The Payroll Bureau's Suspicious Run of New Hires
You are the MLRO at a small payroll bureau serving 140 SME clients. Over six weeks, a newly onboarded client, Northbridge Staffing Ltd, has added 38 employees, all paid weekly into accounts at two banks in a jurisdiction your firm has flagged as higher risk. Each employee's net pay is between £410 and £480, and 31 of the 38 accounts were opened within the same three-week window. The client's stated business is construction labour supply, but no CIS deductions appear on the payroll file and the director has twice deferred the enhanced due diligence interview. The relationship manager argues the fees are valuable and the file is 'technically complete'. The client has now asked you to backdate three weeks of payroll submissions so the payments fall before a contract start date.
1. Identify the red flags in this file and explain why 'technically complete' onboarding is not the same as adequate customer due diligence here.
Read the worked answer
The flags cluster rather than sit alone, which is what raises this above routine monitoring. First, velocity and volume: 38 hires in six weeks for a firm with no trading history with you is a step change, not a trend. Second, the payroll profile is implausible for the stated sector - construction labour supply would normally generate CIS deductions, and their absence suggests either the business description is inaccurate or the workers are not genuinely employed in that trade. Third, the payment destination pattern: a high proportion of accounts opened in a short window at a small number of banks in a higher-risk jurisdiction is consistent with mule or nominee account networks, where wages are a cover for moving funds. Fourth, the net pay banding is unusually narrow, which can indicate fabricated salary levels designed to fit a template.
On CDD: a file can contain every required field - name, address, ID document, company search - and still fail the substantive test. The purpose of CDD is to understand who the customer is, what the money flow represents, and whether that story holds together. Here the director has deferred the EDD interview twice, which is itself a risk indicator: reluctance to explain source of funds and business model is exactly what EDD exists to test. The relationship manager's 'valuable fees' argument is a classic conflict - commercial pressure is not a mitigating factor and should never be recorded as one. The correct position is that the file is incomplete in substance, EDD should be completed before further processing, and the deferral should be documented as a risk event with a date by which the relationship will be exited if the interview is not held.
2. The client asks you to backdate three weeks of payroll submissions. How should you respond, and what is the supervisory and reporting logic behind that response?
Read the worked answer
You refuse, and you refuse in writing. Backdating payroll records is falsification of a business record regardless of whether the underlying payments are legitimate - the submission would misrepresent when the work was performed and when the liability arose. It also directly interferes with the audit trail that a supervisor or law enforcement would later rely on, and it would place the firm in the position of manufacturing evidence that the client's funds moved earlier than they did. If the client's genuine need is to align pay dates with a contract, the legitimate route is a prospective change to the pay cycle, documented and agreed.
The supervisory logic: your firm is a regulated business and the payroll file is part of your own record-keeping obligation, not merely the client's. A request to alter dates is a request to alter your records, so it engages your obligations directly. It is also a further risk indicator - a client seeking to move payments ahead of a contract date may be trying to place funds before scrutiny attaches, or to create a paper trail for money that has already moved.
On reporting: the backdating request, taken together with the account-opening cluster, the absent CIS deductions, and the deferred EDD, should be assessed as a whole. You should not report on the backdating request in isolation as if it were the only issue; the suspicion arises from the pattern. Make a suspicious activity report to the FIU if the threshold is met, do not tip off the client, and do not process the backdated run while the report is under consideration unless the relevant consent regime permits it. Record the decision, the date, and who approved it.