Red flags for banks and credit unions

What supervisors and standard-setters expect

Banks are the most heavily regulated gatekeepers. In the US, a bank's anti-money laundering program must include internal controls, independent testing, a named compliance officer, staff training and risk-based customer due diligence. That means understanding the nature and purpose of each relationship, building a customer risk profile and monitoring ongoing activity to identify and report suspicious transactions. For company customers, the bank must identify and verify the individuals behind the entity at account opening: anyone owning 25 percent or more, plus one person with significant control. The FATF Recommendations, last amended in June 2026, are the international standard these national rules implement.

Reporting is the sharp edge. A US bank must file a Suspicious Activity Report on a transaction of at least $5,000 when it knows or suspects that the funds are illegal, that the transaction is designed to evade reporting rules, or that it has no business or apparent lawful purpose for that customer. The deadline is 30 calendar days from first detection (60 if no suspect is identified), and the file is kept five years. In the UK, regulation 33 of the 2017 Money Laundering Regulations requires enhanced due diligence and monitoring for correspondent relationships, politically exposed persons, high-risk countries, and transactions that are unusually complex or large, follow an unusual pattern or have no apparent economic or legal purpose.

That is how the red flags on this page connect to duties. Structuring and cuckoo smurfing indicators speak to the 'designed to evade' limb. Mule accounts and round-tripping speak to whether activity fits the customer's risk profile. Shell company and loan-back indicators are beneficial ownership questions. Correspondent banking indicators are enhanced due diligence triggers.

Enforcement shows where banks fall short. On October 10, 2024, FinCEN assessed a record $1.3 billion penalty against TD Bank. It found that trillions of dollars in annual transactions went unmonitored, that the bank willfully failed to report thousands of suspicious transactions totalling about $1.5 billion, and that it handled over $400 million for one cash-heavy customer without identifying him in more than 500 currency reports. A four-year monitorship followed.

The UK regulator found a different failure. On July 8, 2025, the FCA fined Monzo £21,091,300 because onboarding, risk assessment and monitoring did not keep pace as customers grew from about 600,000 to over 5.8 million. Some customers were accepted on obviously implausible information, and over 34,000 high-risk customers were signed up while the bank was barred from doing so. Detection only works if systems can see the indicators.

As of October 2026: Regulation texts were read on the eCFR and legislation.gov.uk in October 2026 and were current on those sites at that time; pending rulemaking was not checked. The FATF Recommendations page (amended June 2026) was opened but the numbered recommendation text was not read, so no recommendation numbers are quoted. The TD Bank and Monzo figures come from the regulators' press releases, not the underlying consent order or Final Notice. The DOJ, OCC and Federal Reserve actions against TD Bank ran in parallel and are not described here.