Red Flags Database

AML Red Flags Database

A structured reference of behaviours, transaction patterns, and structural indicators that may be suggestive of financial crime.

This AML Red Flags Database is designed as a structured reference tool to assist regulated entities, Virtual Asset Service Providers (VASPs), and compliance professionals in identifying behaviours, transaction patterns, and structural indicators that may be suggestive of money laundering, terrorist financing, or other forms of financial crime.

The presence of a red flag does not, in itself, establish illicit activity. Rather, it should be interpreted as a risk indicator requiring further assessment, escalation, and where appropriate, enhanced due diligence or regulatory reporting in accordance with applicable obligations.

Red Flag Categories

Indicators grouped by risk dimension

Customer Behaviour Red Flags

Certain customer behaviours may indicate an attempt to obscure identity, evade compliance controls, or avoid regulatory scrutiny. These behaviours should be assessed in conjunction with the overall risk profile of the customer relationship. Key indicators include:

  • Reluctance, refusal, or repeated delay in providing required identification or verification documentation
  • The creation or maintenance of multiple accounts without a clear commercial or legitimate rationale
  • Frequent changes to account details, including identity information, contact information, or linked payment instruments

Transaction Red Flags

Transaction-level anomalies are among the most common indicators of potential financial crime activity. These patterns often reflect attempts to disguise the origin, destination, or purpose of funds. Key indicators include:

  • Structuring of transactions to avoid detection thresholds or reporting requirements
  • Repeated use of round-number transfers without clear commercial justification
  • Rapid movement of funds through accounts or platforms with minimal holding periods (“pass-through” activity)

Wallet Red Flags

In the context of virtual assets, wallet-level exposure to illicit ecosystems represents a significant compliance risk factor. Key indicators include:

  • Direct or indirect exposure to cryptocurrency mixers or tumblers
  • Interaction with wallet addresses associated with sanctioned entities or designated persons
  • Links or transactional exposure to darknet marketplaces or illicit online services

Geographic Red Flags

Jurisdictional exposure remains a critical component of AML risk assessment, particularly in cross-border financial activity. Key indicators include:

  • Transactions involving high-risk jurisdictions as identified by international standard-setters or regulatory bodies
  • Exposure to countries subject to comprehensive economic or financial sanctions regimes

Corporate Red Flags

Corporate structures may be used to obscure beneficial ownership or facilitate the layering of illicit funds through legitimate business entities. Key indicators include:

  • The use of shell companies with no clear operational substance or economic activity
  • Unusually complex or opaque ownership structures lacking commercial rationale or transparency

NFT Red Flags

Non-Fungible Token (NFT) markets may be susceptible to manipulation techniques designed to distort asset valuation and create artificial trading activity. Key indicators include:

  • Wash trading, where assets are repeatedly traded between related or controlled parties to generate artificial volume or pricing signals
  • Self-purchases or transactions between interconnected wallets lacking independent economic purpose

Decentralised Finance (DeFi) Red Flags

Decentralised finance protocols present unique compliance challenges due to their open architecture and cross-chain functionality. Key indicators include:

  • Chain hopping, involving rapid movement of assets across multiple blockchains to obscure transactional traceability
  • Flash laundering techniques, whereby funds are rapidly cycled through protocols in short timeframes to obscure origin and ownership

Such behaviours may be indicative of identity concealment strategies or attempts to circumvent monitoring systems. Transaction patterns may be consistent with layering techniques used in money laundering processes. Wallet indicators may require immediate escalation and sanctions screening procedures. Geographic risk factors should be assessed in conjunction with customer profile and transaction behaviour. Corporate arrangements may warrant enhanced beneficial ownership verification and source-of-funds analysis. NFT behaviours may be indicative of market manipulation or laundering through digital collectibles. DeFi activity may significantly impede traditional transaction monitoring systems and require specialised blockchain analytics tools.