just-below-threshold amounts after the customer learns about reporting rules
Banking
Correspondent banking and wire layering
Layering
- A respondent bank whose customer base is mostly non-residents with no plausible link to the bank's home country
- Transaction volumes far out of proportion to the size, staff, and history of the respondent bank
- Undisclosed nesting: a respondent bank quietly providing correspondent services to other banks through the account
- Wires between related companies, often with round amounts and vague descriptions such as consulting or services
- Corporate customers built from shell companies whose owners the respondent bank cannot or will not identify
- Funds that enter the account and leave within days to accounts in a third country with no business connection
- Pressure on the correspondent bank to speed up payments or to stop asking questions about a customer
Cuckoo smurfing
PlacementLayering
- Several cash deposits made into one personal account by people the account holder does not know, matching an expected overseas transfer
- Cash deposits made across many branches or ATMs, or in different states, on the same day or within a short period
- Deposit amounts that sit consistently just under a reporting threshold
- An account holder who expected a transfer from abroad but did not receive it through the normal channel, or who cannot say who paid the cash in
- A remitter whose customers are repeatedly credited by third-party cash deposits rather than by bank transfer
- A remittance business whose settlement with overseas counterparts does not match the flows it declares
Currency exchanges and MSBs
PlacementLayering
- Cash volumes, or wires abroad, that are far larger than the business's location, size, and customer base can explain
- Repeat customers whose transactions cluster just under identification or reporting limits, or that split across agents and branches
- One customer or a small group sending large amounts, often quickly, to the same beneficiaries or to high-risk destinations, with no clear family or business tie
- An operator that will not file reports, ignores its own stated transaction caps, or keeps incomplete customer records
- A grocery store, convenience store, or other shop that also sends money abroad or exchanges currency but is not registered or licensed as an MSB
- Funds moved on invoices or stated purposes that do not match the customer's actual business
Funnel accounts and money mules
PlacementLayering
- Inflows from many unrelated senders followed by rapid transfers out, leaving a near-zero balance
- Account activity that doesn't fit the holder: a student account suddenly moving tens of thousands
- Cash deposits into one account made in cities the account holder has never visited
- Deposits kept just under reporting or ID thresholds, then withdrawn far away soon after
- A new payee receiving money immediately after account opening, with funds forwarded within hours
- The account holder can't explain the activity, or describes a job that is only receiving and sending money
Insurance products
LayeringIntegration
- A large single premium, or a policy that is far bigger than the customer's needs or income would justify
- Premiums paid with many money orders, cashier's checks, or cash equivalents bought at different banks or shops
- Cancelling a policy soon after purchase, including in the free-look period, especially at a cost to the customer
- Early or heavy borrowing against the policy, or a refund or loan cheque directed to an apparently unrelated third party
- Premiums paid by someone with no obvious tie to the policyholder, or the benefit transferred to an unrelated third party
- A customer who does not care about surrender charges or tax costs, and whose main interest is how fast money can come out
Loan-back schemes
LayeringIntegration
- A loan from an offshore lender the borrower cannot describe, cannot meet, or cannot name the owner of
- Loan terms that make no commercial sense: no collateral, no credit check, an interest rate far from market, or no fixed repayment date
- The lender and the borrower trace back to the same person, family, or professional service provider once ownership is unwound
- Repayments made in cash, made early, made by an unrelated third party, or made from a different country than the loan came from
- A loan that is later forgiven, or whose paperwork is backdated or edited when a bank asks about it
- A large purchase, such as property, funded mainly by a foreign shareholder loan from a company with no visible business
Professional enablers
PlacementLayeringIntegration
- A lawyer's or agent's client account used to receive and pay out funds with no underlying legal work, sometimes called a pass-through
- A client who asks for a company, trust, or account structure that has no clear commercial purpose beyond secrecy
- Fees, loans, or invoices that do not match the services described, or that are paid by unrelated third parties
- Professionals who form hundreds of companies for one offshore client base, or who serve as nominee director on many of them
- Reluctance to identify the beneficial owner, or an intermediary who insists the client's identity cannot be shared
- Property purchases or private loans arranged through a professional for a buyer with no visible source of wealth
- A transaction whose complexity is the main product: many entities, several countries, and no reason a legitimate client would need them
Round-tripping and fake foreign investment
LayeringIntegration
- "Foreign" investment from a tiny jurisdiction far larger than that jurisdiction's own economy
- An investor entity with no staff, premises, operations, or track record that funds a company in the customer's home country
- Ultimate ownership of the foreign investor that leads back to a resident of the country being invested in, or to the target company's own owner
- Funds that leave a customer's account as fees, loans, or investments and return, in a similar amount, from a related party abroad
- Foreign loans to a company with no clear commercial purpose, unusual terms, or repayment that flows back to the same people
- Investment made shortly after a large outflow, or timed to gain a tax, treaty, or exchange-control advantage
- Refusal to identify the beneficial owner behind the offshore investor
Sanctions evasion
LayeringIntegration
- A transfer of a yacht, jet, or property to a spouse, child, trust, or associate near the time an owner is sanctioned, while the owner keeps using it
- A new legal owner with no experience of the asset, no income to support it, and no clear reason for buying it
- Sale terms that are not commercially reasonable: no competitive process, a price far from market, or a buyer formed days earlier
- A company reincorporated under a new name with nominal new owners while the same people run it
- Layered ownership through trusts, foundations, or holding companies in jurisdictions with no link to the asset
- Trade settled in local currencies through correspondent accounts, or through crypto, that keeps a sanctioned party's payments out of dollar systems
- Evasive or vague answers when a bank, agent, or lawyer asks whether a blocked person is involved
Shell companies and nominees
Layering
- A registered-agent address shared by hundreds or thousands of unrelated companies
- Nominee directors whose names appear on dozens or hundreds of company boards
- A company with no staff, premises, or web presence moving sums far beyond any plausible business activity
- Ownership chains that pass through three or more secrecy jurisdictions before reaching a human being
- Circular ownership structures in which companies ultimately own themselves
- A corporate customer unable, or unwilling, to name its beneficial owner during bank onboarding
Trade
Black Market Peso Exchange
Layering
- US exporters paid by third parties (brokers, exchange houses, or strangers) rather than by their actual customer
- Export invoices settled with many structured cash deposits made in different cities or states
- Importers who route payment through a broker instead of their own bank and cannot explain why
- Goods retailing in Latin America below any plausible cost of importing them
- Funnel accounts: cash deposited across multiple states, withdrawn rapidly somewhere else
- Cash-heavy garment, electronics, or appliance wholesalers whose deposits dwarf their walk-in trade
Trade based money laundering (TBML)
Layering
- Invoice prices far above or below the market value of the goods shipped
- Goods that make no sense for the customer's stated line of business
- Payments to an exporter arriving from third parties unrelated to the buyer
- Circuitous shipping routes or transshipment through countries with no role in the deal
- Letters of credit repeatedly amended or extended without a clear commercial reason
- Trade volumes out of proportion to the size and history of the company
Assets
Art, antiques and luxury goods
LayeringIntegration
- A buyer who shows little interest in the work itself, its condition, or its price
- Purchases made through shell companies, trusts, or advisors who will not name the real client
- Large payments from third parties, from unrelated companies, or from high-risk jurisdictions
- Shipping invoices or customs values far below a work's real worth
- Works bought and quickly resold, often at prices that make no market sense
- Pieces held in storage for years and never displayed, then used as collateral or gifted between related parties
Buying legitimate businesses
Integration
- An acquisition paid for by funds from an offshore or unexplained source that the buyer cannot document
- A buyer with no background in the industry who pays well above what the business seems to be worth
- Ownership held through a chain of shell companies, trusts, or nominees that hides who benefits
- A newly acquired company whose turnover suddenly rises or falls without a change in customers or products
- Loans, capital injections, or fees flowing between the business and unrelated parties with no clear service behind them
- A regulator, lender, or bank that cannot get straight answers about who ultimately owns or controls the company
Gold and precious metals
PlacementIntegration
- Large cash payments for scrap gold or bullion from customers who cannot explain their source
- Suppliers who call themselves gold collectors and cannot say where the metal was mined
- Gold arriving from countries whose own production could not supply that volume
- Rotating front companies, or shippers and manufacturers on customs forms who do not match the real seller
- Invoices and shipments that do not match, such as gold grain sold under paperwork describing something else
- A business whose gold turnover, and cash deposits, far exceed its size or history
Real estate
Integration
- All-cash purchases by shell companies, trusts, or nominees with no visible connection to the true buyer
- A buyer whose declared income or business could not plausibly fund the purchase
- Rapid resales between related parties at rising or falling prices with no market explanation
- Large mortgage prepayments or renovations paid in cash shortly after purchase
- Purchase funds arriving from many unrelated third parties or from high-risk jurisdictions
- Luxury properties left empty for years, held purely as stores of value
Informal value transfer
Flying money: Chinese underground banks
Layering
- Cash-intensive US businesses depositing far more currency than their visible customer base could generate
- Structured cash deposits into personal accounts followed by payments for tuition, homes, or luxury goods on behalf of unrelated third parties
- Purchases of US assets paid by parties with no relationship to the buyer, especially via multiple small transfers from China
- Bulk-cash handoffs arranged over WeChat or other Chinese messaging apps, verified with photographs of serial numbers or torn banknotes
- Rapid movement of deposited drug cash into accounts controlled by merchandise exporters shipping goods to Mexico
- A money broker offering dollar conversion at rates far better than any licensed remitter could sustain
Hawala and informal value transfer
Layering
- A money remitter that is not registered or licensed but moves funds internationally for customers
- Settlement wires between import/export firms with no corresponding shipments of goods
- A cash-intensive business making or receiving large international transfers unrelated to its trade
- Frequent bulk-cash handoffs arranged by phone using codes, token serial numbers, or partial banknotes as receipts
- One person's account receiving deposits from many unconnected individuals, then wiring abroad in aggregate
- Customers sending money to high-risk corridors with no apparent family or business connection
Crypto
Chain hopping and cross-chain bridges
Layering
- Rapid bridge or cross-chain swaps beginning minutes after a publicized hack or exploit
- Funds fanned out across hundreds or thousands of fresh wallets immediately before or after a chain hop
- Use of swap services without identity checks that analytics firms have flagged, especially after an FBI or OFAC notice naming the funds
- Value exiting one chain and reappearing on another at matching amounts and timing
- Deposits that trace back, however many hops removed, to addresses named in sanctions designations or public attributions
- Swap volumes on a bridge or protocol spiking far beyond its normal baseline in the days after a major theft
Crypto ATMs and peer-to-peer trades
PlacementLayering
- Several cash deposits just under a reporting or daily kiosk limit, spread across multiple machines or multiple accounts
- Many unrelated customers at kiosks in different places sending to the same crypto address within a short period
- A customer with little or no crypto history making a large deposit that is rapidly forwarded through several addresses or swapped into another coin
- An older customer, new to crypto, withdrawing large cash sums from a bank or retirement account and saying a caller told them to deposit it at a kiosk
- Multiple accounts or transactions linked to the same phone number or wallet address
- A kiosk business that advertises no ID needed, or only a phone number, or is not registered with FinCEN as a money services business
Mixers, tumblers, and CoinJoin
Layering
- Deposits to or withdrawals from wallet clusters that analytics firms have tagged as mixer addresses
- Repeated equal-denomination transactions with no economic rationale: the signature of pool-based mixing
- Funds arriving at an exchange soon after leaving a known mixer, split across many freshly created addresses
- A customer's transaction history that goes dark at a mixer and resumes days later at a similar total value
- Mixer exposure combined with links to darknet markets, ransomware wallets, or hack-designated addresses
NFT wash trading
LayeringIntegration
- An NFT bought and resold repeatedly between wallets that were funded from the same source or from each other
- A sale price far above the token's earlier sales or the collection's floor, with no visible bidding or listing history
- New wallets with no prior history that buy, sell and cash out within hours or days
- Buyers who show no interest in the artwork or utility and pay the asking price immediately
- NFT sales settled in a way that quickly moves proceeds to a mixer, a bridge or a platform that does no identity checks
- Trading on several NFT platforms at once, or across many accounts, in a pattern that keeps any one platform from seeing the whole picture
Peel chains
Layering
- A long sequence of transactions from one address to the next, each moving almost the whole balance forward and sending a small amount elsewhere
- Small side payments, in irregular amounts, going to exchange deposit addresses or to services that have been flagged by analytics
- Funds gradually deposited into a darknet market or other pass-through service rather than moved in one piece
- Withdrawals from several exchange accounts converging in one chain and ending at a single account
- New addresses created for each hop, used once and then emptied
- A chain that begins at wallet addresses tied to a hack, theft or ransomware payment
Privacy coins
Layering
- A new exchange account funded almost entirely by a privacy coin that is then converted to bitcoin or a stablecoin and withdrawn quickly
- Conversions from traceable coins into a privacy coin shortly after funds leave a hack, darknet market or ransomware wallet
- Chain-hopping into a privacy coin and back, with the round trip serving no obvious business purpose
- Accounts registered with unverifiable identities that go quiet or are abandoned once the exchange asks for source-of-funds documents
- Repeated privacy-coin deposits to accounts at different exchanges, in sequences that match one another in timing and size
- Use of venues that accept privacy coins with no identity checks, or that were designed to avoid the Travel Rule
Stablecoins and OTC brokers
PlacementLayering
- High-volume USDT wallets, especially on Tron, with no visible business rationale
- Exposure to addresses that analytics firms tag to guarantee marketplaces or sanctioned OTC brokers
- Fresh wallets that collect deposits from many unrelated victims and consolidate into large stablecoin positions within hours
- Hacked or fraud proceeds converted to stablecoins immediately after theft, then split before issuers can freeze
- Counterparties that trace back, at any remove, to FinCEN Section 311 targets or OFAC-designated entities
- Broker-arranged conversions that settle in cash and never touch a regulated exchange account
Unlicensed exchanges and nested services
LayeringIntegration
- An exchange or platform that advertises no identity checks, or accepts only a phone number or email address to open an account
- A service that is unregistered or unlicensed where it serves customers, or represents itself as registered while lacking real anti-money-laundering controls
- Deposit addresses at a large exchange that receive large volumes from ransomware, darknet market, or sanctioned-entity wallets
- One account or deposit address at an exchange moving unusually large volumes, more like a business than an individual
- Answers to source-of-funds questions that are evasive, incomplete or falsely say the account is unverified
- A service reappearing under a new name shortly after sanctions or a seizure, moving the same customers and balances
Gambling
Casinos and gambling
PlacementLayering
- Large cash buy-ins, especially in small bills, followed by little or no actual play
- Chips bought with cash and cashed out quickly, or requested as a cheque marked as winnings
- Cash delivered to the casino or a nearby car park by third parties in bags or suitcases
- Chips passed between players at the table so one gambler cashes out another's buy-in
- Junket or private-lender credit with no visible repayment trail in the casino's own records
- A patron's buy-in volume wildly out of line with any known source of income
Digital
Gaming currencies and skins
PlacementLayering
- Many new accounts buying the same virtual currency or items with cards issued to different names
- In-game purchases that are followed by fast transfers to a different account and then sold on an outside marketplace
- Items or currency bought and resold at a steady discount, which suggests the seller did not pay real cost for them
- Players who deposit into a gambling or gaming account, wager little or nothing, and withdraw to a different payment method
- Multiple accounts or payment methods under different identities, or payment details that do not match the customer's identity
- A wave of chargebacks and card disputes tied to purchases of a single tradeable item
Prepaid cards and gift cards
PlacementLayering
- Bulk purchases of prepaid or gift cards with cash or other illicit funds, or people recruited to buy or carry cards for someone else
- Multiple cards bought under aliases, or funded with stolen credit or debit card details
- Two or more cards linked to one account, with funds loaded in one country and withdrawn in another
- Cards used to buy money orders, merchandise, or other prepaid cards, which are then resold for cash
- A retailer or account with gift card redemptions or resales that are far out of line with its normal business
- Elderly or vulnerable customers buying large numbers of cards while on the phone, then reading out the codes (a sign of an active scam, and the start of the laundering chain)
Transaction laundering
Layering
- A merchant whose website sells one thing while its payment descriptors, refunds or checkout pages point to another
- Sales volume, average ticket size or geography that do not match the storefront's catalogue or traffic
- A sudden jump in card-not-present volume from a business that normally sells face to face
- Rounded-amount transactions, or repeated charges to the same card in a short time, that are out of line with the seller's normal pattern
- Unusual chargeback, refund or dispute patterns that suggest customers do not recognize what they paid for
- Checkout pages that hand the customer to a different site, or that carry the name of an unrelated business
Securities
Mirror trading
Layering
- Buy and sell orders in the same security, at the same time, in the same size and at the same price, placed for two related customers in different currencies
- Customers linked by shared directors, owners, employees, or addresses, especially when one side is offshore
- Trading that has no chance of profit or loss and generates unusually little commission
- Trading volumes that are far out of line with a customer's profile or stated business
- Customers acting as intermediaries for undisclosed underlying clients, with ownership evidence that is unverified
- Trades placed through one office but booked to the books of another, with weak oversight of the booking office
- Outside inquiries about a customer's wires that go unanswered, or are answered without detail
Securities and brokerage
LayeringIntegration
- Accounts held by offshore companies or nominees whose real owners cannot be identified
- Shares deposited and then sold almost immediately, especially in low-priced, thinly traded stocks
- Matched trades, pre-arranged trades, or wash trades with no change in beneficial ownership
- One account or group dominating the volume of a stock, or trading at the close to move the price
- Large volume in a stock that had barely traded for months, with sharp price moves and no news
- Sale proceeds sent to a different country, third party, or account than the one that traded
Frequently asked questions
What is a money laundering red flag?
An observable feature of a transaction, customer, or account that is common in laundering and uncommon in ordinary business. A red flag is a reason to look closer, not a finding. Most turn out to have innocent explanations, which is why they trigger review rather than accusation.
Does one red flag mean money laundering is happening?
No. Single indicators are weak on their own: cash businesses hold cash, and importers do use round numbers. What matters to an investigator is clustering, several unrelated indicators in the same customer at the same time, and persistence over months.
Who is expected to act on these indicators?
Banks and other reporting entities, and increasingly the professions handling large transactions: real estate agents, lawyers, accountants, dealers in precious metals. Their obligation is to report suspicion to the national financial intelligence unit, not to investigate or to confront the customer.
Every indicator on this page is reproduced from the technique record that contains it. The sourcing for each sits on that technique's page, with dates and primary links.