Typologies and Red Flags Across Financial Crime Threats
Typologies and Red Flags Across Financial Crime Threats
This domain tests recognition of threat-specific patterns and, more importantly, differentiation. Terrorist financing does not look like laundering, sanctions evasion is not the same as high-risk geography, and a single red flag is not a finding.
Core rules
- Money laundering stages are placement, layering and integration. In bank data the stages usually overlap and placement is often already complete before you see it.
- Fraud patterns: authorised push payment scams, business email compromise with lookalike domains and payment diversion, and mule accounts showing rapid in-and-out movement with many unrelated counterparties.
- Terrorist financing: small amounts, charitable or non-profit fronts, cash couriers, low-value remittances, fundraising and foreign fighters. Volume is a poor signal; purpose and destination matter.
- Sanctions evasion: obfuscated ownership, AIS gaps, ship-to-ship transfers, re-invoicing through intermediaries, dual-use goods.
- Corruption: PEPs, state contracts, consultants and intermediaries, lifestyle inconsistent with declared salary.
- Human trafficking: commingling of business and personal funds, repeated cash deposits at the same branch, payments to recruitment or transport businesses.
- Trade-based laundering: over- and under-invoicing, phantom shipments, multiple invoicing for one consignment.
- Environmental crime: illegal logging, waste and fishing, indicated by vessel flags, company structures and documentation gaps.
Worked example
A student account receives $8,000 from three unrelated senders and forwards $7,800 within hours to a crypto exchange, twice in one month. Red flags: profile mismatch, rapid pass-through, unrelated senders, high-risk destination. This is a mule signature rather than terrorist financing and not an ordinary remittance. Each flag alone is weak, but the combination and the velocity make suspicion reasonable and the case reportable.
Traps that cost marks
- Treating one red flag as proof of a predicate offence.
- Applying laundering typologies to terrorist financing and missing small-value patterns.
- Profiling by nationality or culture instead of using behavioural indicators.
- Forgetting that red flags can have legitimate explanations, such as a genuine cash-intensive business.