Nonprofit Organizations AML Red Flags
Search 427 AML and BSA red flags specifically for nonprofit organizations. Filter by risk level, transaction type, and customer profile, each sourced from a FinCEN advisory, FFIEC manual, or federal regulation. Whether you're preparing for an exam, filing a SAR, or training your team, find exactly the red flags that apply to your regulated business in seconds.
- 1
Pick your industry: Select from 13 regulated sectors like Money Services Businesses, Fintech, Real Estate, or Crypto to instantly filter relevant red flags.
- 2
Narrow by risk or transaction type: Sort by Critical, High, or Medium risk, or filter by wire, cash, ACH, or crypto transactions.
- 3
Save, share, or print: Copy filtered sets for your compliance program, export for SAR documentation, or use Training Mode to quiz your team.
Turn this library into an active study session. Use Training Mode to hide risk levels and test your own classification skills. Or jump into Quiz Mode for flashcard-style review with pass/review tracking, a progress bar, and a readiness score, exactly what you need before exam day.
What AML and BSA red flags are, and how to use them
This library is more than a list. It is a working reference for compliance officers, examiners, and training programs. Before diving into the database, here is how red flags fit into an effective AML program and what they do and do not mean.
What AML and BSA red flags are
A red flag is a transaction pattern, customer behavior, or operational anomaly that may indicate money laundering, terrorist financing, fraud, or sanctions evasion under the Bank Secrecy Act. Red flags are warning signs drawn from FinCEN advisories, FFIEC examination manuals, and federal regulation. They help a compliance team know where to look; they are the beginning of an analysis, not the end of one.
Why red flags vary by industry
Money laundering risk is not the same everywhere. A cash-intensive money services business, a mortgage lender funding a home purchase, a casino handling chips, and a crypto exchange moving virtual assets each face different typologies. That is why this library is organized by industry and why a red flag that is critical for one sector may be irrelevant to another.
A red flag is not proof of suspicious activity
Identifying a red flag does not automatically mean suspicious activity has occurred. Legitimate customers trigger indicators for entirely benign reasons. The framework expects institutions to weigh each indicator against the customer profile, the nature of the business, and the surrounding facts before deciding what it means.
Escalation and investigation
Once an indicator is observed, the next step is investigation, not accusation. Staff compare the activity against the expected profile, gather supporting facts, and route the review through a documented escalation path to the compliance officer. The goal is a clear, consistent, and documented decision about what the activity means.
The importance of documented procedures
A red flag only becomes useful when there is a written procedure for handling it. Documented escalation steps, investigation notes, and decision records show examiners that the institution has a repeatable process, regardless of how any single case turns out. Good documentation is what makes a program defensible.
Connection to SAR decision-making
Red flags feed into Suspicious Activity Report decisions. When the facts meet the applicable threshold and suggest illegal activity, evasion of the BSA, or no apparent lawful purpose, a SAR is filed. When they do not, that decision is documented too. Not every red flag requires a SAR, and treating it as though it does is a common misunderstanding.
Educational versus legal conclusions
The entries in this library are educational and informational. They describe indicators; they do not determine guilt, liability, or compliance. They are not legal advice and do not replace a qualified review of your specific facts, your obligations, and the current text of the regulation. Always confirm against the official source.
Red flags organized by industry
Every entry in the database is tagged by industry. Skip straight to the dedicated guide for your sector, or use the selector below to filter the full library on this page.
Nothing on this hub is legal, regulatory, or compliance advice. Red flags are educational indicators and do not establish that suspicious activity, criminal conduct, or a violation has occurred. Confirm every requirement against the official FinCEN, FFIEC, or federal source and consult a qualified professional for your specific circumstances.
Select your industry to get started
21
of 427 totalMatching Red Flags
Nonprofit
Currently filteredIndustry
27
FinCEN & FFIECSource Documents
15
Red flag typesCategories
Fintech platform experiences a ransomware attack where customer data is exfiltrated and a cryptocurrency ransom demand is made, with subsequent dark web postings of stolen account information.
Hide risk levels and source documents to test your own classification skills. A proven way to lock in knowledge before your CAMS or BSA exam.
21 of 427 red flags
Nonprofit’s board of directors consists entirely of family members or individuals with no visible background in the charity’s stated field, and no independent governance documentation exists.
Charity receives a large donation from an individual or entity with no prior giving history, and the donor has no apparent connection to the charity’s mission or geographic focus.
Charity wires funds overseas to a recipient organization that cannot be verified through independent sources, and the recipient’s name is similar but not identical to a known legitimate charity.
Nonprofit transfers funds to an overseas contractor or vendor in a conflict zone, but the contractor has no verifiable business registration, website, or physical address.
Charity is controlled by a foreign national from a high-risk jurisdiction who is also a PEP, and the organization’s activities are concentrated in that individual’s home country or region.
Nonprofit receives funds from a donor in a sanctioned jurisdiction and immediately wires the equivalent amount to a different recipient in a non-sanctioned country, effectively acting as a sanctions evasion conduit.
Charity receives donations and immediately forwards them to wallets or accounts linked to designated terrorist organizations or individuals on the OFAC SDN list.
Charity claims to operate a shelter or job placement program for vulnerable populations, but the organization’s transactions show payments to landlords or employers associated with forced labor investigations.
Nonprofit organization opens a bank account but cannot provide a valid IRS determination letter, Form 990 filing history, or board of directors list upon request.
Charity’s stated mission is inconsistent with its transaction activity, such as a “disaster relief” organization receiving large wires from countries with no active disaster or humanitarian crisis.
Nonprofit receives funds from a for-profit business that has no commercial relationship with the charity, and the payment is described as a “donation” rather than a sponsorship or fee-for-service.
Nonprofit’s bank account shows rapid inflows from crowdfunding platforms followed by immediate wires to individual beneficiaries overseas, with no documentation of how beneficiaries were selected.
Charity receives donations in round-dollar amounts from multiple donors who share the same IP address, mailing address, or payment method, suggesting the donations are from a single source being split.
Charity’s expenditures are disproportionately directed toward administrative costs, travel, or consulting fees rather than programmatic activities, with no independent audit or board oversight.
Nonprofit’s founder or executive director is also the sole signatory on all bank accounts and refuses to add additional authorized signers or implement dual control over large wire transfers.
Charity wires funds to a jurisdiction under FATF enhanced monitoring or subject to a FinCEN advisory, with no documented assessment of the recipient’s AML controls or risk profile.
Nonprofit’s “relief” activities are concentrated in regions with active terrorist presence, and the charity has no documented risk assessment or safeguards to prevent diversion of aid to armed groups.
Nonprofit’s fundraising materials emphasize speed and urgency while downplaying transparency, accountability, or donor verification, and the organization has no independent accreditation or rating.
Nonprofit’s donation page is compromised, with donors reporting that their credit card charges went to an unrelated merchant, and the charity was unaware of the breach until contacted by donors.
Elderly donor makes a large bequest or recurring donation to a newly formed charity after attending a free seminar, with no independent verification of the charity’s legitimacy or tax status.
Charity’s leadership is evasive about the organization’s programmatic activities, beneficiary selection process, or financial controls, and refuses to provide audited financial statements or board minutes.
Showing 21 of 427 red flags
Found a nonprofit red flag? See what to review next.
Nonprofit organizations are not generally covered financial institutions, but banks and money services businesses that serve them apply enhanced scrutiny. Treasury and FATF guidance describe a risk-based approach for charities operating in high-risk regions.
How every red flag is sourced, cited, and reviewed
This library is meant to be checked, not just read. Each entry shows where it came from and when it was last reviewed, so examiners, compliance officers, and trainers can verify the basis for any indicator.
Every entry cites its source — and its attribution strength
Each red flag is linked to a related FinCEN, FFIEC or regulatory source. The wording is Soflo's summary, not a quotation, so confirm any indicator against the source before relying on it. Reviewed records also carry an attribution tier, so you can see whether the source names the indicator directly or whether it was adapted from that source.
Citations are shown, not summarized away
Where a record maps to a regulation, the 31 CFR citation is displayed with a direct link so you can read the operative text yourself instead of trusting a paraphrase.
Each record carries a last-reviewed date
Records show the date they were last checked against the source document. The library is reviewed periodically against current FinCEN advisories, FFIEC manual updates, and the Code of Federal Regulations.
SAR categories are mapped, not implied
Where applicable, records show the corresponding FinCEN SAR Form 111 checkbox category and key term, so the link between an indicator and a filing decision is explicit.
How we signal the strength of each citation
Not every entry is a literal, named FinCEN indicator \u2014 some are FinCEN indicators applied to a new industry context, and some are generalized training scenarios. Rather than blur those distinctions, each reviewed record is tagged with one of three attribution tiers:
Direct FinCEN indicator
Restates an indicator that the cited FinCEN advisory or guidance itself identifies.
Adapted from FinCEN advisory
Applies an indicator from a FinCEN advisory to this industry’s context rather than quoting it verbatim.
Composite training scenario
A generalized compliance scenario assembled from multiple concepts or standard practice. Useful for training; it is not a single named advisory indicator.
Tagging is being applied sector by sector as each industry\u2019s records are re-checked against their source documents. Insurance and Fintech are classified first; records without a tier are still being reviewed and carry no attribution claim until they are.
Red flags are educational indicators drawn from official sources. They do not establish that suspicious activity, criminal conduct, or a violation has occurred, and this library is not legal or compliance advice.
Browse compliance resourcesEducational & Informational Use Only
This library is a training aid and reference tool. It is not legal, regulatory, or compliance advice. Results are a self-reported estimate, not a formal examination or audit. There is no guarantee of regulatory compliance, and this is not a substitute for an independent BSA audit by a qualified professional. No attorney-client or consulting relationship is established. No warranties are made regarding the accuracy, completeness, or fitness for purpose of the content herein. Always consult a licensed compliance professional for guidance specific to your situation.
Red Flag Reference by Topic
Deep-dive guides for specific red flag categories and industries. Each page includes expanded explanations, regulatory context, and related training resources.
AML Red Flags for Title Companies
30+ BSA red flags specifically for title companies, escrow agents, and closing attorneys. Sourced from FinCEN advisories...
MSB Suspicious Activity Indicators
45+ suspicious activity indicators specifically for money services businesses. Drawn from the FFIEC Exam Manual and rela...
Cryptocurrency Money Laundering Red Flags
40+ red flags for detecting money laundering in cryptocurrency transactions. Drawn from FIN-2019-G001, FIN-2021-A004, an...
SAR Red Flags List
427+ BSA red flags organized by SAR checkbox category. Each red flag includes the SAR checkbox it maps to, its source do...
Structuring Red Flags for Banks
25+ structuring indicators specifically for banks. Sourced from the FFIEC Core Examination Manual, FinCEN advisories, an...
AML Red Flags by Industry
427+ BSA red flags organized by 13 regulated industries. Each entry is sourced from a FinCEN advisory, FFIEC manual, or ...
BSA Red Flags List
427+ Bank Secrecy Act red flags covering every compliance category, industry, and risk level. Each flag cites a FinCEN, ...
Money Laundering Red Flags
427+ money laundering indicators organized by the three stages: placement, layering, and integration. Each flag cites a ...
FinCEN Red Flags for Mortgage Companies
35+ BSA red flags for mortgage companies under 31 CFR § 1029. Drawn from FIN-2012-A009 and FinCEN mortgage fraud reporti...
FinCEN Red Flags for Fintech Companies
35+ BSA red flags for fintech companies under 31 CFR § 1022. Drawn from FIN-2020-A007, the 2024 Financial Trend Analysis...
FinCEN Casino AML Red Flags Examiners Look For
30+ BSA red flags for casinos under 31 CFR § 1021. Adapted from FinCEN casino guidance and advisories, each record shows...
FinCEN Red Flags for Insurance
25+ BSA red flags for insurance under 31 CFR § 1025. Based on FinCEN's insurance rule and related FinCEN advisories, eac...
FinCEN Red Flags for Investment Advisers
25+ red flags for investment firms. Based on FinCEN's investment adviser rule and related guidance, each record shows it...
FinCEN Red Flags for Precious Metals Dealers
20+ BSA red flags for DPMS under 31 CFR § 1027. Based on FinCEN's dealer rule at 31 CFR Part 1027 and related guidance, ...
FinCEN Red Flags for Real Estate
25+ BSA red flags for real estate under the FIN-2017-A003 Real Estate Advisory and GTO Orders. Sourced from 31 CFR § 101...
FinCEN Red Flags for Charities and Nonprofit Organizations
20+ red flags for nonprofits. Drawn from FIN-2014-A005, FinCEN's Hizballah financing alert (FIN-2024-Alert003), and FinC...
FinCEN Red Flags for Auto Dealers
15+ red flags for auto dealers, tied to Form 8300 and OFAC duties. Each flag includes its SAR checkbox and source citati...
Need Help Building Your AML Program?
Soflo Consulting provides end-to-end BSA/AML compliance solutions for regulated businesses across 13 industries. From risk assessments to annual training, we have you covered.