Mortgage Companies AML Red Flags

Borrower provides a large down payment in cash without a documented source of funds, or the funds are traced to a shell company or nominee account.

Borrower’s closing funds are wired from an account in the name of a third party with no familial or documented gift letter relationship to the borrower.

Loan application contains fabricated or altered documents, including fake pay stubs, forged bank statements, or manipulated tax returns submitted to support the borrower’s qualification.

Real estate purchase is financed through a nominee borrower or straw buyer, where the true purchaser is a foreign PEP or sanctioned individual attempting to conceal their identity.

Property transaction involves a massage parlor, nail salon, or residential rental where the listed occupants match patterns of forced labor, including restricted movement and shared living quarters.

Closing instructions are altered via compromised email, redirecting wire transfer of closing funds to a fraudulent account controlled by an attacker, with the change appearing subtly different from the original.

Property is purchased with a mortgage, then immediately listed for sale at a significantly higher price without any improvements, suggesting the transaction was used to inflate the property value for a subsequent fraud.

PEP or family member purchases luxury real estate with funds that cannot be traced to legitimate salary, business income, or documented gifts from known sources.

Borrower is the subject of a prior SAR filed by another financial institution for suspicious activity, and the new application does not disclose this history or explain the prior findings.

Down payment funds are sourced from multiple recent cash deposits into the borrower’s account, each below the $10,000 CTR threshold, with no legitimate income documentation.

Borrower brings a large sum of cash to closing that smells of marijuana, has unusual markings, or is wrapped in rubber bands and stored in a duffel bag rather than a bank envelope.

Business entity provides funds for a residential mortgage closing but is not a documented employer, investor, or permissible funding source under GSE or FHA guidelines.

Borrower receives a large wire from a cryptocurrency exchange immediately before closing, with no prior history of virtual asset holdings or trading activity.

Borrower’s stated income is significantly higher than industry norms for their stated profession and cannot be verified through tax returns, W-2s, or third-party income verification services.

Borrower uses a Social Security number that belongs to another individual, or the Social Security Administration’s records show a mismatch between the number and the applicant’s name and date of birth.

Investment property is purchased by an LLC or trust where the beneficial owners are concealed behind multiple layers of ownership, and the borrower refuses to disclose the ultimate controllers.

Borrower’s bank statements show large, unexplained deposits just before the loan closing, with the source of funds changing between application and funding.

Loan is originated at an inflated appraised value, with the appraisal ordered by parties with a financial interest in the transaction and comparable sales that appear fabricated or cherry-picked.

Foreign national borrower purchases U.S. real estate with no intent to occupy, funded entirely from overseas accounts in jurisdictions with weak AML controls or high corruption indices.

Borrower pressures the loan officer to rush the closing, waive documentation requirements, or overlook discrepancies in the application, particularly near month-end or quarter-end.

Elderly homeowner refinances or takes out a reverse mortgage at the direction of a new caregiver, family member, or acquaintance, with the proceeds directed to that individual’s account.

Title company receives a wire for closing proceeds from an account name that differs slightly from the expected sender, such as a misspelled company name or different routing number.

Commercial mortgage is secured by a property whose stated use is inconsistent with the borrower’s business type, with no lease agreements or tenant documentation.

Borrower refinances a property multiple times in a short period, each time extracting equity, with no evidence of home improvement, debt consolidation, or other legitimate purpose.

PEP uses a mortgage to acquire U.S. real estate but makes no regular payments, suggesting the loan was a facade to legitimize the movement of illicit funds into the U.S. financial system.

Loan is originated by a third-party originator (TPO) who has a history of loans that default quickly, or who is under investigation by state regulators for predatory lending practices.

Earnest money or down payment check is drawn on an account with insufficient funds, is post-dated, or bounces upon deposit, suggesting the funds are not actually available.

Loan application includes a video call with the borrower for identity verification, but the video exhibits signs of deepfake technology such as unnatural eye blinking, flat lighting, or audio-visual desynchronization.

Borrower’s transaction history reveals a pattern of rapid property flipping, with each purchase funded by the next lender and no meaningful renovation or occupancy occurring between sales.

Property is purchased in a high-value market with cash or wire from a jurisdiction subject to FinCEN advisory alerts, and the borrower has no documented ties to that location.

Borrower is uncooperative during the verification process, refuses to provide additional documentation when requested, or becomes hostile when questioned about income sources.

Elderly borrower adds a non-relative to the property title or takes out a home equity line of credit shortly after meeting a new acquaintance who pressures them to “invest” in a business.

Borrower pays off an existing mortgage in full with a large cash payment that appears to come from unexplained sources, then immediately applies for a new, larger loan.

Mortgage broker submits applications with identical or near-identical documentation across multiple borrowers, suggesting the use of template or fabricated application packages.

Borrower’s bank statements show large checks deposited from check-cashing services, payday lenders, or other high-risk MSBs as a significant portion of their income.

Mortgage payment ACH transactions are returned for insufficient funds repeatedly, yet the borrower continues to make large cash deposits or wires that do not appear tied to legitimate income.