AML Red Flags and Suspicious Activity Reports

Money laundering is the process of making illegally obtained money look like it came from a legitimate source, and it almost always leaves behavioral traces even when no single transaction is obviously illegal. Anti-money-laundering (AML) programs are built around watching for those traces, called red flags, and reacting to them systematically rather than waiting for definitive proof of wrongdoing.

Common red flags include: structuring (breaking a large sum into many smaller transactions specifically to stay under reporting thresholds), rapid movement of funds through an account with no clear business purpose ("in and out" activity with little balance retained), transactions that don't match a customer's stated occupation or expected activity from their KYC profile, unusual involvement of high-risk jurisdictions, and a customer suddenly unwilling to explain the source of funds when asked. None of these alone proves laundering — a business owner might legitimately move money quickly, someone might genuinely receive an unexplained windfall — but the pattern, and a customer's reaction when questioned, is what compliance teams are trained to weigh.

When a red flag is serious enough, the firm files a Suspicious Activity Report (SAR) with the relevant financial intelligence unit — FinCEN in the US, equivalent bodies elsewhere. Critically, filing a SAR does not require certainty that a crime occurred; the legal standard is a reasonable suspicion, and firms are protected from liability for filing in good faith even if the suspicion turns out to be unfounded. SARs are also strictly confidential — a firm cannot tell the customer that a report was filed about them ("tipping off" is itself a separate offense), which is why an account might be quietly restricted or closed without the customer ever being told the real reason.

The asymmetry in the system is deliberate: the cost of over-reporting (a false positive investigated and cleared) is far lower than the cost of under-reporting (illicit money moving undetected through the legitimate system), so AML programs are built to flag liberally and let investigators sort out which reports matter.