FinCEN Red Flags for Fintech & Payment Processors
35+ BSA red flags for fintech companies under 31 CFR § 1022. Drawn from FIN-2020-A007, the 2024 Financial Trend Analysis on identity, and FinCEN virtual currency guidance, each record shows its attribution tier.
FinCEN Red Flags for Fintech Companies: What Compliance Officers Need to Know
FinCEN red flags for fintech companies are the indicators that a payments, wallet, or neobank product may be used for fraud or money laundering. Examples include synthetic identities that pass onboarding, rapid in-and-out fund movement, and merchants processing volumes inconsistent with their stated business. Most fintechs are MSBs and must maintain a full AML program.
Fintech companies - including neobanks, peer-to-peer payment apps, digital wallets, and payment processors - are classified as money services businesses (MSBs) under the Bank Secrecy Act and must comply with all AML program requirements from day one. The fintech industry faces unique risks including synthetic identity fraud, transaction laundering, API credential breaches, and rapid account velocity schemes.
FinCEN's unemployment insurance fraud advisory (FIN-2020-A007), the 2024 Financial Trend Analysis on identity, and the ongoing virtual currency guidance provide the regulatory framework for fintech AML compliance. The fintech red flags on this page cover all major risk categories specific to digital financial services.
This page presents the most critical FinCEN red flags for fintech companies, including biometric verification bypass, device fingerprinting evasion, merchant settlement diversion, chargeback fraud, MCC code flipping, and cross-border sanctions evasion through cryptocurrency on-ramps.
34+ BSA Red Flags
Synthetic identity created using a real Social Security number combined with fabricated personal information passes initial KYC checks but fails deeper identity verification or credit bureau cross-referencing.
Biometric verification fails liveness detection: the user submits a high-resolution photo or deepfake video instead of a live capture, bypassing facial recognition controls.
Account shows rapid inflows and outflows (velocity) with funds passing through within minutes, showing no legitimate holding pattern consistent with normal payment or savings behavior.
Account is used to purchase virtual currency and immediately transfer it to an external wallet with no prior history of crypto trading, followed by rapid liquidation or mixing service use.
Customer reports unauthorized transactions after their account credentials were compromised, with login attempts from unfamiliar IP addresses, geolocations, or devices not previously associated with the account.
Fintech platform experiences a ransomware attack where customer data is exfiltrated and a cryptocurrency ransom demand is made, with subsequent dark web postings of stolen account information.
Fintech platform processes cross-border payments for customers using virtual currency to circumvent traditional banking channels and avoid sanctions screening in jurisdictions subject to OFAC restrictions.
Multiple prepaid debit cards are loaded with state unemployment insurance benefits using stolen or synthetic identities, then immediately used for ATM withdrawals or P2P transfers to a common recipient.
Customer uses a peer-to-peer payment app to receive funds from multiple users and immediately converts them to virtual currency, sending the crypto to a mixer or privacy coin wallet.
Customer uses a deepfake-generated video call to verify identity for a high-value account opening, with the synthetic persona mimicking a real person whose identity was stolen from social media.
Multiple accounts are opened in rapid succession using the same device, IP address, or phone number, with slight variations in name or date of birth to evade duplicate detection.
Account applicant provides a selfie or document photo that has been manipulated using AI tools, with telltale signs such as unnatural skin texture, inconsistent shadow direction, or missing security features.
What to Do When a Red Flag Appears
Not every red flag is suspicious activity, and a single indicator never automatically requires a Suspicious Activity Report. What matters is a consistent, documented process for evaluating indicators before deciding whether to escalate or file. The steps below describe that process.
- 1
Observe and record
Capture what you saw: the customer, the transaction, the amount, the date, and the specific indicator that caught your attention. Contemporaneous notes are far more useful than a reconstruction weeks later.
- 2
Compare against the expected profile
Weigh the activity against what you already know about the customer, their business, and their normal transaction pattern. A single red flag outside context means much less than a pattern that contradicts the profile.
- 3
Investigate before deciding
A red flag is a reason to look closer, not a conclusion. Gather the supporting facts, ask reasonable questions, and review related activity across accounts, products, and time periods.
- 4
Escalate through your procedure
Route the review to your designated compliance officer or BSA officer using the escalation path documented in your program. Staff should never be left to decide on their own whether to report.
- 5
Document the decision and the reasoning
Whether you file or not, write down what you found, what you concluded, and why. Examiners look for a documented, consistent decision process, not a perfect outcome on every case.
- 6
File a SAR when the facts support it
If the facts meet the filing threshold and suggest illegal activity, evasion of the BSA, or no apparent lawful purpose, file the Suspicious Activity Report within the required timeframe. Filing is confidential.
- 7
Retain records for the required period
Keep the investigation notes, supporting documents, and a copy of any SAR filed for at least five years, consistent with BSA recordkeeping expectations for your industry.
This is an educational framework, not legal or regulatory advice. Your program and your regulator determine the exact escalation, filing, and retention requirements that apply to your business.
More AML Red Flags by Industry
Common Questions About FinCEN Red Flags for Fintech
What FinCEN red flags apply to fintech companies?
Fintech companies must watch for: synthetic identities that pass initial KYC but fail deeper verification; biometric liveness detection bypass using deepfake photos; multiple accounts opened from the same device or IP address; rapid inflow/outflow of funds with no holding period; merchant settlement funds diverted to personal accounts; chargeback fraud schemes; MCC code changes to unrelated industries; and cross-border payments routed through cryptocurrency to avoid sanctions screening.
Are fintech companies required to have AML programs?
Yes. Most fintech companies - including payment apps, neobanks, money transmitters, and digital asset platforms - are classified as MSBs under 31 CFR § 1010.100 and must maintain a written AML program with the five BSA pillars: written policies, designated compliance officer, ongoing training, independent testing, and customer due diligence. This requirement applies from the first day of operation, not after reaching a certain transaction volume.
What is transaction laundering in fintech?
Transaction laundering occurs when a merchant uses a fintech payment processor to process payments for illegal goods or services while posing as a legitimate business. Red flags include: merchant transaction volumes far exceeding their stated business type; chargeback rates exceeding industry norms; payments from cardholders in unrelated geographic regions; and merchants who change their business description or MCC code shortly after onboarding to process different types of transactions.
How do fintech platforms detect synthetic identity fraud?
Synthetic identity fraud combines real data (like a valid Social Security number) with fabricated information to create a new persona. Fintech red flags include: applicants with no credit history despite claiming significant age and employment; device fingerprints matching multiple other applications; biometrics that fail liveness detection; and accounts that pass initial onboarding but show no normal usage patterns. FinCEN's 2024 FTA Identity Advisory provides detailed guidance on detecting synthetic identities in digital onboarding.
What are the latest fintech sanctions evasion red flags?
Sanctions evasion red flags for fintech include: customers using virtual currency to circumvent traditional banking channels and avoid OFAC screening; VPN or Tor access from sanctioned jurisdictions; name variants and spelling alterations to avoid exact-match sanctions screening; cross-border remittances routed through multiple fintech platforms in different countries; and stablecoin transfers to offshore exchanges with no apparent commercial purpose.
More BSA Red Flags & Compliance Resources
Cryptocurrency Money Laundering Red Flags
40+ red flags for detecting money laundering in cryptocurrency transactions. Drawn from FIN-2019-G001, FIN-2021-A004, and FinCEN virtual cur...
MSB Suspicious Activity Indicators
45+ suspicious activity indicators specifically for money services businesses. Drawn from the FFIEC Exam Manual and related FinCEN advisorie...
BSA Red Flags List
427+ Bank Secrecy Act red flags covering every compliance category, industry, and risk level. Each flag cites a FinCEN, FFIEC, or federal so...
AML Red Flag Library
Browse all 427+ BSA red flags across 13 regulated industries. Searchable by keyword, filter by category, industry, or risk level.
Explore related AML-BSA compliance resources
Regulatory sources and guidance
Official Guidance
The indicators on this page draw on primary FinCEN, FFIEC, and federal regulatory material rather than third-party commentary. Always confirm current requirements against the official source.
Section 1022.210 is the core MSB AML program rule. It requires every money services business to develop and implement a written anti-money laundering program that is reasonably designed to prevent the MSB from being used to facilitate money laundering and the financing of terrorist activities. The program must include internal controls, a designated compliance person, ongoing employee training, and independent review.
Money services businesses, other than those that only cash checks, must file Suspicious Activity Reports (SARs) for transactions of $2,000 or more where the MSB knows, suspects, or has reason to suspect the transaction involves funds from illegal activity, is designed to evade the BSA, has no apparent lawful purpose, or involves use of the MSB to facilitate criminal activity.
The FFIEC Bank Secrecy Act/Anti-Money Laundering Examination Manual provides detailed examination procedures used by federal and state regulators to evaluate financial institution BSA/AML compliance programs across all four pillars: internal controls, independent testing, designated BSA officer, and training.
OFAC administers and enforces U.S. economic and trade sanctions. All U.S. persons, including nonprofits, must comply with OFAC sanctions. Screening donors, grantees, vendors, and counterparties against the SDN List and other sanctions lists is the standard control, and they may need an OFAC license before operating in or sending funds to comprehensively sanctioned jurisdictions.
Knowing the red flags is only part of an effective AML program
For fintechs, red flag detection is one part of a program that also needs onboarding controls, transaction monitoring, sanctions screening, and training built for digital channels.
Browse All 35+ Fintech Red Flags
Access the complete AML Red Flag Library. Filter by fintech-specific categories including synthetic identity, transaction laundering, and cyber fraud.