FinCEN Red Flags for Mortgage Lenders & Originators
35+ BSA red flags for mortgage companies under 31 CFR § 1029. Drawn from FIN-2012-A009 and FinCEN mortgage fraud reporting, each record shows its attribution tier.
FinCEN Red Flags for Mortgage Companies: What Compliance Officers Need to Know
FinCEN red flags for mortgage companies are the indicators that a residential mortgage transaction may involve fraud or money laundering. Examples include down payments with no documented source, funds traced to shell companies or crypto exchanges, and income or appraisals that do not match reality. Covered lenders and originators are subject to AML program and SAR requirements under 31 CFR Part 1029.
Non-bank residential mortgage lenders and originators are required to maintain AML programs under 31 CFR § 1029.210, implemented by FinCEN in 2012. The mortgage industry faces unique money laundering risks involving down payment structuring, source of funds concealment, appraisal fraud, straw buyer arrangements, and rapid property flipping schemes.
FinCEN's advisory on mortgage loan fraud (FIN-2012-A009) and related guidance address suspicious patterns such as fabricated income documentation, Social Security number fraud, inflated appraisals, and third-party funding with no documented relationship. The FFIEC BSA/AML Examination Manual's mortgage section provides additional red flags for examiner review.
This page covers the most critical FinCEN red flags for mortgage companies, including cash structuring for down payments, wire transfers from cryptocurrency exchanges, elder financial exploitation through refinance coercion, and business entity funding that does not match GSE or FHA guidelines.
36+ BSA Red Flags
Borrower provides a large down payment in cash without a documented source of funds, or the funds are traced to a shell company or nominee account.
Borrower’s closing funds are wired from an account in the name of a third party with no familial or documented gift letter relationship to the borrower.
Loan application contains fabricated or altered documents, including fake pay stubs, forged bank statements, or manipulated tax returns submitted to support the borrower’s qualification.
Real estate purchase is financed through a nominee borrower or straw buyer, where the true purchaser is a foreign PEP or sanctioned individual attempting to conceal their identity.
Property transaction involves a massage parlor, nail salon, or residential rental where the listed occupants match patterns of forced labor, including restricted movement and shared living quarters.
Closing instructions are altered via compromised email, redirecting wire transfer of closing funds to a fraudulent account controlled by an attacker, with the change appearing subtly different from the original.
Property is purchased with a mortgage, then immediately listed for sale at a significantly higher price without any improvements, suggesting the transaction was used to inflate the property value for a subsequent fraud.
PEP or family member purchases luxury real estate with funds that cannot be traced to legitimate salary, business income, or documented gifts from known sources.
Borrower is the subject of a prior SAR filed by another financial institution for suspicious activity, and the new application does not disclose this history or explain the prior findings.
Down payment funds are sourced from multiple recent cash deposits into the borrower’s account, each below the $10,000 CTR threshold, with no legitimate income documentation.
Borrower brings a large sum of cash to closing that smells of marijuana, has unusual markings, or is wrapped in rubber bands and stored in a duffel bag rather than a bank envelope.
Business entity provides funds for a residential mortgage closing but is not a documented employer, investor, or permissible funding source under GSE or FHA guidelines.
What to Do When a Red Flag Appears
Not every red flag is suspicious activity, and a single indicator never automatically requires a Suspicious Activity Report. What matters is a consistent, documented process for evaluating indicators before deciding whether to escalate or file. The steps below describe that process.
- 1
Observe and record
Capture what you saw: the customer, the transaction, the amount, the date, and the specific indicator that caught your attention. Contemporaneous notes are far more useful than a reconstruction weeks later.
- 2
Compare against the expected profile
Weigh the activity against what you already know about the customer, their business, and their normal transaction pattern. A single red flag outside context means much less than a pattern that contradicts the profile.
- 3
Investigate before deciding
A red flag is a reason to look closer, not a conclusion. Gather the supporting facts, ask reasonable questions, and review related activity across accounts, products, and time periods.
- 4
Escalate through your procedure
Route the review to your designated compliance officer or BSA officer using the escalation path documented in your program. Staff should never be left to decide on their own whether to report.
- 5
Document the decision and the reasoning
Whether you file or not, write down what you found, what you concluded, and why. Examiners look for a documented, consistent decision process, not a perfect outcome on every case.
- 6
File a SAR when the facts support it
If the facts meet the filing threshold and suggest illegal activity, evasion of the BSA, or no apparent lawful purpose, file the Suspicious Activity Report within the required timeframe. Filing is confidential.
- 7
Retain records for the required period
Keep the investigation notes, supporting documents, and a copy of any SAR filed for at least five years, consistent with BSA recordkeeping expectations for your industry.
This is an educational framework, not legal or regulatory advice. Your program and your regulator determine the exact escalation, filing, and retention requirements that apply to your business.
More AML Red Flags by Industry
Common Questions About FinCEN Red Flags for Mortgage Companies
What FinCEN red flags apply to mortgage companies?
Mortgage companies must watch for: large down payments in cash with no documented source; down payment funds traced to shell companies or nominee accounts; multiple recent cash deposits each below the CTR threshold; wires from cryptocurrency exchanges with no prior trading history; stated income significantly higher than industry norms; fabricated or altered tax returns and pay stubs; inflated appraisals ordered by interested parties; and elderly borrowers coerced into refinancing by caregivers.
Do mortgage companies have to file SARs?
Yes. Under 31 CFR § 1029.320, mortgage lenders and originators must file SARs for suspicious transactions aggregating to $5,000 or more. This includes suspicious loan applications, down payment anomalies, wire fraud, identity fraud, and transactions involving PEPs or sanctioned individuals. SAR filing has been mandatory for mortgage companies since 2012.
What is mortgage fraud vs. money laundering?
Mortgage fraud involves misrepresentation or deception in the mortgage application process - such as fabricated income, inflated appraisals, or straw buyers. Money laundering involves making illicit proceeds appear legitimate. The two often overlap: a drug trafficker may use a straw buyer and fraudulent income documentation to purchase real estate with drug proceeds, committing both mortgage fraud and money laundering simultaneously. This page covers both types of red flags.
How do criminals use mortgage companies to launder money?
Criminals launder money through mortgages by: providing cash down payments from drug proceeds; using shell companies to fund residential purchases; inflating property values to extract equity; refinancing repeatedly to strip equity with no legitimate purpose; and using non-performing loans as a facade to move illicit funds into the U.S. financial system. PEPs may use mortgages to acquire U.S. real estate with government bank account funds.
What are the latest cyber fraud red flags in mortgage transactions?
Cyber fraud red flags in mortgages include: closing instructions altered via compromised email (BEC attacks); title companies receiving wires from accounts with slightly different names; borrowers' email accounts compromised with wire instructions changed to fraudulent accounts; and deepfake video calls used to verify identity for loan applications. FinCEN's 2024 deepfake fraud alert (FIN-2024-Alert004) warns about AI-generated borrower verification videos.
More BSA Red Flags & Compliance Resources
AML Red Flags for Title Companies
30+ BSA red flags specifically for title companies, escrow agents, and closing attorneys. Sourced from FinCEN advisories, GTO orders, and th...
FinCEN Red Flags for Real Estate
25+ BSA red flags for real estate under the FIN-2017-A003 Real Estate Advisory and GTO Orders. Sourced from 31 CFR § 1010.370 and FinCEN res...
AML Red Flags by Industry
427+ BSA red flags organized by 13 regulated industries. Each entry is sourced from a FinCEN advisory, FFIEC manual, or federal regulation, ...
AML Red Flag Library
Browse all 427+ BSA red flags across 13 regulated industries. Searchable by keyword, filter by category, industry, or risk level.
Explore related AML-BSA compliance resources
Regulatory sources and guidance
Official Guidance
The indicators on this page draw on primary FinCEN, FFIEC, and federal regulatory material rather than third-party commentary. Always confirm current requirements against the official source.
FinCEN's final rule requires all non-bank residential mortgage lenders and originators (RMLOs) to establish and maintain a written anti-money laundering (AML) program including policies, a designated BSA officer, annual training, and independent review. Covered RMLOs must also file Suspicious Activity Reports (SARs) when they detect suspicious transactions.
Section 1029.210 codifies the specific AML program requirements for residential mortgage lenders and originators: written policies and procedures, a designated compliance officer, ongoing employee training, and independent testing. This is the operative regulatory text that FinCEN examiners cite in enforcement actions.
The FFIEC Bank Secrecy Act/Anti-Money Laundering Examination Manual provides detailed examination procedures used by federal and state regulators to evaluate financial institution BSA/AML compliance programs across all four pillars: internal controls, independent testing, designated BSA officer, and training.
FinCEN's Customer Due Diligence (CDD) Rule requires covered financial institutions to identify and verify beneficial owners of legal entity customers, understand the nature and purpose of customer relationships, and conduct ongoing monitoring to detect and report suspicious transactions. Codified at 31 CFR § 1010.230.
Knowing the red flags is only part of an effective AML program
For residential mortgage lenders and originators, red flag monitoring is required alongside a written AML program, a designated compliance officer, training, and independent review under 31 CFR Part 1029.
Browse All 35+ Mortgage Red Flags
Access the complete AML Red Flag Library. Filter by mortgage-specific categories, risk levels, and FinCEN source documents.