Anti-money laundering red flags and risk assessments at financial institutions work as a single system: frontline monitoring flags customers, transactions, geographies, and digital-asset activity that don’t fit a legitimate profile, and the institution’s written risk assessment decides which of those signals get the heaviest scrutiny, the deepest due diligence, and the fastest escalation. Federal law requires that this work be risk-based, with “more attention and resources” directed toward higher-risk customers and activities.1Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority What follows is the catalog of signals compliance teams watch for, and how those signals feed the assessment that governs the program.
Customer and Identification Red Flags
Most warning signs appear before any money moves. Section 326 of the USA PATRIOT Act requires every institution to run a Customer Identification Program that verifies the identity of anyone opening an account.2Financial Crimes Enforcement Network. USA PATRIOT Act For individuals, that generally means an unexpired government-issued photo ID. For legal entities, it means formation documents, tax identification numbers, and identification of the people behind the structure.3Federal Deposit Insurance Corporation. FFIEC BSA/AML Examination Manual – Customer Identification Program
Behavioral cues at onboarding often matter as much as the documents. Watch for:
- Vague answers about how the customer earns money or funds the account.
- Refusal to supply a tax identification number.
- An address that traces to a commercial mailbox service.
- Altered documents — blurred text, mismatched fonts, inconsistent formatting.
- Unusual questions about what the institution reports to the government.
- Reluctance to identify the beneficial owners of a business entity.
- A customer who appears to be acting on someone else’s behalf without a legal basis for doing so.
When documents alone are not enough, institutions must verify identity through non-documentary means, which can include cross-referencing consumer reporting agencies, public databases, or other financial institutions.3Federal Deposit Insurance Corporation. FFIEC BSA/AML Examination Manual – Customer Identification Program
Beneficial Ownership
For corporate clients, the Customer Due Diligence Rule requires identifying every individual who owns 25% or more of the entity’s equity, plus any individual who exercises significant control, even if they own nothing.4Financial Crimes Enforcement Network. CDD Final Rule Shell companies and layered structures exist to obscure that question, so an entity with nominee directors, no clear operating business, and ownership traced to a secrecy-law jurisdiction should trigger enhanced due diligence from the start.
The Corporate Transparency Act created a national beneficial ownership registry at FinCEN, though a 2025 interim rule exempted domestic reporting companies from filing obligations. Foreign entities registered to do business in the United States still face reporting requirements. The institution’s own duty to identify and verify beneficial owners at account opening is unchanged by the registry’s status.
Transactional Red Flags
Once an account is active, monitoring shifts to how money moves. The clearest signal is structuring: deliberately breaking transactions into smaller amounts to stay under the $10,000 currency transaction reporting threshold set by 31 C.F.R. § 1010.311.5eCFR. 31 CFR 1010.311 – Filing Obligations for Reports of Transactions in Currency A customer depositing $3,500 in cash at three branches on three consecutive days is the textbook example. Structuring is a federal crime under 31 U.S.C. § 5324, punishable by up to five years in prison.6Office of the Law Revision Counsel. 31 USC 5324 – Structuring Transactions to Evade Reporting Requirement Prohibited
Other patterns worth flagging:
- Activity that doesn’t match what the customer said the account would do. A small retail business that told the bank it processes $20,000 a month in cash suddenly running $200,000 in a week is a glaring mismatch.
- Layering — funds moved rapidly through multiple accounts to obscure their origin. A wire arrives, gets split across five accounts within hours, and lands in offshore entities the customer never mentioned at onboarding.
- Money that bounces through an account without resting. Legitimate businesses hold funds for payroll, inventory, and operating expenses; pass-through activity with no commercial purpose has no innocent explanation.
- Six-figure wires through a normally dormant account.
Automated monitoring systems compare each customer’s current activity against their historical baseline and against peer-group benchmarks for similar account types, generating alerts when the numbers break pattern. The question analysts ask is simple: does this activity make sense given everything we know about this customer?
Virtual Currency and Digital Assets
The Anti-Money Laundering Act of 2020 brought businesses that exchange or transmit virtual currency under BSA obligations, and the Financial Action Task Force has identified virtual-asset red flags that apply to both crypto-native businesses and traditional institutions whose customers interact with digital assets.7Financial Action Task Force. Virtual Assets Red Flag Indicators of Money Laundering and Terrorist Financing Key signals include:
- Use of mixing or tumbling services designed to break the link between sender and recipient.
- Transactions involving privacy-focused cryptocurrencies that resist blockchain analysis.
- Rapid conversion of large sums between virtual currencies with no apparent business reason.
FinCEN issued a 2025 notice flagging convertible virtual currency kiosk activity specifically, including customers who structure cash deposits just below reporting thresholds across multiple kiosk locations, and situations where blockchain analysis links a customer’s transactions to wallets associated with fraud or other criminal activity.8Financial Crimes Enforcement Network. FinCEN Notice FIN-2025-NTC1 – CVC Kiosk Red Flags Traditional banks should also watch for customers who withdraw large cash amounts and mention being directed by someone online to deposit the funds at a crypto kiosk, a pattern closely associated with investment scams.
Geographic and Entity Risk
Where money comes from matters as much as how it moves. The Financial Action Task Force maintains two public lists that drive institutional risk decisions. The “black list” identifies high-risk jurisdictions subject to a call for countermeasures. As of early 2026, that list includes Iran, Myanmar, and North Korea. The “grey list” names jurisdictions under increased monitoring that have committed to resolving strategic deficiencies, and as of February 2026 includes 22 jurisdictions such as Algeria, Angola, Haiti, Lebanon, Syria, Venezuela, and Yemen.9Financial Action Task Force. Jurisdictions Under Increased Monitoring – 13 February 2026 Transactions involving these countries should trigger enhanced due diligence automatically.10Financial Action Task Force. Black and Grey Lists
Shell companies with no real operations, employees, or significant assets remain the favored tool for hiding who controls dirty money. The opacity of layered corporate structures, especially those registered in jurisdictions with strict bank secrecy laws, makes them inherently high-risk. Politically exposed persons, including foreign heads of state, senior government officials, and their close associates, warrant heightened scrutiny because of their access to public funds and vulnerability to corruption.
FinCEN also uses Geographic Targeting Orders to close specific loopholes. Current real estate GTOs require reporting on certain residential property transactions, particularly all-cash purchases not financed through an institution with its own AML program, across dozens of metropolitan areas in 14 states and the District of Columbia.11Financial Crimes Enforcement Network. Frequently Asked Questions Regarding Geographic Targeting Orders for Certain Real Estate Transactions High-value property has historically been used to integrate large sums of illicit cash into the legitimate economy.
Building the Risk Assessment
A risk assessment is not a single document filed and forgotten. It is the foundation the entire compliance program sits on. The assessment identifies which customers, products, services, and geographies expose the institution to the highest money laundering and terrorist financing risk, then determines how much monitoring and due diligence each category requires.12FFIEC BSA/AML InfoBase. BSA/AML Risk Assessment
A useful assessment requires specific data on every customer: legal names, dates of birth, tax identification numbers, expected transaction volumes, the types of products the customer plans to use, and the geographic footprint of their activity. For business accounts, add beneficial ownership information, the nature of the business, and whether it operates in a cash-intensive industry. This baseline is what monitoring systems measure against. Without it, anomaly detection has nothing to compare.
The institution’s own profile matters too. A community bank with a local deposit base faces different risks than an international correspondent banking operation or a money services business handling remittances to high-risk jurisdictions. Update the assessment whenever the institution enters new markets, launches new products, or sees significant changes in its customer base. Examiners look for assessments that actually drive resource allocation. A document that identifies high risks but doesn’t result in enhanced controls is worse than useless, because it proves the institution knew about the risk and failed to act.
When a Red Flag Becomes a SAR
When monitoring identifies activity that can’t be explained by the customer’s profile or any legitimate business purpose, the institution must file a Suspicious Activity Report. For national banks, filing is required when a known or suspected criminal violation involves $5,000 or more and a suspect can be identified, or $25,000 or more regardless of whether a suspect is identified.13eCFR. 12 CFR 21.11 – Suspicious Activity Report Any insider abuse — a director, officer, or employee involved in a violation — requires a SAR regardless of the dollar amount.
Filing goes through the FinCEN BSA E-Filing System, the only accepted method.14Financial Crimes Enforcement Network. Mandatory E-Filing FAQs FinCEN Form 111 requires transaction dates, amounts, instruments used, and a narrative explaining why the activity is suspicious.15Financial Crimes Enforcement Network. Bank Secrecy Act Filing Information That narrative is what law enforcement actually reads. Effective narratives stick to observed facts, describe what made the activity unusual compared to the customer’s baseline, and avoid speculation about the underlying crime. Vague or boilerplate narratives are a common deficiency examiners flag.
A bank must file within 30 calendar days of first detecting facts that may warrant a report. If no suspect has been identified at that point, the bank gets an additional 30 days to try to identify one, but filing cannot be delayed beyond 60 days from initial detection. When the activity involves an ongoing scheme requiring immediate attention, the bank must also notify law enforcement by phone in addition to filing the SAR.16eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions
After filing, the institution must retain a copy of the SAR and all supporting documentation for five years. Supporting documentation includes every record that helped the institution decide a SAR was warranted, whether or not each item is specifically referenced in the narrative.17Financial Crimes Enforcement Network. Suspicious Activity Report Supporting Documentation
What Non-Compliance Costs
The penalty structure runs on two tracks, civil and criminal, and both are now large enough to threaten institutional survival.
Under 31 U.S.C. § 5321, a financial institution or any partner, director, officer, or employee who willfully violates the BSA faces a civil penalty of up to the greater of $100,000 or $25,000 per violation.18Office of the Law Revision Counsel. 31 USC 5321 – Civil Penalties Negligent violations carry a $500 cap per incident, but a pattern of negligent violations can add up to $50,000 more. Violations involving international counter-money laundering requirements carry penalties between two times the transaction amount and $1,000,000. Federal banking regulators can also impose separate tiered civil money penalties under the Federal Deposit Insurance Act, with the highest tier exceeding $2.4 million per violation for knowing misconduct that causes substantial losses or gains.19Federal Register. Notice of Inflation Adjustments for Civil Money Penalties
Aggregate penalties dwarf these per-violation caps. FinCEN assessed a record $1.3 billion against TD Bank in 2024 after the bank willfully failed to file SARs on roughly $1.5 billion in suspicious transactions, alongside a four-year independent monitorship and a mandatory lookback review of missed filings.20Financial Crimes Enforcement Network. FinCEN Assesses Record $1.3 Billion Penalty Against TD Bank
On the criminal side, 31 U.S.C. § 5322 provides for fines up to $250,000, imprisonment up to five years, or both, for willful BSA violations.21eCFR. 31 USC 5322 – Criminal Penalties These apply to individuals: the compliance officer who knowingly ignores red flags, the executive who orders staff not to file, or anyone who facilitates a violation. Structuring under § 5324 carries the same five-year maximum. When BSA violations occur alongside other federal crimes like fraud or drug trafficking, sentences compound.