Indicators

Indicators, also known as risk indicators or red flags, are observable signs that suggest a particular technique is in use. Indicators provide obliged entities with a better understanding of possible illicit activity, in the expectation that this understanding will be useful in identifying high-risk business relationships and transactions.

Nominee shareholder details, including address or identification documents, are inconsistent or generic across official filings.

Nominee shareholder formally listed as owner but not actively involved in management or decision-making processes.

Large cash deposits into newly created or dormant corporate accounts lacking a discernible business purpose or supporting documentation.

No evidence of physical office location, employees, or operational staff for a registered entity claiming significant commercial activities.

Frequent turnover of directorship or beneficial ownership in corporate records without commercial justification.

Frequent cross-jurisdictional fund transfers in quick succession without documented business or operational purpose.

An account with historically low or stable activity that suddenly shows numerous small, structured transactions inconsistent with the account profile.

Transactions in incrementally varied amounts that remain below reporting thresholds but collectively accumulate to a large total.

High-volume or frequent fund transfers between entities lacking supporting documentation or a clear economic purpose.

Multiple companies established within a short time by the same service provider, all sharing identical or highly similar ownership structures.

Companies formed via corporate service providers without evidence of legitimate commercial purpose in their foundational documents.

Use of non-standard contractual or legal frameworks for private interest foundations that obscure beneficial ownership or deviate from typical norms.

Foundation financial records are non-transparent or inconsistent with standard practices for private wealth management.

Incomplete or vague documentation regarding the source of funds or underlying assets managed by the foundation, impeding due diligence.

Submission of templated or incomplete corporate documents during onboarding, inconsistent with standard business procedures.

Beneficial ownership records are vague, contradictory, or reliant on layers of proxy structures that obscure the ultimate owner.

Rapid account opening immediately after corporate registration, followed by abrupt closure after a short burst of transactions.

Entities established for a single-purpose transaction profile soon after incorporation, lacking evidence of broader operational activities.

Nominee shareholders or directors from secrecy-friendly jurisdictions with minimal regulatory oversight.

Discrepancies between beneficial ownership details in CDD records and the nominee information listed in corporate registries.

Shareholder agreements indicating that shares are held in trust or on behalf of undisclosed beneficial owners.

Interconnected financial transactions among newly formed entities with no documented commercial relationships.

Rapid and unexplained changes in transaction volumes that are inconsistent with the entity’s stated business activities.

Entity formed in a secrecy-friendly jurisdiction with minimal ownership disclosure requirements.

Use of mailing addresses, PO boxes, or virtual offices in registration documents, complicating verification of the entity’s physical location.

Multiple entities that share overlapping beneficial owners without a legitimate business justification for their interconnection.

Multiple entities with nearly identical addresses, incorporation timings, or naming conventions, suggesting coordinated formation.

Entities with minimal governance or operational capacity, lacking genuine business activities or evidence of commercial viability.

Inbound funds from high-risk or secrecy-friendly jurisdictions with no verifiable documentation or credible business rationale.

Recurring wire transfers from or to newly formed companies lacking clear evidence of actual business operations.

T0001.001
|
|

High-velocity movement of funds in and out, with minimal net retention in accounts.

T0001.001
|
|

Multiple companies linked to the same beneficial owner share similar corporate structures or addresses without a clear commercial rationale.

T0001.001
|
|

Official corporate records show no evidence of actual operations, such as missing invoices, contracts, or supplier payments.

T0001.001
|
|

The company’s registration date is significantly older than any verifiable evidence of business operations.

T0001.001
|
|

Frequent changes in beneficial ownership or the appointment of nominee directors shortly after the company’s acquisition.

T0001.001
|
|

Dormant accounts are suddenly reactivated for large, irregular financial transactions that do not align with any declared business purpose.

T0001.001
|
|

Bank accounts linked to the company show minimal routine transactions with sudden high-value deposits or transfers, inconsistent with normal business activity.

T0001.001
|
|

The company routes funds through offshore jurisdictions with limited transparency or regulatory oversight.

T0001.001
|
|

The company’s official address is a virtual office or mailbox service, lacking any physical presence or operational facilities.

The entity is incorporated and then dissolved within a short period, deviating significantly from typical business lifespans.

Bank accounts under the shell entity exhibit a burst of high-volume inbound and outbound transactions in a short timeframe prior to dissolution.

Incorporation records list nominee directors or show frequent changes in key management shortly after formation.

The registered address is associated with virtual offices or mail-forwarding services rather than a verifiable commercial location.

A high discrepancy exists between the declared business purpose on official filings and the complete lack of genuine commercial or operational activity.

Multiple ephemeral entities are formed and dissolved in close succession by the same principals, indicating a structured pattern to facilitate repeated laundering cycles.

Entities repeatedly created and dissolved by the same corporate service provider, suggesting professional facilitation of short-lived shells.

Frequent establishment of new legal entities across multiple jurisdictions with disparate regulatory environments in short time frames.

Complex ownership structures spanning multiple jurisdictions, involving layers of legal entities that obscure the ultimate beneficial owner.

Use of shell companies with no physical presence or employees in the jurisdictions where they are registered to conduct significant financial transactions.

Transactions involving entities based in jurisdictions with known weak regulatory frameworks or high levels of secrecy.

Frequent changes in company directors or beneficial owners across different jurisdictions without a clear business rationale.

Entities whose financial transactions are inconsistent with their stated business activities or industry norms, indicating a mismatch or discrepancy.

Use of intermediary entities with no apparent legitimate business function to facilitate transactions between parties in high-risk jurisdictions.

Involvement of professional intermediaries (e.g., lawyers, accountants, or corporate service providers) known for establishing complex multi-jurisdictional corporate structures.

Unusual patterns of fund movement through multiple legal entities across different jurisdictions in rapid succession.

Entities conducting transactions lacking a documented or logical economic rationale.

Missing or contradictory beneficial ownership information for entities involved in cross-jurisdictional transactions.

Multiple layering transactions across jurisdictions that obscure the origin and final beneficiary of funds.

Frequent changes in an entity’s registered address across multiple jurisdictions with no clear business justification.

Unusual volume or frequency of inter-company loans or transfers between related entities across different jurisdictions with minimal supporting documentation.

Use of nominee directors or shareholders with no direct involvement in company operations, particularly across multiple jurisdictions.

Excessive or unexplained intermediary service fees without a plausible business justification or service detail.

Frequent routing of funds through intermediary accounts that deviate from typical transaction flows and lack a documented economic rationale.

Use of multiple non-operational corporate vehicles or trusts through intermediaries to conceal the true beneficial owner.

Intermediaries submit incomplete, inconsistent, or unverifiable identification documents during due diligence reviews.

Repeated reliance on a single intermediary for multiple transactions inconsistent with a customer’s typical business profile, raising suspicion of layering.

Intermediaries operating from or connected to high-risk or non-cooperative jurisdictions flagged by due diligence checks.

Abrupt shifts in intermediary usage, including engagement of unverified or lesser-known brokers without a clear commercial justification.

Inconsistent or grouped intermediary-facilitated transactions featuring discrepancies in fees or beneficiary details, diverging from standard practices.

Multiple third-party signatories or proxies authorized on accounts without credible evidence of a legitimate role or business affiliation.

Transactions to or from addresses publicly identified as belonging to mixing services.

Consistent usage of anonymity-enhanced cryptocurrencies or privacy-focused features by a customer.

Multiple deposits from diverse cryptocurrency wallets converging into a single address or pool, consistent with typical mixer consolidation patterns.

Rapid consolidation of funds from multiple addresses, followed by immediate dispersal to new addresses, obscuring links between original sources and final recipients.

Transaction chains with repeated splitting and merging of funds in short intervals, consistent with layering via mixing techniques.

Unusually structured deposits and withdrawals (e.g., repeated identical amounts), consistent with typical mixing transaction patterns.

Transactions initiated through privacy wallets employing built-in mixing or anonymizing features (e.g., CoinJoin).

High volumes of inbound or outbound transactions from addresses associated with mixing services.

Customer accounts frequently transacting with known mixer addresses.

Frequent usage of mixing services by a customer with no prior history of such activity, deviating from their normal transaction profile.

Customer profiles lacking a verifiable source of funds while regularly interacting with mixing service platforms.

Transactions with custodial mixing services known to have minimal KYC requirements, hindering ownership traceability.

Frequent mixing transactions within short intervals, consistent with orchestrated layering of funds.

Use of addresses flagged as belonging to high-risk mixing services in multiple related transactions.

Transaction flows routed through mixing platforms spanning multiple jurisdictions, complicating compliance and traceability.

Frequent creation of one-time-use addresses specifically for mixing deposits or withdrawals, limiting any traceable transaction history.

T0003.001
|
|

Funds are transferred to an address identified as controlled by a custodial mixer operator.

T0003.001
|
|

Customer receives cryptocurrency from a different address than the one used for the deposit to the custodial mixer, indicating separation of funds.

T0003.001
|
|

Multiple small deposits to the custodial mixer, followed by consolidated withdrawals, indicating layering of funds.

T0003.001
|
|

Funds are deposited into a custodial mixer and withdrawn in quick succession, reflecting minimal holding periods.

T0003.001
|
|

A client with historically limited cryptocurrency activity suddenly begins using custodial mixer services.

T0003.001
|
|

Frequent use of custodial mixers with multiple unrelated withdrawal addresses in a short timeframe.

T0003.001
|
|

Discrepancies between the customer’s declared wallet details and the actual addresses used for custodial mixer deposits or withdrawals.

T0003.001
|
|

Anomalous discrepancies between amounts deposited and withdrawn through the custodial mixer, not aligning with typical service fees or exchange rates.

T0003.001
|
|

Frequent or high-value transactions directed to custodial mixers known to operate in jurisdictions with minimal AML/CFT oversight.

Absence of verifiable identity data or compliance oversight for funds transferred via non-custodial smart contracts, aligned with minimal or nonexistent KYC processes.

Rapid cross-chain transfers immediately following mixing transactions, where funds quickly move to decentralized exchanges or other platforms, indicating layering of transactions.

Transactions routing funds through smart contract addresses known to function as decentralized mixers, where funds from multiple sources are pooled and then redistributed.

Multiple small deposits from various unrelated wallets into a single mixer address followed by rapid, fragmented withdrawals to diverse wallets.

Frequent and consistent usage of decentralized mixing services by a wallet with no apparent economic or operational rationale.