Money Mules and Structuring Red Flags
Money mule and structuring indicators are common AML red-flag categories. This page presents defensive indicators and evidence concepts only. It should not be used to teach avoidance of controls.
1. Defensive definitions #
A money mule is a person or account used to receive, move or transfer funds on behalf of others, often hiding the real beneficiary or origin of funds.
Structuring means splitting activity into smaller parts to avoid attention, reporting thresholds or internal controls. Local legal definitions vary.
2. Defensive indicators #
| Indicator type | Examples of concern |
|---|---|
| Account behaviour | Incoming funds quickly moved onward, limited normal activity, sudden change in use |
| Customer profile mismatch | Activity inconsistent with occupation, income, age, business model or stated purpose |
| Network pattern | Many unrelated counterparties, repeated pass-through behaviour, shared devices or addresses where available |
| Explanation issue | Vague or inconsistent explanation for funds or counterparties |
| Transaction pattern | Repeated small transfers, rapid in/out movement, unusual corridor or payment method |
3. Evidence concepts #
Evidence should focus on chronology, profile mismatch, source of funds, counterparties, communication records, account purpose and customer explanation where appropriate.
4. Caution #
A single indicator rarely proves suspicious activity. Assess combined behaviour, customer context, product, geography, timing and source evidence.
5. Source basis #
- SRC-FATF-001: FATF Recommendations and suspicious reporting framework.
- SRC-FFIEC-001: FFIEC monitoring and suspicious activity concepts.
- SRC-FINCEN-001: SAR narrative quality concepts.