Bank Secrecy Act Red Flags and High-Risk AML Transactions: A Practical Guide for Banks and Auditors
Recognizing Suspicious Activity Before It Becomes a Regulatory Problem
Banks and other financial institutions face continuing challenges in detecting money laundering, fraud, terrorist financing, and other illicit financial activity.
The Bank Secrecy Act (BSA) and related anti-money laundering and countering the financing of terrorism (AML/CFT) requirements establish a framework for identifying and reporting certain financial transactions and suspicious activities.
However, regulatory compliance requires more than maintaining written policies, collecting customer identification information, and filing required reports.
Financial institutions must understand their customers, identify unusual activity, investigate relevant red flags, and maintain internal controls appropriate to their risk profiles.
For community banks, regional institutions, and larger financial organizations, the challenge is particularly significant because suspicious activity may resemble legitimate customer transactions.
A BSA/AML red flag is not proof of money laundering. It is an indicator that activity may require further investigation.
An effective BSA/AML compliance program should help employees recognize these indicators, evaluate suspicious patterns, and escalate concerns before significant compliance failures occur.
1. What Is the Bank Secrecy Act?
The Bank Secrecy Act, enacted in 1970 and subsequently amended, is a foundational component of the United States' financial crime prevention framework.
The BSA and implementing regulations impose requirements on covered financial institutions concerning recordkeeping, reporting, and AML compliance programs.
For banks, important requirements include:
Establishing and maintaining an appropriate BSA/AML compliance program.
Implementing customer identification procedures.
Conducting customer due diligence.
Identifying and monitoring higher-risk customer relationships.
Filing Currency Transaction Reports when required.
Filing Suspicious Activity Reports when applicable.
Maintaining required records.
Providing appropriate employee training.
Conducting independent testing of the compliance program.
The Financial Crimes Enforcement Network (FinCEN) administers BSA regulations, while federal banking agencies examine banks for compliance with applicable requirements.
The objective is to help protect the financial system from misuse.
2. Understanding BSA/AML Red Flags
A red flag is a condition, transaction, behavior, or pattern that may indicate suspicious activity.
Red flags may involve:
Customer behavior.
Cash transactions.
Wire transfers.
Deposit and withdrawal patterns.
Business activity inconsistent with the customer's profile.
Unusual account relationships.
Transactions involving higher-risk jurisdictions.
Attempts to evade reporting or identification requirements.
A single red flag may have a legitimate explanation.
For example, a cash-intensive business may routinely deposit large amounts of currency.
However, repeated transactions inconsistent with the customer's expected activity may warrant additional investigation.
Banks should evaluate red flags in the context of the customer's business, expected activity, transaction history, and overall risk profile.
3. Cash Transaction Red Flags
Cash transactions remain an important area of BSA/AML monitoring.
Examples of potentially suspicious activity include:
Frequent deposits just below reporting thresholds. A customer repeatedly deposits amounts slightly below $10,000 without an apparent business explanation.
Unusual cash volume. A business deposits significantly more cash than expected based on its operations.
Rapid cash movement. Currency is deposited and quickly transferred to unrelated accounts.
Multiple branches. A customer conducts cash transactions at different branches in a pattern suggesting an attempt to avoid detection.
Unusual denominations. A customer presents large volumes of currency in denominations inconsistent with normal business activity.
Third-party deposits. Unrelated individuals make repeated cash deposits into the same account.
These patterns may warrant further review, particularly when they differ from established customer behavior.
4. Structuring: A Critical BSA Red Flag
Structuring involves conducting or attempting transactions in a manner intended to evade applicable BSA reporting requirements.
For example, a customer may divide a larger cash transaction into multiple smaller transactions to avoid a Currency Transaction Report.
Under generally applicable CTR rules, banks must report covered currency transactions exceeding $10,000 in a single business day, including multiple transactions that must be aggregated under the regulations.
A customer depositing $9,500 does not automatically indicate structuring.
The concern arises when the surrounding facts suggest an attempt to evade reporting.
Potential indicators include:
Repeated cash transactions near the reporting threshold.
Multiple transactions conducted on the same day.
Use of several branches or accounts.
Statements suggesting concern about government reporting.
Changes in transaction patterns after questions about reporting requirements.
Banks should investigate potential structuring without assuming that every transaction below the threshold is suspicious.
5. High-Risk Wire Transfer Activity
Wire transfers can facilitate legitimate commerce but may also be used to move illicit funds.
Potential red flags include:
Transfers inconsistent with the customer's known business.
Large incoming transfers followed by rapid outgoing transfers.
Transfers involving unexplained third parties.
Payments with unclear economic purposes.
Repeated transfers involving jurisdictions associated with elevated financial crime risks.
Transactions involving shell companies or opaque ownership structures.
Transfers with incomplete or inconsistent identifying information.
Unusual changes in beneficiaries or payment instructions.
For example, a small domestic retailer that begins sending substantial international wires to unrelated companies may warrant further review.
The bank should consider whether the transactions are consistent with the customer's business and whether legitimate supporting explanations exist.
6. Rapid Movement of Funds and Layering
Money laundering commonly is described in three stages:
Placement: Introducing illicit proceeds into the financial system.
Layering: Conducting transactions intended to obscure the source or ownership of funds.
Integration: Returning funds to the economy in a form that appears legitimate.
Potential layering indicators include:
Funds moving rapidly through multiple accounts.
Incoming deposits followed by immediate outgoing transfers.
Transactions involving numerous intermediaries.
Transfers with little apparent business purpose.
Repeated movement of funds among related entities.
Circular transactions returning funds to their original source.
Banks should evaluate whether transaction patterns have a reasonable economic explanation.
7. Customer Due Diligence Red Flags
Customer due diligence is fundamental to effective AML monitoring.
Potential warning signs include:
Reluctance to provide required identifying information.
Inconsistent explanations of business operations.
Unclear ownership or control structures.
Frequent changes in beneficial ownership.
Business activity inconsistent with stated operations.
Unexplained sources of funds.
Use of multiple entities without a clear business purpose.
Customer activity substantially different from the expected account profile.
Banks should maintain procedures for identifying customers and understanding the nature and purpose of customer relationships.
Customer information should be updated on a risk basis, including when relevant facts indicate that existing information may no longer be reliable.
8. Higher-Risk Customers and Businesses
Certain customer characteristics, products, services, or activities may present elevated money laundering risks.
Examples may include:
Money services businesses.
Cash-intensive businesses.
Certain privately owned ATMs.
Businesses with complex ownership structures.
Customers conducting significant international transactions.
Customers with significant exposure to higher-risk jurisdictions.
Politically exposed persons, depending on the circumstances.
Businesses operating in industries vulnerable to fraud or illicit finance.
These categories do not automatically establish suspicious activity.
A risk-based approach considers the customer's actual operations, geographic exposure, products, services, controls, and transaction behavior.
Higher risk should lead to appropriately tailored due diligence and monitoring—not automatic assumptions of wrongdoing.
9. Suspicious Activity Involving Business Accounts
Business accounts may be used to disguise illicit activity within apparently legitimate commercial transactions.
Potential indicators include:
Payments unrelated to the customer's stated business.
Large transfers without supporting invoices or contracts.
Frequent transactions with newly established companies.
Payments involving businesses with common ownership but no apparent commercial purpose.
Significant account activity shortly after account opening.
Transactions inconsistent with reported revenue.
Payments to individuals unrelated to normal operations.
For example, a small consulting company receiving substantial cash deposits may warrant review if cash receipts are inconsistent with its stated business model.
The bank should examine the facts before determining whether further action is necessary.
10. Fraud and AML: Understanding the Connection
Fraud and money laundering frequently intersect.
Fraud generates illicit proceeds that criminals may attempt to move, conceal, or convert through financial institutions.
Examples include:
Business email compromise: Fraudsters impersonate executives or vendors to redirect payments.
Account takeover: Criminals obtain unauthorized access and transfer funds.
Check fraud: Fraudulent or altered checks are deposited and proceeds withdrawn or transferred.
Elder financial exploitation: Vulnerable customers are manipulated into transferring money.
Synthetic identity fraud: Criminals use fabricated or combined identity information to establish accounts.
Investment fraud: Victims transfer funds to accounts controlled by fraudsters.
BSA/AML monitoring should be coordinated with the bank's fraud prevention and investigation functions.
Relevant information should be shared through authorized channels while maintaining appropriate confidentiality.
11. Suspicious Activity Reports: When Is a SAR Required?
Suspicious Activity Reports are an essential component of the BSA reporting framework.
For banks, SAR obligations depend on the nature of the activity, applicable dollar thresholds, and the relevant regulatory requirements.
Generally, a bank must evaluate transactions conducted or attempted by, at, or through the institution when it knows, suspects, or has reason to suspect activity involving potential violations of law, evasion of BSA requirements, or transactions lacking an apparent lawful or business purpose.
For many covered suspicious transactions, the general reporting threshold is $5,000 when the bank identifies a suspect or the activity otherwise meets the applicable regulatory criteria. Different thresholds apply to certain categories, including insider abuse and violations without an identified suspect.
A SAR generally must be filed within 30 calendar days after initial detection of facts that may constitute a basis for filing. A limited extension may apply when no suspect is identified, subject to the regulatory maximum.
Banks should consult the applicable regulations and regulatory guidance for the precise thresholds, deadlines, and exceptions.
A red flag does not automatically require a SAR.
The bank must evaluate the relevant facts and determine whether the applicable reporting criteria are met.
SAR confidentiality is critical. Banks must not improperly disclose a SAR or information that would reveal its existence.
12. Transaction Monitoring: Moving Beyond Basic Rules
An effective transaction monitoring program should reflect the bank's risk profile.
Monitoring may include:
Cash transaction analysis.
Wire transfer surveillance.
Unusual account activity detection.
Customer risk-based monitoring.
Structuring scenarios.
Rapid movement of funds.
Significant deviations from expected activity.
High-risk customer activity.
Suspicious transaction relationships.
Monitoring systems may use rules-based scenarios, statistical methods, and advanced analytics.
However, the effectiveness of monitoring depends on more than software.
Banks should evaluate:
Data completeness: Are all relevant transactions included?
Scenario design: Do monitoring rules address the bank's actual risks?
Thresholds: Are parameters appropriately calibrated?
Alert investigation: Are unusual transactions reviewed by qualified personnel?
Documentation: Are conclusions supported by relevant facts?
Escalation: Are potential SAR matters promptly referred for review?
Quality assurance: Are missed alerts, false positives, and monitoring weaknesses evaluated?
A sophisticated monitoring platform cannot compensate for unreliable data or ineffective investigation procedures.
13. Responsibilities of Bank Management
Bank management is responsible for establishing and maintaining an effective BSA/AML compliance program.
Management should ensure that:
BSA/AML risks are appropriately assessed.
Policies and procedures address identified risks.
Monitoring and reporting systems operate effectively.
Customer due diligence requirements are implemented.
Compliance personnel have adequate authority and resources.
Significant deficiencies are corrected.
Required training is provided.
The Board receives meaningful information about compliance risks.
Management should not treat BSA compliance as the sole responsibility of the BSA Officer.
The compliance function depends on coordinated responsibilities across operations, lending, deposit services, information technology, fraud prevention, and senior management.
14. Responsibilities of the BSA Officer
The designated BSA Officer is responsible for coordinating and monitoring the bank's day-to-day BSA/AML compliance program.
Responsibilities commonly include:
Overseeing compliance policies and procedures.
Coordinating customer due diligence processes.
Supervising suspicious activity monitoring.
Managing SAR and CTR processes.
Maintaining appropriate documentation.
Coordinating employee training.
Communicating significant issues to management and the Board.
Monitoring regulatory developments.
Supporting examinations and independent testing.
The BSA Officer should have sufficient authority, expertise, staffing, and access to information.
A designated officer cannot compensate for inadequate institutional support.
15. Responsibilities of Internal Audit
Independent testing is a fundamental element of a bank's BSA/AML compliance program.
Internal Audit, or another qualified independent testing function, should evaluate whether the program is appropriately designed and operating effectively.
A risk-based review may address:
The BSA/AML risk assessment.
Customer identification and due diligence.
Customer risk ratings.
CTR completeness, accuracy, and timeliness.
SAR identification, investigation, and reporting processes.
Transaction monitoring scenarios and data quality.
Higher-risk customer monitoring.
Staff training.
Record retention.
Management's remediation of previous findings.
Internal Audit should evaluate the design and operating effectiveness of relevant controls.
Testing should be sufficiently independent from the activities being examined.
An effective BSA audit does not simply determine whether policies exist. It evaluates whether the bank's controls actually operate as intended.
16. Responsibilities of the Audit Committee
The Board of Directors has ultimate oversight responsibility for the bank's BSA/AML compliance program.
The Audit Committee may assist the Board through responsibilities delegated in its charter.
Important oversight questions include:
Has management completed an appropriate BSA/AML risk assessment?
Does the bank's monitoring program address its significant risks?
Are SAR and CTR processes operating effectively?
Does the BSA Officer have sufficient authority and resources?
Has independent testing identified significant deficiencies?
Are repeat findings receiving appropriate attention?
Are corrective actions completed and validated?
Are significant regulatory examination findings escalated?
Does the Board receive meaningful BSA/AML performance reporting?
Are emerging financial crime risks incorporated into the compliance program?
The Audit Committee should not assume responsibility for individual SAR decisions or day-to-day compliance operations.
Its role is to provide oversight, challenge management when appropriate, and ensure significant issues receive attention.
17. Common BSA/AML Internal Control Deficiencies
Examples of weaknesses that may create significant compliance exposure include:
Incomplete or outdated customer risk assessments.
Failure to monitor significant changes in customer activity.
Inadequate investigation of transaction monitoring alerts.
Insufficient documentation supporting SAR decisions.
Untimely required reporting.
Weak controls over monitoring data completeness.
Inadequate staffing of the BSA compliance function.
Poor coordination between fraud and AML teams.
Repeated independent testing findings.
Failure to implement corrective actions.
Inadequate Board reporting.
A deficiency's severity depends on the facts, its impact, the associated risks, and applicable supervisory criteria.
Not every control weakness constitutes a regulatory violation.
However, unresolved weaknesses can accumulate and undermine the effectiveness of the compliance program.
18. A Practical BSA/AML Red Flag Review Exercise
Consider a community bank with approximately $175 million in assets.
A business customer historically deposits $25,000 per month, primarily through checks and electronic payments.
Over the past six weeks, the customer has:
Made numerous cash deposits.
Increased total monthly deposits substantially.
Initiated several international wire transfers.
Transferred funds shortly after deposits.
Provided inconsistent explanations for the increased activity.
The bank's monitoring system generates multiple alerts.
Questions for the Compliance Officer
What does the customer's current risk profile indicate?
Are the transactions consistent with the customer's known business?
Has the bank identified a reasonable explanation for the activity?
Do the transactions suggest potential structuring or layering?
What additional records or information should be reviewed?
Does the activity meet applicable SAR reporting criteria?
Questions for Internal Audit
Did the monitoring system identify the transactions promptly?
Were all relevant transactions included in the monitoring population?
Were the alerts investigated and documented?
Was the SAR decision appropriately supported?
Were applicable reporting deadlines considered?
Were identified control weaknesses escalated?
Questions for the Audit Committee
Does this case indicate a broader monitoring weakness?
Are similar patterns being identified across the bank?
Does the BSA Officer have sufficient resources?
Are significant compliance deficiencies receiving management attention?
Does independent testing provide appropriate assurance concerning the monitoring program?
The objective is to evaluate both the suspicious activity and the effectiveness of the bank's BSA/AML control framework.
The Bottom Line
BSA/AML compliance requires banks to identify, evaluate, and respond to financial activity that may involve money laundering, fraud, or other illicit conduct.
Red flags are important because they direct attention toward transactions that may require further investigation.
But red flags are not conclusions.
Effective compliance depends on risk-based customer due diligence, reliable transaction monitoring, qualified personnel, sound investigations, appropriate reporting, independent testing, and Board oversight.
The most important question is not whether the bank has a list of BSA red flags. It is whether the bank has effective controls to identify, investigate, and respond to suspicious activity.
For management, compliance officers, Internal Audit, and Audit Committees, that distinction is fundamental to an effective BSA/AML compliance program.
Comments