MSB Suspicious Activity Indicators: The Complete List
45+ suspicious activity indicators specifically for money services businesses. Drawn from the FFIEC Exam Manual and related FinCEN advisories — each record shows its attribution tier.
MSB Suspicious Activity Indicators: What Compliance Officers Need to Know
MSB suspicious activity indicators are the behaviors and transaction patterns that may signal money laundering, structuring, fraud, or sanctions evasion at a money services business. Examples include customers splitting transactions below reporting thresholds, rapid in-and-out movement of funds, and wires to or from high-risk jurisdictions. Indicators are evaluated against the customer profile before any reporting decision.
Money Services Businesses (MSBs) - including check cashers, money transmitters, currency exchangers, and prepaid card providers - are among the most heavily regulated non-bank financial institutions under the Bank Secrecy Act. The FFIEC BSA/AML Examination Manual and FinCEN advisories give extensive guidance on red flags relevant to MSBs.
MSBs face unique money laundering risks due to their high-volume cash transactions, cross-border wire transfers, and customer-facing operations that make them attractive targets for structuring, human trafficking networks, drug trafficking proceeds, and sanctions evasion schemes. The MSB suspicious activity indicators in this guide cover all major risk categories.
This page presents the most critical suspicious activity indicators for MSBs, including customer behavior patterns, transaction monitoring alerts, geographic risk factors, beneficial ownership concerns, and emerging threats like synthetic identity fraud and unemployment insurance benefit fraud.
54+ BSA Red Flags
Customer attempts to split a large cash transaction into multiple smaller transactions below the $3,000 recordkeeping threshold to avoid creating a paper trail.
Multiple customers visit the same location in rapid succession and each conducts a cash transaction just below the reporting threshold, suggesting a coordinated structuring scheme.
Wire transfers sent to or received from high-risk jurisdictions known for money laundering, with no apparent business or family connection to those countries.
Customer provides identification that appears altered, forged, or inconsistent with the person presenting it, including mismatched photos or expired credentials.
Corporate customer sends wires on behalf of undisclosed principals, or the stated beneficial owner is a nominee shareholder with no independent wealth or employment.
Transaction patterns show sudden and significant changes in volume, frequency, or typology that are inconsistent with the customer’s established activity profile.
Politically Exposed Person (PEP) or a close associate conducts large cash transactions that appear disproportionate to their known sources of income or legitimate wealth.
Multiple individuals use the same phone number or address to receive wire transfers, with none able to explain the source or purpose of the funds independently.
Funds are sent to or received from individuals, entities, or charities linked to designated terrorist organizations or individuals on OFAC SDN lists.
Customer uses virtual currency exchanges or mixers to obfuscate the origin or destination of funds, particularly involving sanctioned jurisdictions or SDN-listed individuals.
Customer reports that their online account was compromised and unauthorized wire transfers were initiated, with rapid fund movement to overseas accounts.
Customer receives funds and is instructed to convert them to virtual currency and send to a specific wallet address as part of a job offer, romance scheme, or investment opportunity.
What to Do When a Red Flag Appears
Not every red flag is suspicious activity, and a single indicator never automatically requires a Suspicious Activity Report. What matters is a consistent, documented process for evaluating indicators before deciding whether to escalate or file. The steps below describe that process.
- 1
Observe and record
Capture what you saw: the customer, the transaction, the amount, the date, and the specific indicator that caught your attention. Contemporaneous notes are far more useful than a reconstruction weeks later.
- 2
Compare against the expected profile
Weigh the activity against what you already know about the customer, their business, and their normal transaction pattern. A single red flag outside context means much less than a pattern that contradicts the profile.
- 3
Investigate before deciding
A red flag is a reason to look closer, not a conclusion. Gather the supporting facts, ask reasonable questions, and review related activity across accounts, products, and time periods.
- 4
Escalate through your procedure
Route the review to your designated compliance officer or BSA officer using the escalation path documented in your program. Staff should never be left to decide on their own whether to report.
- 5
Document the decision and the reasoning
Whether you file or not, write down what you found, what you concluded, and why. Examiners look for a documented, consistent decision process, not a perfect outcome on every case.
- 6
File a SAR when the facts support it
If the facts meet the filing threshold and suggest illegal activity, evasion of the BSA, or no apparent lawful purpose, file the Suspicious Activity Report within the required timeframe. Filing is confidential.
- 7
Retain records for the required period
Keep the investigation notes, supporting documents, and a copy of any SAR filed for at least five years, consistent with BSA recordkeeping expectations for your industry.
This is an educational framework, not legal or regulatory advice. Your program and your regulator determine the exact escalation, filing, and retention requirements that apply to your business.
More AML Red Flags by Industry
Common Questions About MSB Suspicious Activity Indicators
What are the top suspicious activity indicators for MSBs?
The top MSB suspicious activity indicators include: customers splitting transactions below the $3,000 threshold to avoid recordkeeping; rapid inflow/outflow of funds with no holding period; wires to or from high-risk jurisdictions; customers who ask about reporting thresholds; PEPs conducting transactions disproportionate to known income; multiple customers using the same phone number or address; and synthetic identity documents that fail verification checks.
Do MSBs have to file SARs for suspicious activity?
Yes. Under 31 CFR § 1022.320, most MSBs must file SARs when they detect suspicious transactions aggregating to $2,000 or more ($5,000 for certain issuer reviews of clearance records). Businesses that only cash checks are not covered by this rule, but may file voluntarily. This includes structuring, money laundering, terrorist financing, human trafficking, elder financial exploitation, and cyber events. MSBs must also file Currency Transaction Reports (CTRs) for cash transactions exceeding $10,000.
How do MSBs detect human trafficking through transactions?
MSBs should look for multiple individuals using the same phone number or address to receive wire transfers, with none able to explain the source of funds independently. Other indicators include incoming wires or prepaid loads from escort services, massage parlors, or short-term rental operations; and young individuals controlled by an older patron who handles all their cash and transactions.
What are the latest synthetic identity red flags for MSBs?
FinCEN's 2024 deepfake fraud alert (FIN-2024-Alert004) warns MSBs about AI-generated identification documents that show unnatural facial symmetry, inconsistent lighting, or mismatched security features. MSBs should also watch for biometric verification that fails liveness detection, and voice or video calls for high-value transactions that appear artificially generated.
More BSA Red Flags & Compliance Resources
BSA Red Flags List
427+ Bank Secrecy Act red flags covering every compliance category, industry, and risk level. Each flag cites a FinCEN, FFIEC, or federal so...
FinCEN Red Flags for Fintech Companies
35+ BSA red flags for fintech companies under 31 CFR § 1022. Drawn from FIN-2020-A007, the 2024 Financial Trend Analysis on identity, and Fi...
AML Red Flags by Industry
427+ BSA red flags organized by 13 regulated industries. Each entry is sourced from a FinCEN advisory, FFIEC manual, or federal regulation, ...
AML Red Flag Library
Browse all 427+ BSA red flags across 13 regulated industries. Searchable by keyword, filter by category, industry, or risk level.
Explore related AML-BSA compliance resources
Regulatory sources and guidance
Official Guidance
The indicators on this page draw on primary FinCEN, FFIEC, and federal regulatory material rather than third-party commentary. Always confirm current requirements against the official source.
Money services businesses, other than those that only cash checks, must file Suspicious Activity Reports (SARs) for transactions of $2,000 or more where the MSB knows, suspects, or has reason to suspect the transaction involves funds from illegal activity, is designed to evade the BSA, has no apparent lawful purpose, or involves use of the MSB to facilitate criminal activity.
Section 1022.210 is the core MSB AML program rule. It requires every money services business to develop and implement a written anti-money laundering program that is reasonably designed to prevent the MSB from being used to facilitate money laundering and the financing of terrorist activities. The program must include internal controls, a designated compliance person, ongoing employee training, and independent review.
Money services businesses must file a Currency Transaction Report (CTR) with FinCEN for each transaction in currency of more than $10,000, and for multiple currency transactions that total more than $10,000 in a single day when the MSB knows they are by or on behalf of the same person.
The FFIEC Bank Secrecy Act/Anti-Money Laundering Examination Manual provides detailed examination procedures used by federal and state regulators to evaluate financial institution BSA/AML compliance programs across all four pillars: internal controls, independent testing, designated BSA officer, and training.
Knowing the red flags is only part of an effective AML program
For money services businesses, red flag recognition is one pillar of a program that also needs a written AML policy, a designated compliance person, training, and independent review.
Browse All 45+ MSB Suspicious Activity Indicators
Access the complete AML Red Flag Library with 427+ BSA red flags. Filter by MSB-specific categories, risk levels, and FinCEN source documents.