Investment Red Flags

FinCEN Red Flags for Investment Advisers

25+ red flags for investment firms. Based on FinCEN's investment adviser rule and related guidance, each record shows its attribution tier.

FinCEN & FFIEC sourced
SAR checkbox mapping
CFR citations included
Full-text searchable
Self-Paced Online Training
About These Red Flags

FinCEN Red Flags for Investment Advisers: What Compliance Officers Need to Know

The short answer

FinCEN red flags for investment advisers are the indicators that an account may be used to layer or integrate illicit funds. Examples include in-and-out transactions with no investment purpose, early redemptions despite lock-ups, and benefits paid to parties with no documented relationship to the client. SEC-registered advisers and exempt reporting advisers would be brought within the AML program framework by FinCEN's investment adviser AML rule (31 CFR Part 1032), whose effective date has been postponed to January 1, 2028.

Investment advisers were brought under BSA/AML requirements by FinCEN in 2015 under 31 CFR § 1024. The investment industry faces unique money laundering risks due to the complexity of investment products, the ease of cross-border fund movement, and the high value of transactions. Criminals exploit investment accounts for layering through penny stocks, early redemption schemes, and margin loan offshore transfers.

Common investment adviser red flags include in-and-out transactions, early redemptions despite lock-up periods, unrelated sector investments by corporate clients, income diversion to different payees, and unorthodox funding methods like cash delivered to the adviser's office.

This page covers the most critical FinCEN red flags for investment advisers, including synthetic identity onboarding, opaque feeder fund structures, penny stock layering, sanctions evasion through nominee fund structures, and PEP investments sourced from government bank accounts.

Featured Red Flags

27+ BSA Red Flags

View All 27 in Library
CriticalInvestment|identity/KYC

Synthetic identity passes initial onboarding but the client has no verifiable employment history, credit report, or prior banking relationships, despite claiming significant wealth.

FinCEN FTA Identity 2024|Identity theft
CriticalInvestment|identity/KYC

PEP client opens an investment account but the stated source of wealth cannot be verified through independent sources, and the assets appear disproportionate to known salary or business income.

Kleptocracy Advisory|PEP concern
CriticalInvestment|transaction monitoring

Client wires funds to the advisory account and immediately requests liquidation and wire-out to a different beneficiary, with no stated investment objective or time horizon.

FinCEN Investment Adviser Rule (89 FR 72156)|Money laundering
CriticalInvestment|transaction monitoring

Client requests that dividends, interest, or capital gains be paid to a different account or payee than the original funding source, with no documented gift, family, or legal reason for the diversion.

FinCEN Investment Adviser Rule (89 FR 72156)|Suspicious activity
CriticalInvestment|transaction monitoring

Advisory account for a corporate client shows investments in sectors completely unrelated to the client’s business, with no board resolution or documented investment policy authorizing the allocation.

FinCEN Investment Adviser Rule (89 FR 72156)|Suspicious activity
CriticalInvestment|beneficial ownership

Investment vehicle is owned by a series of shell companies in different jurisdictions, with each layer adding opacity, and the ultimate beneficial owner is a sanctioned individual or entity.

FFIEC Core Exam Manual|Beneficial ownership
CriticalInvestment|customer behavior

Client introduces another prospective investor who is a PEP or sanctioned individual, and attempts to facilitate account opening by vouching for them or offering to co-sign.

Kleptocracy Advisory|PEP concern
CriticalInvestment|cyber/fraud

Adviser receives an email purportedly from the client requesting a wire transfer of account assets to a new bank, but the email address contains a subtle domain variation and bypasses verbal confirmation.

FIN-2016-A003 E-Mail Compromise Fraud|Cyber event
CriticalInvestment|sanctions evasion

Foreign national uses a U.S.-domiciled investment fund to hold assets that are effectively controlled by a sanctioned individual, with the nominee structure designed to avoid OFAC screening.

FIN-2022-Alert003 Russian Export Control Evasion|Sanctions evasion
CriticalInvestment|customer behavior

PEP invests in a private equity fund with capital sourced from a government development bank in their home country, where the investment terms are disproportionately favorable and lack independent valuation.

Kleptocracy Advisory|PEP concern
HighInvestment|identity/KYC

Client provides a passport or driver’s license that fails document authentication checks, with the photo appearing artificially generated or manipulated using AI tools.

FIN-2024-Alert004 Deepfake Fraud|Identity verification concerns
HighInvestment|identity/KYC

Investment fund client is a legal entity registered in a secrecy jurisdiction with no audited financials, no website, and no verifiable officers or employees.

FinCEN Investment Adviser Rule (89 FR 72156)|Identity verification concerns
Escalation & Investigation

What to Do When a Red Flag Appears

Not every red flag is suspicious activity, and a single indicator never automatically requires a Suspicious Activity Report. What matters is a consistent, documented process for evaluating indicators before deciding whether to escalate or file. The steps below describe that process.

  1. 1

    Observe and record

    Capture what you saw: the customer, the transaction, the amount, the date, and the specific indicator that caught your attention. Contemporaneous notes are far more useful than a reconstruction weeks later.

  2. 2

    Compare against the expected profile

    Weigh the activity against what you already know about the customer, their business, and their normal transaction pattern. A single red flag outside context means much less than a pattern that contradicts the profile.

  3. 3

    Investigate before deciding

    A red flag is a reason to look closer, not a conclusion. Gather the supporting facts, ask reasonable questions, and review related activity across accounts, products, and time periods.

  4. 4

    Escalate through your procedure

    Route the review to your designated compliance officer or BSA officer using the escalation path documented in your program. Staff should never be left to decide on their own whether to report.

  5. 5

    Document the decision and the reasoning

    Whether you file or not, write down what you found, what you concluded, and why. Examiners look for a documented, consistent decision process, not a perfect outcome on every case.

  6. 6

    File a SAR when the facts support it

    If the facts meet the filing threshold and suggest illegal activity, evasion of the BSA, or no apparent lawful purpose, file the Suspicious Activity Report within the required timeframe. Filing is confidential.

  7. 7

    Retain records for the required period

    Keep the investigation notes, supporting documents, and a copy of any SAR filed for at least five years, consistent with BSA recordkeeping expectations for your industry.

This is an educational framework, not legal or regulatory advice. Your program and your regulator determine the exact escalation, filing, and retention requirements that apply to your business.

FAQ

Common Questions About FinCEN Red Flags for Investment Advisers

What FinCEN red flags apply to investment advisers?

Investment advisers must watch for: clients who wire funds and immediately request liquidation and withdrawal; early redemptions despite stated lock-up periods; investments in unrelated sectors with no board authorization; dividends diverted to accounts different from the funding source; unorthodox payment methods like cash or third-party checks; penny stock purchases immediately sold at a loss; margin loan proceeds wired offshore; and PEP clients whose wealth cannot be traced to legitimate sources.

Do investment advisers have to file SARs?

FinCEN's investment adviser AML rule, finalized in 2024, would require SEC-registered investment advisers and exempt reporting advisers to file SARs for suspicious transactions of $5,000 or more, and to maintain a written AML program, designate a compliance officer, provide ongoing training, conduct independent testing, and perform customer due diligence. The rule's effective date has been postponed to January 1, 2028, so advisers should prepare but are not yet subject to these requirements.

What are "in-and-out" transactions in investment accounts?

In-and-out transactions occur when a client wires funds to an investment account and immediately requests liquidation and wire-out to a different beneficiary, with no stated investment objective or time horizon. This pattern suggests the account is being used as a pass-through for money laundering rather than for legitimate investment purposes. In-and-out transactions are a widely recognized red flag for investment accounts.

How do criminals use investment accounts for layering?

Criminals layer funds through investment accounts by: purchasing thinly traded penny stocks and immediately selling at a loss to generate a paper trail; using margin accounts to borrow against securities and wire proceeds offshore; investing in private placements and requesting early redemption to extract funds; and directing dividends and capital gains to different accounts or payees than the original funding source. Each step creates a layer of separation between the illicit origin and the final destination.

What are PEP red flags for investment advisers?

PEP red flags for investment advisers include: clients whose stated wealth cannot be verified through independent sources; investments in private equity funds with terms disproportionately favorable to the PEP; funds sourced from foreign government-owned banks or ministries; family members or close associates used as account signatories to distance the PEP from transactions; and investments in sectors where the PEP's government role creates apparent conflicts of interest.

Primary Sources

Regulatory sources and guidance

Official Guidance

The indicators on this page draw on primary FinCEN, FFIEC, and federal regulatory material rather than third-party commentary. Always confirm current requirements against the official source.

Beyond the List

Knowing the red flags is only part of an effective AML program

For investment advisers, red flag recognition supports customer due diligence, monitoring, and a documented program that reflects the firm and its client base.

A documented, risk-based risk assessment
Written policies, procedures, and internal controls
A designated compliance officer or BSA officer
Ongoing employee training, including red flag recognition
Clear escalation and investigation procedures
Monitoring calibrated to the business and its risk profile
Independent review or testing where applicable
Investment Firm AML Compliance
Soflo Consulting, AML/BSA compliance services
AML Red Flag Library

Browse All 25+ Investment Red Flags

Access the complete AML Red Flag Library. Filter by investment-specific categories including in-and-out transactions, penny stock layering, and PEP concerns.