AML Red Flag Library

A red flag is a transaction pattern, customer behavior, or operational anomaly that may indicate money laundering, terrorist financing, fraud, or sanctions evasion under the Bank Secrecy Act. Red flags are warning signs drawn from FinCEN advisories, FFIEC examination manuals, and federal regulation. They help a compliance team know where to look; they are the beginning of an analysis, not the end of one.

Money laundering risk is not the same everywhere. A cash-intensive money services business, a mortgage lender funding a home purchase, a casino handling chips, and a crypto exchange moving virtual assets each face different typologies. That is why this library is organized by industry and why a red flag that is critical for one sector may be irrelevant to another.

Identifying a red flag does not automatically mean suspicious activity has occurred. Legitimate customers trigger indicators for entirely benign reasons. The framework expects institutions to weigh each indicator against the customer profile, the nature of the business, and the surrounding facts before deciding what it means.

Once an indicator is observed, the next step is investigation, not accusation. Staff compare the activity against the expected profile, gather supporting facts, and route the review through a documented escalation path to the compliance officer. The goal is a clear, consistent, and documented decision about what the activity means.

A red flag only becomes useful when there is a written procedure for handling it. Documented escalation steps, investigation notes, and decision records show examiners that the institution has a repeatable process, regardless of how any single case turns out. Good documentation is what makes a program defensible.

Red flags feed into Suspicious Activity Report decisions. When the facts meet the applicable threshold and suggest illegal activity, evasion of the BSA, or no apparent lawful purpose, a SAR is filed. When they do not, that decision is documented too. Not every red flag requires a SAR, and treating it as though it does is a common misunderstanding.

The entries in this library are educational and informational. They describe indicators; they do not determine guilt, liability, or compliance. They are not legal advice and do not replace a qualified review of your specific facts, your obligations, and the current text of the regulation. Always confirm against the official source.