AML Red Flags for Title Companies and Escrow Professionals

1. Buyer red flags

The behavior of the buyer is often the first signal that a closing warrants a closer look. Indicators are not proof of wrongdoing, but a reason to document and, where appropriate, escalate.

• A purchaser who shows little or no interest in the property's condition, location, or price
• A buyer who cannot be reached for independent verbal confirmation of identity or wiring details
• A buyer whose stated source of wealth or income is inconsistent with the transaction value
• Last-minute changes to the named buyer or beneficial owner without a documented reason
• A buyer who insists on remote notarization or power of attorney executed by an unrelated party

2. Seller red flags

Sellers can also be a source of warning signs, particularly when the sale appears designed to move value rather than to transfer property for a legitimate purpose.

• A seller who accepts a price significantly below market value without negotiation
• A seller who requests that proceeds be wired to multiple accounts or to a third party
• Rapid resale of a property shortly after purchase with no meaningful improvement or explanation
• A seller who is reluctant to provide identification or whose identity documents are inconsistent
• Unusual assignment of the sales contract shortly before closing to a different party

3. Funding red flags

How a transaction is funded, and by whom, is central to detecting money laundering. Funds that cannot be tied to the parties of record are a recurring feature of illicit activity.

• Unusual third-party payments from parties with no documented relationship to the buyer
• Funds from multiple unrelated individuals or entities pooled into a single purchase
• Wires from accounts in a different name without a gift letter, power of attorney, or other explanation
• Payments inconsistent with the customer's known profile or stated source of wealth
• Unexplained foreign transfers, particularly from high-risk or sanctioned jurisdictions

4. Wire transfer red flags

Wire fraud and business email compromise are among the most immediate and costly risks in a closing. Criminals intercept legitimate closing instructions and redirect funds to accounts they control.

• Last-minute changes to wire instructions sent by email with a slightly altered domain
• Requests to redirect closing funds to an account different from the one originally provided
• A party who resists verbal confirmation of new wiring details through a known channel
• Wiring instructions that arrive from a personal email rather than the title or escrow company's domain
• Refunds requested to an account or party different from the original source of funds

5. Escrow account risks

Escrow and trust accounts are a natural target because they hold large sums temporarily and can be used to move value while appearing to serve a legitimate closing. Overpayment-and-refund schemes are a classic sign.

• Overpayments at closing followed by a request to refund the excess to a different account
• Earnest money from a closed, freshly opened, or post-dated account
• Multiple cashier's checks from different banks, each just under $10,000
• Cash payments in small-denomination bills with no documented source
• Requests to split escrow disbursements across accounts with no legitimate purpose

6. Entity ownership red flags

Legal entities and trusts are the most common tool for concealing the true owner of real estate. A legitimate buyer may hold property in an LLC for asset protection, but opaque ownership is a meaningful warning sign.

• Purchases through newly formed LLCs, trusts, or shell companies with no operating history
• Opaque LLC ownership with no clear, disclosed natural-person beneficial owner
• Entities registered in secrecy jurisdictions or that cannot be verified through public records
• Layered ownership where one entity owns another with no apparent business purpose
• Beneficial owners who are nominees, unrelated third parties, or politically exposed persons

7. Beneficial ownership concerns

Beneficial ownership refers to the natural person who ultimately owns or controls an entity, trust, or arrangement, even when title is held in a different name. Concealed beneficial ownership is a recurring feature of money laundering and sanctions evasion.

For title companies under an active Geographic Targeting Order, identifying and reporting the beneficial owners of legal entities making covered non-financed purchases is a specific regulatory duty. For all transactions, a reluctance to provide beneficial ownership information is itself a red flag.

• Refusal to provide beneficial ownership information or supporting documentation
• Unusual or unexplained changes to beneficial ownership shortly before or after closing
• Beneficial owners who are not the individuals directing the transaction
• Discrepancies between the entity's stated purpose and the transaction

8. Foreign purchaser concerns

Foreign buyers are a large and legitimate segment of the U.S. real estate market, but cross-border transactions introduce geographic risk that warrants enhanced due diligence. The concern is not the buyer's nationality but the jurisdiction of the funds and the transparency of ownership.

• Funds originating from jurisdictions with weak anti-money laundering controls
• Wires from accounts in countries subject to sanctions or FinCEN advisories
• Purchasers who are foreign nationals with no U.S. tax identification, visa, or business presence
• Requests to structure ownership through offshore entities or foreign trusts
• Beneficial owners who are politically exposed persons from high-corruption jurisdictions

9. Fraud and business email compromise

Business email compromise (BEC) is a primary fraud risk in real estate closings. Attackers compromise the email of a buyer, seller, realtor, or attorney and send fraudulent wiring instructions that redirect funds. Because closings are time-sensitive and involve large sums, BEC is disproportionately successful here.

Robust defense relies on procedure rather than judgment calls: verify any change to wiring instructions through an independent, out-of-band channel using a previously known phone number, and never rely on contact details supplied in the same suspicious message.

• Emails with slightly altered domain names (e.g., a single character changed)
• Sudden urgency or pressure to wire funds immediately to meet a deadline
• Instructions to change the receiving account at the last minute
• A party who cannot be reached by phone for independent confirmation
• Grammatical errors or unusual phrasing in what appears to be a legitimate email thread

10. OFAC risks

OFAC sanctions apply to all U.S. persons, including title companies, escrow agents, and closing attorneys. Title and escrow professionals should screen buyers, sellers, entities, and beneficial owners against the SDN List and other sanctions lists, and be alert to activity that suggests an attempt to evade sanctions through property transactions.

• Buyers or beneficial owners who appear on or are linked to the OFAC SDN List
• Transfers structured through intermediaries or entities to obscure a sanctioned party's involvement
• Funds wired from comprehensively sanctioned jurisdictions
• Requests to transfer property or proceeds to a family member or associate subject to sanctions

11. Real Estate Reporting Rule considerations

Title companies should understand the distinction between three things: the Geographic Targeting Orders, the (now vacated) Residential Real Estate Reporting rule, and general risk-management best practices.

FinCEN's Geographic Targeting Orders (31 CFR § 1010.370) are temporary, county-specific, and renewed on a rolling basis; they require title insurance companies to identify and report beneficial owners of legal entities purchasing covered residential real estate without financing. Because the covered counties and dates change, verify the current status for the specific jurisdiction of each transaction.

In August 2024, FinCEN finalized a broader Residential Real Estate Reporting rule (31 CFR Part 1031) that would have created a nationwide requirement. On March 19, 2026, a federal district court in Flowers Title Companies, LLC v. Bessent vacated that rule nationwide, and FinCEN confirmed reporting entities are not currently required to file under it. Compliance professionals should monitor this area as it remains subject to litigation and possible rulemaking.

12. Employee escalation procedures

A single red flag is rarely conclusive, but a pattern of indicators is a reason to look closer and escalate. Title and escrow firms should have a documented process for reviewing unusual transactions and recording what was found.

• Evaluate the transaction as a whole rather than any single indicator in isolation
• Document the parties, the source of funds, and the ownership structure
• Escalate internally to a compliance officer, manager, or designated BSA contact when multiple indicators align
• For covered transactions under any GTO that is in force, follow its specific identification and reporting requirements
• Retain records consistent with applicable recordkeeping obligations and state licensing rules

13. AML training for title and escrow employees

Title agents, escrow officers, and closing coordinators are most likely to observe the earliest warning signs, so training should focus on recognition and escalation rather than accusation. Staff should understand the difference between a legitimate cash purchase and one that warrants scrutiny.

• Provide role-specific training on entity, funding, and beneficial ownership red flags
• Cover OFAC screening obligations and any applicable GTO reporting duties
• Include business email compromise and wire-fraud prevention as a recurring module
• Reinforce the internal escalation path so staff know exactly where to raise concerns
• Document training completion and refresh content as FinCEN guidance and rules evolve

Title & Escrow Red Flags at a Glance

A quick reference for evaluating and escalating potential suspicious closing activity.

Individual red flags are not proof of criminal activity. Evaluate each transaction in context and against the parties\' stated profile before escalating.