BSA/AML Red Flags: Comprehensive Warning Signs Checklist

1. What is a BSA red flag?

A Bank Secrecy Act (BSA) red flag is a transaction pattern, customer behavior, or account anomaly that may indicate money laundering, structuring, fraud, terrorist financing, sanctions evasion, or other illicit financial activity. Red flags are the compliance officer's earliest warning system, they signal that a transaction or relationship warrants a closer look.

The critical distinction is that a red flag is an indicator, not evidence. No single red flag automatically proves illegal activity, and legitimate customers can and do trigger indicators for entirely benign reasons. The BSA framework expects institutions to evaluate red flags in context, against the customer's known profile and the nature of the business, before deciding whether to escalate or file a Suspicious Activity Report (SAR).

2. Customer identity red flags

Identity red flags arise during onboarding and ongoing monitoring, when the information a customer provides does not hold together or the customer resists verification. These are often the first sign of synthetic identity fraud, account takeover, or a deliberate attempt to obscure who is actually behind an account.

• Identification documents that appear altered, forged, or inconsistent with the person presenting them
• A customer who refuses to provide required identification or provides incomplete or suspicious documentation
• Frequent changes to name, address, phone number, or beneficial ownership in short succession
• Multiple accounts opened from the same device, IP address, or contact details
• Use of synthetic or "Frankenstein" identities that combine real and fabricated data

3. Transaction red flags

Transaction monitoring is the heart of BSA/AML compliance. The most useful signal is deviation, activity that departs from what would be expected of a similarly situated, legitimate customer.

• Sudden, significant changes in transaction volume, frequency, or typology without explanation
• Rapid movement of funds in and out of accounts with no holding period or business purpose
• Transactions that appear designed to create complex layering with no economic rationale
• Round-dollar transfers in high volume, particularly when inconsistent with the customer's profile
• Activity that bears no relationship to the stated purpose of the account or the customer's industry

4. Cash transaction red flags

Cash is the highest-risk payment method because it is difficult to trace and easy to conceal. Cash activity is not inherently suspicious, but unusual cash patterns, especially combined with threshold avoidance, are a core money laundering signal.

• Large cash deposits or withdrawals just below the $10,000 Currency Transaction Report (CTR) threshold
• Business cash deposits that are inconsistent with the nature of the business (a "business cash mismatch")
• Large volumes of small-denomination bills, or currency transported in unusual containers
• Frequent cash exchanges or conversions with no clear business or personal reason
• Customers who ask about reporting thresholds or how to avoid CTR filing

5. Structuring red flags

Structuring, also called "smurfing", is the deliberate breaking up of transactions to evade currency reporting requirements. It is a standalone federal crime under 31 U.S.C. § 5324, punishable even when the underlying funds are entirely legitimate.

• Cash transactions split into amounts just below the reporting threshold across days, branches, or locations
• Multiple individuals conducting coordinated threshold-avoiding transactions using shared addresses or phone numbers
• Sequential purchases of money orders, cashier's checks, or other monetary instruments that aggregate above the threshold
• A customer who changes a transaction amount after learning about the reporting threshold
• Deposits at multiple branches of the same institution on the same day to avoid aggregation

6. Wire transfer red flags

Wire transfers move funds across borders and institutions quickly, making them a favored tool for layering and moving value out of reach. The concern is not the wire itself but the parties, the jurisdiction, and the economic logic of the transfer.

• Wires to or from high-risk, weakly regulated, or sanctioned jurisdictions with no apparent connection
• Funds received and immediately re-wired to unrelated third parties or overseas beneficiaries
• Payments from or to parties with no documented relationship to the customer
• Wires structured through shell companies or intermediaries to obscure the true beneficiary
• Instructions that change repeatedly or arrive through intermediaries with no documented role

7. Business account red flags

Business accounts are attractive to criminals because they provide a legitimate-looking facade for illicit flows. Watch for entities whose structure or activity does not match their stated business.

• Shell companies with no physical presence, employees, website, or verifiable operations
• Business revenue or transaction volume that is incompatible with the stated industry or size
• Frequent changes to business name, ownership, or line of business shortly after onboarding
• Payments for goods or services that do not match the company's stated line of business
• Accounts opened by businesses whose principal activity appears to be passing through funds

8. Beneficial ownership concerns

The FinCEN Customer Due Diligence (CDD) rule requires covered institutions to identify and verify the beneficial owners of legal entity customers. Concealment of beneficial ownership is one of the strongest indicators that an entity is being used to hide the true party behind a transaction.

• A legal entity customer that is unable or unwilling to identify its beneficial owners
• Beneficial owners who are nominees with no independent wealth, employment, or connection to the business
• Complex, multi-layered ownership structures with no apparent business purpose
• Unusual or unexplained changes to beneficial ownership shortly before or after a transaction
• Entities registered in secrecy jurisdictions that cannot be verified through public records

9. Geographic risk indicators

Geographic risk reflects the money laundering and terrorist financing risk associated with a particular country or region. It is a risk factor to weigh, not a nationality test, legitimate customers transact with high-risk jurisdictions for legitimate reasons.

• Transactions involving countries under comprehensive OFAC sanctions
• Funds routed through jurisdictions on the FATF "high-risk" or "increased monitoring" lists
• Wires to or from known money laundering havens or bank secrecy jurisdictions
• Activity involving conflict zones or regions with significant terrorist financing risk
• Use of intermediaries in non-sanctioned countries to conceal a sanctioned jurisdiction connection

10. Fraud indicators

Fraud, including identity theft, account takeover, wire fraud, and increasingly AI-enabled synthetic fraud, is a growing share of suspicious activity reporting. FinCEN's 2024 Deepfake Fraud Advisory highlights how generative AI is being used to defeat identity verification.

• Unusual login patterns, account takeover, or credential-stuffing signals
• Biometric verification that fails liveness detection or appears artificially generated
• Last-minute changes to payment or wire instructions via compromised communication channels
• Customers or accounts linked to known fraud typologies, chargeback schemes, or stolen identities
• Documents or media that appear AI-generated or digitally manipulated

11. OFAC and sanctions indicators

OFAC sanctions apply to all U.S. persons and require screening customers, counterparties, and beneficial owners against the SDN List and other sanctions lists. Sanctions evasion is a priority enforcement area, and the patterns are increasingly sophisticated.

• Parties, beneficial owners, or counterparties that match or are linked to the OFAC SDN List
• Use of name variants, misspellings, or shell entities to avoid exact-match screening
• Funds routed through intermediaries or non-sanctioned jurisdictions to conceal a sanctioned connection
• Transactions involving virtual currency, mixers, or privacy coins with no legitimate explanation
• Shipments, transfers, or exports to comprehensively sanctioned jurisdictions

12. When to escalate activity

Escalation is the bridge between a red flag and a decision. A documented escalation process ensures that unusual activity is reviewed consistently and that the reasoning behind each decision is preserved.

• Evaluate the transaction as a whole rather than any single indicator in isolation
• Compare the activity against the customer's established, legitimate profile
• Escalate when multiple indicators align, or when a single high-significance indicator is present
• Document the facts observed, the customer's explanation, and the compliance decision
• Route escalation to the designated BSA/AML officer or a trained compliance reviewer

13. SAR considerations

A Suspicious Activity Report (SAR) is filed when, after review, an institution knows, suspects, or has reason to suspect that a transaction involves funds from illegal activity, is designed to evade BSA requirements, or has no apparent lawful purpose. Filing thresholds vary by institution type, for example, $5,000 for banks and $2,000 for MSBs and casinos, and certain activity, such as structuring or suspected terrorist financing, must be reported regardless of amount.

A SAR is a confidential report, not an accusation of guilt, and the decision to file is based on the totality of the circumstances rather than the presence of any single red flag.

• File when the facts, taken together, establish reason to suspect illicit activity
• Remember that structuring and terrorist financing have no dollar threshold
• Select all applicable SAR checkbox categories and write a clear, factual narrative
• Maintain the confidentiality of the SAR and the parties involved
• Document the review that led to, or away from, a filing decision

14. Employee training requirements

The BSA requires covered institutions to provide training to all personnel whose duties involve BSA/AML responsibilities. Front-line staff, tellers, relationship managers, and operations personnel, are the employees most likely to observe red flags first, so training should emphasize recognition and escalation over accusation.

• Provide annual training as a baseline, with more frequent, role-specific refreshers for front-line staff
• Cover structuring, unusual cash, wire, and beneficial ownership red flags relevant to the role
• Reinforce the internal escalation path so staff know exactly where to raise concerns
• Update training when FinCEN issues new advisories or the institution's risk profile changes
• Document training completion for examiner review

BSA Red Flags at a Glance

A quick reference for evaluating and escalating potential suspicious activity across common BSA/AML categories.

Individual red flags are not proof of criminal activity. Evaluate each indicator in context and against the customer\'s stated profile before escalating.