Title & Escrow Companies AML Red Flags

Buyer attempts to pay closing costs or the entire purchase price in cash, particularly when the amount exceeds $10,000 and no bank draft or cashier’s check is provided.

LLC or trust purchases residential real estate entirely in cash, with no mortgage financing, and the beneficial owners are not disclosed or are foreign nationals from high-risk jurisdictions.

Closing funds are wired from an account that is not in the buyer’s name, with no gift letter, power of attorney, or other documentation authorizing the third-party funding.

Last-minute change to wire instructions sent via email that differs from previously verified instructions, particularly if the email domain is slightly altered or the signature block is missing.

Purchaser is a legal entity (LLC, trust, or corporation) and refuses to provide beneficial ownership information, or the provided information traces to shell companies with no physical presence.

PEP or close family member is listed as a beneficial owner of the purchasing entity, with funds sourced from a country with high corruption indices and no legitimate business justification.

Entity purchasing residential property operates a massage business, nail salon, or residential rental where the occupants match patterns of forced labor, with no legitimate commercial lease documentation.

Title company receives an email purportedly from the buyer’s attorney directing a change in wire destination, but the email address contains a subtle typographical variation from the legitimate domain.

Title company fails to file a SAR for a transaction that meets the 31 CFR Part 1031 permanent rule criteria: all-cash or wire purchase by a legal entity where the beneficial owner is not a U.S. person.

Under the permanent Part 1031 rule effective March 2026, a title company handles a residential real estate transaction funded by a trust where the settlor or beneficiaries are concealed or located in high-risk jurisdictions.

Foreign buyer uses a title company to purchase U.S. real estate and subsequently transfers the property to a family member or associate on the OFAC SDN list without filing a SAR.

PEP purchases luxury residential property in the U.S. using funds wired from a foreign government account or from a shell company linked to government contracts in their home country.

Buyer provides multiple cashier’s checks from different banks, each just under $10,000, to fund a single real estate closing, suggesting intentional structuring of the payment.

Buyer brings cash to closing in denominations commonly associated with drug trafficking (e.g., $20 bills in large quantities) and cannot explain the source of the funds.

Title company receives closing funds from an overseas entity in a jurisdiction with weak AML controls, and the wire memo references a property address that does not match the closing file.

Trust purchasing real estate has a protector or settlor who is a foreign national with no U.S. tax identification number, and the trust deed is not registered in any U.S. jurisdiction.

Buyer’s identification documents show signs of tampering, such as mismatched fonts, incorrect holograms, or a photo that does not resemble the person presenting them at closing.

Buyer purchases multiple properties in rapid succession, all funded by the same source, with no evidence of rental income, property management, or legitimate investment strategy.

Property is purchased well above market value with no appraisal justification, and the buyer appears unconcerned about the inflated price or refuses to negotiate.

Purchase occurs in a county or metropolitan area currently covered by a FinCEN Geographic Targeting Order, and the transaction matches the GTO criteria (cash, LLC, no mortgage).

Funds are wired from a jurisdiction that is subject to OFAC sanctions or a FinCEN advisory, and the source of funds cannot be verified through independent documentation.

Buyer expresses no interest in the property’s condition, location, or amenities, and does not request an inspection, appraisal, or walkthrough before closing.

Elderly seller is coerced into signing a quitclaim deed or power of attorney at closing by a caregiver or family member who then directs the proceeds to their own account.

Buyer’s email account is compromised, and the attacker sends wire instructions that bypass the title company’s verbal verification protocol by spoofing the buyer’s phone number via VOIP.

Commercial real estate purchase is funded by a business whose stated revenue is incompatible with the purchase price, with no audited financial statements or tax returns to support the funding source.

PEP’s family member purchases U.S. real estate through a trust or LLC and refuses to disclose the source of funds, which cannot be traced to legitimate salary, business income, or inheritance.

Buyer’s earnest money check is drawn on a closed account, is post-dated, or is from an account with no prior transaction history, suggesting the account was opened solely for this transaction.

Foreign buyer presents a passport from a country not commonly associated with U.S. real estate investment and provides no U.S. visa, green card, or other immigration documentation.

Buyer purchases property with cash and immediately takes out a home equity line of credit, converting the equity to liquid funds with no stated renovation or investment purpose.

Buyer is unwilling to attend closing in person and insists on using a remote notary or power of attorney from an individual with no prior relationship to the transaction.

Elderly buyer purchases property well above their means or in a distant location with no apparent reason, funded by a reverse mortgage or HELOC taken out under pressure.

Buyer’s wire for closing comes from a cryptocurrency exchange or digital asset custodian, with no prior relationship or explanation for the virtual currency holdings.