Last reviewed 2 November 2026 against the sources linked in this post.
A customer pays in cash and, when you mention a form, suddenly decides to take half of it back. Another is happy to wait but cannot quite explain what their business does. You have seconds to notice, and a few minutes to pass it on. That noticing is what a red flag is for.
It matters because frontline reports feed real investigations. FinCEN's Year in Review says that in fiscal year 2025, 88.6% of IRS Criminal Investigation cases opened had one or more Bank Secrecy Act filings associated with the primary subject, and 79.7% of those cases were associated with suspicious activity reports. What you spot at the counter can end up in a file like that.
This post gives you 25 warning signs in 5 sets of 5. Each one comes from the FFIEC BSA/AML Examination Manual, Appendix F: Money Laundering and Terrorist Financing Red Flags, the list US bank examiners use. It then covers what to do next and what never to say to a customer. The appendix is written for banks, so credit unions and other institutions should check their own regulator's rules.
Why a red flag is not proof
Appendix F is clear on this point: the mere presence of a red flag is not by itself evidence of criminal activity. A red flag is a reason to look closer. Plenty of honest customers have an odd-looking pattern for a good reason, and it is not your job to decide which is which. Your job is to notice, note and pass it on.
Set 1: customer information
The first flags show up when someone opens an account or updates their details. All five are from the appendix category on customers who provide insufficient or suspicious information.
- Identification that cannot be readily verified. The appendix lists a customer who uses unusual or suspicious identification documents that cannot be readily verified.
- A taxpayer number that keeps changing. A customer uses different taxpayer identification numbers with variations of their name, or gives an individual taxpayer identification number after previously using a Social Security number.
- A business that will not explain itself. When opening a new account, the business is reluctant to give complete information about the nature and purpose of its business, anticipated account activity, its officers and directors, or its location.
- A background that does not fit. The customer's background differs from what you would expect given their business activities.
- Big money, no job. The customer makes frequent or large transactions and has no record of past or present employment.
Our pick: identification that cannot be verified. It is the first thing a teller can notice, and it needs no knowledge of the customer's finances, only the document in front of you.
Set 2: avoiding reporting or recordkeeping
The Bank Secrecy Act asks financial institutions to keep records of cash purchases of negotiable instruments and file reports of cash transactions. The first four flags come from the appendix category on efforts to avoid reporting or recordkeeping requirements, and the fifth from its category on other unusual customer activity. All five are about customers working around that. We state no thresholds here; your institution's policy and the regulator's pages hold the current figures.
- A request not to file. A customer or group tries to persuade a bank employee not to file required reports or maintain required records.
- A change of heart after a form. The customer is reluctant to give the information needed for a mandatory report, to have the report filed, or to go ahead with a transaction after being told a report must be filed.
- No identification for an instrument. The customer is reluctant to give identification when buying negotiable instruments in recordable amounts.
- A request for an exemption. A business or customer asks to be exempted from reporting or recordkeeping requirements.
- Splitting across branches. The appendix lists deposits structured through multiple branches of the same bank, or by groups of people who enter a single branch at the same time.
Our pick: splitting across branches. One teller sees one deposit. Only a team that shares what it notices sees the pattern, which is why this one rewards a good escalation habit.
Set 3: funds transfers
Wires are quick and cross borders easily, so the appendix gives them a section of their own.
- Round numbers. Many funds transfers are sent in large, round-dollar, hundred-dollar or thousand-dollar amounts.
- A destination with no reason. Transfer activity goes to or from a financial secrecy haven or higher-risk geographic location without an apparent business reason, or is inconsistent with the customer's business or history.
- Small in, everything out. Many small incoming transfers or deposits (using cheques and money orders) are received, then almost immediately all or most are wired to another city or country, in a way that does not match the customer's business or history.
- Payments linked to nothing. Payments or receipts have no apparent links to legitimate contracts, goods or services.
- One person, many accounts. Funds transfers are sent or received from the same person to or from different accounts.
Our pick: small in, everything out. The money never settles, and "almost immediately" is something you can see on the account screen.
Set 4: activity that does not fit the customer
Knowing your customer is a strong detector. These flags come from the appendix categories on activity inconsistent with the customer's business and other unusual customer activity.
- A sudden change. The currency transaction patterns of a business show a sudden change inconsistent with normal activities.
- Instruments the business cannot explain. A large volume of cashier's cheques, money orders or funds transfers is deposited into, or bought through, an account when the accountholder's business would not appear to justify it.
- Unlike its neighbours. A retail business has dramatically different patterns of currency deposits from similar businesses in the same general location.
- Money that outruns income. The customer makes high-value transactions not commensurate with their known income.
- A dormant account that wakes up. An account with little activity suddenly sees large deposit and withdrawal activity. The appendix also flags large deposits and withdrawals shortly after opening, followed by closing the account or it going dormant.
Our pick: a dormant account that wakes up. It needs no judgement about what is "normal" for the customer, only a look at the history, and it is easy to teach.
Set 5: lending, safe deposit boxes and staff
The last set covers three corners of a bank that frontline staff also see. The final two flags are about colleagues, from the appendix section on employees.
- Collateral held by strangers. Loans are secured by pledged assets held by third parties unrelated to the borrower.
- Someone else repays the loan. Loans are made for, or paid on behalf of, a third party with no reasonable explanation.
- Unusual safe deposit traffic. The customer shows unusual traffic patterns in the safe deposit box area, for example several people arriving together, entering frequently, or carrying bags or containers that could hide large amounts of currency or valuables.
- A colleague who never takes leave. An employee is reluctant to take a vacation.
- A colleague who overrides a hold. An employee overrides a hold placed on an account identified as suspicious so that transactions can occur.
Our pick: the colleague who never takes leave. It is the flag nobody wants to raise. In our reading, a scheme that needs one person's daily presence is harder to run when that person is away.
What to do next
A red flag calls for four calm steps. Frontline staff do not decide whether anything is reported, so follow your institution's policy for the detail.
- Note what you saw. Write down the date, what was said or done, and the transaction, in your own words and without guessing at motive.
- Escalate it internally. Pass it to your institution's BSA or AML officer through its own procedure. A report you do not make cannot join the pattern, which is why that FinCEN figure matters: 79.7% of the cases it describes were associated with SARs.
- Keep it confidential. Under 31 CFR 1020.320(e), no bank, and no director, officer, employee or agent of a bank, shall disclose a suspicious activity report or any information that would reveal its existence. In plain words, never tip a customer off, and do not mention it to colleagues who have no need to know.
- Carry on serving the customer normally. Do not refuse, question or confront them unless your policy says so. A calm, ordinary visit keeps you safe and leaves the decision with the people trained to make it.
FinCEN's FAQ on the suspicious activity report explains how reporting works once your compliance team takes it from there. If your role is reviewing alerts rather than the front line, our guide to AI fraud alert review training is the better next read.
Ways to host a red flag session with AhaSlides
A 20-minute live session turns this list into practice. Build the slides from the flags above.
- Pick Answer: "Red flag or normal?" Read out one flag at a time, for example "a retail business deposits far more cash than the shops around it", and let teams answer. Show a team leaderboard and reveal which appendix set it belongs to.
- Word Cloud: "What would make you uneasy at the counter?" The biggest words show what your branch notices first and what it overlooks.
- Rating Scale: "How confident are you that you know who to escalate to?" Ask for 1 to 5. A low average tells you the escalation route needs a refresher, not the flags.
- Open Ended: an anonymous question for the compliance officer. People ask the awkward ones when their name is hidden. For running it well, see our 9 tips for a successful Q&A session.
To make completion easy to prove, read how to track employee training completion.
Frequently asked questions
What are AML red flags?
They are warning signs in a customer, a transaction or a pattern that may point to money laundering and should be escalated. The FFIEC calls them examples of potentially suspicious activities that may warrant additional scrutiny.
What are examples of money laundering red flags?
Splitting deposits across branches, wires with no clear purpose, activity far above the stated business, and reluctance to give identification. Sets 1 to 5 above list 25 from the FFIEC appendix.
Is a red flag proof of money laundering?
No. The FFIEC appendix says a red flag alone is not evidence of criminal activity, only a reason to look closer.
What should a bank employee do if they see a red flag?
Escalate it internally under your institution's procedure and keep it confidential, as 31 CFR 1020.320(e) requires of banks for suspicious activity reports. Your BSA or AML officer takes it from there.
Can you tell the customer you are reporting them?
No. Suspicious activity reports are confidential under 31 CFR 1020.320(e), so never tip a customer off.
Where to start
Pick one set, read the five flags aloud at your next team huddle, and agree who each of you would call. If you only run one session this quarter, make it Set 2: the staff who deal with forms and reports are the ones who hear the excuses first.
This post is general information, not legal advice. For a decision about your own workplace, speak to a qualified employment lawyer or the regulator.
