Mortgage Red Flags

FinCEN Red Flags for Mortgage Lenders & Originators

35+ verified BSA red flags for mortgage companies under 31 CFR § 1029. Every flag traces to FIN-2012-A002 or the FFIEC Mortgage Examination Manual.

FinCEN-verified sources
SAR checkbox mapping
CFR citations included
Full-text searchable
About These Red Flags

FinCEN Red Flags for Mortgage Companies: What Compliance Officers Need to Know

Non-bank residential mortgage lenders and originators are required to maintain AML programs under 31 CFR § 1029.210, implemented by FinCEN in 2012. The mortgage industry faces unique money laundering risks involving down payment structuring, source of funds concealment, appraisal fraud, straw buyer arrangements, and rapid property flipping schemes.

FinCEN's FIN-2012-A002 advisory on mortgage fraud provides specific guidance on suspicious patterns including fabricated income documentation, Social Security number fraud, inflated appraisals, and third-party funding with no documented relationship. The FFIEC BSA/AML Examination Manual's mortgage section provides additional red flags for examiner review.

This page covers the most critical FinCEN red flags for mortgage companies, including cash structuring for down payments, wire transfers from cryptocurrency exchanges, elder financial exploitation through refinance coercion, and business entity funding that does not match GSE or FHA guidelines.

Featured Red Flags

36+ Verified BSA Red Flags

View All 36 in Library
CriticalMortgage|structuring

Borrower provides a large down payment in cash without a documented source of funds, or the funds are traced to a shell company or nominee account.

FIN-2012-A002 Mortgage Fraud|Suspicious activity
CriticalMortgage|wire activity

Borrower’s closing funds are wired from an account in the name of a third party with no familial or documented gift letter relationship to the borrower.

FIN-2012-A002 Mortgage Fraud|Wire transfer
CriticalMortgage|identity/KYC

Loan application contains fabricated or altered documents, including fake pay stubs, forged bank statements, or manipulated tax returns submitted to support the borrower’s qualification.

FIN-2012-A002 Mortgage Fraud|Identity verification concerns
CriticalMortgage|beneficial ownership

Real estate purchase is financed through a nominee borrower or straw buyer, where the true purchaser is a foreign PEP or sanctioned individual attempting to conceal their identity.

Kleptocracy Advisory|Beneficial ownership
CriticalMortgage|human trafficking

Property transaction involves a massage parlor, nail salon, or residential rental where the listed occupants match patterns of forced labor, including restricted movement and shared living quarters.

FIN-2018-A001 Human Trafficking|Human trafficking
CriticalMortgage|cyber/fraud

Closing instructions are altered via compromised email, redirecting wire transfer of closing funds to a fraudulent account controlled by an attacker, with the change appearing subtly different from the original.

FIN-2021-A001 Ransomware|Cyber event
CriticalMortgage|structuring

Property is purchased with a mortgage, then immediately listed for sale at a significantly higher price without any improvements, suggesting the transaction was used to inflate the property value for a subsequent fraud.

FIN-2012-A002 Mortgage Fraud|Suspicious activity
CriticalMortgage|customer behavior

PEP or family member purchases luxury real estate with funds that cannot be traced to legitimate salary, business income, or documented gifts from known sources.

Kleptocracy Advisory|PEP concern
CriticalMortgage|structuring

Borrower is the subject of a prior SAR filed by another financial institution for suspicious activity, and the new application does not disclose this history or explain the prior findings.

SAR Activity Review|Suspicious activity
HighMortgage|structuring

Down payment funds are sourced from multiple recent cash deposits into the borrower’s account, each below the $10,000 CTR threshold, with no legitimate income documentation.

FIN-2012-A002 Mortgage Fraud|Structuring
HighMortgage|unusual cash

Borrower brings a large sum of cash to closing that smells of marijuana, has unusual markings, or is wrapped in rubber bands and stored in a duffel bag rather than a bank envelope.

FIN-2023-A001 Fentanyl/Opioid|Suspicious activity
HighMortgage|wire activity

Business entity provides funds for a residential mortgage closing but is not a documented employer, investor, or permissible funding source under GSE or FHA guidelines.

FFIEC Exam Manual Mortgage Section|Wire transfer
FAQ

Common Questions About FinCEN Red Flags for Mortgage Companies

What FinCEN red flags apply to mortgage companies?

Mortgage companies must watch for: large down payments in cash with no documented source; down payment funds traced to shell companies or nominee accounts; multiple recent cash deposits each below the CTR threshold; wires from cryptocurrency exchanges with no prior trading history; stated income significantly higher than industry norms; fabricated or altered tax returns and pay stubs; inflated appraisals ordered by interested parties; and elderly borrowers coerced into refinancing by caregivers.

Do mortgage companies have to file SARs?

Yes. Under 31 CFR § 1029.320, mortgage lenders and originators must file SARs for suspicious transactions aggregating to $5,000 or more. This includes suspicious loan applications, down payment anomalies, wire fraud, identity fraud, and transactions involving PEPs or sanctioned individuals. SAR filing has been mandatory for mortgage companies since 2012.

What is mortgage fraud vs. money laundering?

Mortgage fraud involves misrepresentation or deception in the mortgage application process - such as fabricated income, inflated appraisals, or straw buyers. Money laundering involves making illicit proceeds appear legitimate. The two often overlap: a drug trafficker may use a straw buyer and fraudulent income documentation to purchase real estate with drug proceeds, committing both mortgage fraud and money laundering simultaneously. FinCEN's FIN-2012-A002 covers both types of red flags.

How do criminals use mortgage companies to launder money?

Criminals launder money through mortgages by: providing cash down payments from drug proceeds; using shell companies to fund residential purchases; inflating property values to extract equity; refinancing repeatedly to strip equity with no legitimate purpose; and using non-performing loans as a facade to move illicit funds into the U.S. financial system. PEPs may use mortgages to acquire U.S. real estate with government bank account funds.

What are the latest cyber fraud red flags in mortgage transactions?

Cyber fraud red flags in mortgages include: closing instructions altered via compromised email (BEC attacks); title companies receiving wires from accounts with slightly different names; borrowers' email accounts compromised with wire instructions changed to fraudulent accounts; and deepfake video calls used to verify identity for loan applications. The 2024 Deepfake Fraud Advisory (FIN-2024-A001) warns about AI-generated borrower verification videos.

AML Red Flag Library

Browse All 35+ Mortgage Red Flags

Access the complete AML Red Flag Library. Filter by mortgage-specific categories, risk levels, and FinCEN source documents.

Talk with Us