Money Services Businesses AML Red Flags

Customer attempts to split a large cash transaction into multiple smaller transactions below the $3,000 recordkeeping threshold to avoid creating a paper trail.

Multiple customers visit the same location in rapid succession and each conducts a cash transaction just below the reporting threshold, suggesting a coordinated structuring scheme.

Wire transfers sent to or received from high-risk jurisdictions known for money laundering, with no apparent business or family connection to those countries.

Customer provides identification that appears altered, forged, or inconsistent with the person presenting it, including mismatched photos or expired credentials.

Corporate customer sends wires on behalf of undisclosed principals, or the stated beneficial owner is a nominee shareholder with no independent wealth or employment.

Transaction patterns show sudden and significant changes in volume, frequency, or typology that are inconsistent with the customer’s established activity profile.

Politically Exposed Person (PEP) or a close associate conducts large cash transactions that appear disproportionate to their known sources of income or legitimate wealth.

Multiple individuals use the same phone number or address to receive wire transfers, with none able to explain the source or purpose of the funds independently.

Funds are sent to or received from individuals, entities, or charities linked to designated terrorist organizations or individuals on OFAC SDN lists.

Customer uses virtual currency exchanges or mixers to obfuscate the origin or destination of funds, particularly involving sanctioned jurisdictions or SDN-listed individuals.

Customer reports that their online account was compromised and unauthorized wire transfers were initiated, with rapid fund movement to overseas accounts.

Customer receives funds and is instructed to convert them to virtual currency and send to a specific wallet address as part of a job offer, romance scheme, or investment opportunity.

MSB agent location shows a sudden spike in transaction volume that cannot be explained by normal business growth, seasonal patterns, or marketing campaigns.

Customer receives funds from multiple unrelated sources and immediately forwards them to other individuals or entities, acting as an intermediary with no apparent economic purpose.

Cash deposits or money order purchases made in amounts designed to avoid the $10,000 CTR threshold, with customers using identical or sequential serial numbers.

Multiple prepaid cards or accounts are opened using stolen or synthetic identities to receive state unemployment insurance benefits, with rapid liquidation via ATM withdrawals.

Customer presents a driver’s license or passport that shows signs of deepfake or AI-generated manipulation, such as inconsistent lighting, unnatural facial symmetry, or mismatched security features.

Customer’s voice or video call for high-value wire authorization appears artificially generated, with unnatural speech patterns, lack of ambient background noise, or refusal to answer dynamic security questions.

Customer consistently exchanges large volumes of small-denomination bills for larger denominations without a clear business or personal reason.

Business customer makes multiple cash deposits or withdrawals on the same day across different MSB locations, with no legitimate business justification.

Customer purchases money orders or traveler’s checks in sequential amounts totaling $10,000 or more, conducted across multiple transactions and days.

Customer sends multiple wire transfers to the same overseas beneficiary within a short period, with varying stated purposes that appear inconsistent with the customer’s profile.

Business customer receives large incoming wires from shell companies with no visible commercial relationship and immediately forwards the funds to unrelated third parties.

Customer refuses to provide required identification or provides incomplete or suspicious documentation, such as a foreign passport from a high-risk country with no U.S. visa.

Business customer is unable or unwilling to identify its beneficial owners, or the listed owners have no discernible connection to the business operations.

Customer conducts transactions that appear designed to create complex layering, such as rapid conversion of cash to money orders to wire transfers within hours.

Customer frequently transacts with or sends funds to countries under OFAC sanctions, FATF high-risk jurisdiction designations, or known money laundering havens.

Customer appears nervous or evasive during routine transactions, avoids eye contact, rushes the process, or attempts to distract staff from normal procedures.

Incoming wire transfers or prepaid card loads from escort services, massage parlors, or short-term rental operations that exhibit patterns consistent with forced labor exploitation.

Charitable or nonprofit customer sends funds overseas without adequate due diligence on the end recipient, particularly to conflict zones or regions with terrorist presence.

Business customer receives payments from entities in jurisdictions subject to comprehensive sanctions, routed through intermediary countries to conceal the true origin.

Elderly customer is accompanied by a younger individual who dominates the conversation, provides all instructions, and prevents the customer from speaking directly to staff.

Business customer’s account shows unauthorized changes to wire instructions followed by large outgoing wires to new, unverified beneficiary accounts.

Business customer conducts trade-related wire transfers with pricing that is significantly inconsistent with commodity market values, suggesting invoice manipulation.

Customer cashes third-party checks made out to multiple different payees but endorses them all in the same handwriting or with identical signature styles.

Customer purchases multiple prepaid cards at different locations on the same day, each loaded to amounts just below the aggregate reporting threshold, and immediately transfers the balances.

Agent location consistently fails to file CTRs or maintains inadequate records, with internal audits revealing repeated deficiencies in compliance procedures.

Remittance corridor shifts abruptly from one country to another with no corresponding change in the customer’s circumstances, particularly to a higher-risk jurisdiction.

Customer is a student, retiree, or unemployed individual who receives and forwards unusually large sums inconsistent with their demographic profile and income sources.

Business customer involved in chemical supply or pharmaceutical distribution receives wires from shell companies with no verifiable business purpose or website presence.

Unemployment benefit prepaid cards are loaded in one state but immediately used for ATM withdrawals in a different state, far from the recipient’s listed address.

Business customer receives PPP or EIDL loan proceeds and immediately wires the full amount to unrelated third parties or personal accounts with no payroll or business expenditure documentation.

Account opened with biometric verification that fails liveness detection, or the submitted selfie does not match the photo on the government-issued ID provided.

Customer regularly brings in a briefcase or bag containing a large amount of cash and requests that the funds be converted into money orders in increments just under reporting limits.

Customer frequently changes contact information, address, or phone number within short timeframes without explanation.

Prepaid card customer loads and unloads large amounts in quick succession, particularly across multiple reload locations, with no clear spending pattern.

Funds are wired to or from a country with weak AML controls, where the stated purpose of the transfer is inconsistent with typical remittance corridors.

Customer makes repeated inquiries about the MSB’s reporting thresholds, CTR filing procedures, or how to avoid triggering recordkeeping requirements.

Elderly customer suddenly begins wiring large sums to previously unknown individuals, particularly those claiming to be family members, government officials, or lottery representatives.

ACH transactions from a business customer show round-dollar amounts with no supporting documentation or invoices, and the receiving entities have no apparent commercial relationship.

Business customer deposits checks from unrelated companies with memo lines referencing goods or services that do not match the customer’s stated business type.

Remittance sender provides vague or inconsistent explanations for the purpose of funds, such as “family support” that varies significantly in amount and timing from historical patterns.

Business deposits government stimulus or relief checks for employees who are not on the company’s payroll records, or for amounts exceeding the statutory limits.

High-net-worth individual structures large cash purchases of gold, silver, or other precious metals into transactions below the Form 8300 reporting threshold across multiple dealers.