Red Flags Library

Purpose#

This library gives practical indicators that should increase risk, trigger EDD or support MLRO escalation. Red flags are not proof of wrongdoing. They are prompts for deeper review.

Severity scale#

Customer identity red flags#

• Customer avoids providing basic identity information.
• Documents are expired, inconsistent or unverifiable.
• Customer uses multiple names, transliterations or unexplained aliases.
• Registered address is a mass registration address without plausible business explanation.
• Customer refuses to explain purpose of relationship.

Beneficial ownership red flags#

• Ownership chain is unusually complex for a simple business.
• Nominee shareholders/directors are used without clear commercial reason.
• Control appears to sit outside formal ownership documents.
• UBO changes shortly before onboarding or transaction.
• Trust, foundation or holding structure lacks clear settlor/protector/beneficiary information.

PEP red flags#

• Customer or UBO is a foreign PEP with unexplained wealth.
• Customer is a close associate or family member of a high-risk PEP.
• Wealth source is inconsistent with public income or declared business activity.
• PEP status is hidden until adverse media or screening reveals it.
• Customer seeks urgent onboarding or transaction before EDD completion.

Sanctions / TFS / CPF red flags#

• Name, identifiers or ownership link match a sanctions target.
• Customer is owned or controlled by a sanctioned person or entity.
• Goods, route, vessel, bank or intermediary connects to restricted geographies or sectors.
• Transaction appears structured to avoid sanctions screening.
• Counterparty uses shell companies, transshipment or unclear end user in a PF-sensitive trade.

Adverse media red flags#

• Credible reports of fraud, corruption, organised crime, sanctions evasion or financial crime.
• Regulatory enforcement or criminal proceedings involving customer/UBO/director.
• Repeated allegations across credible and independent sources.
• Media is recent and directly connected to the proposed relationship.
• Customer explanation contradicts public record.

Transaction red flags#

• Activity is inconsistent with customer profile or declared purpose.
• High-value transaction with no clear economic rationale.
• Circular movement of funds with no obvious commercial purpose.
• Payments from or to unrelated third parties.
• Rapid pass-through of funds.
• Frequent changes to payment instructions.
• Split payments that appear linked.

Crypto/VASP red flags#

• Exposure to sanctioned wallet, darknet market, mixer, scam, ransomware or high-risk exchange cluster.
• VASP is unlicensed or claims licensing in a market that does not regulate the activity.
• Customer cannot explain source of crypto funds.
• Wallet movement appears designed to obscure trail.
• Funds originate from multiple newly created wallets and converge before fiat off-ramp.

TBML red flags#

• Price inconsistent with market value without commercial explanation.
• Goods description is vague or inconsistent across invoice, contract and shipping documents.
• Trade route is unnecessarily complex.
• Counterparty has no apparent experience in the traded goods.
• Payment route does not match goods route.
• Multiple intermediaries are added without economic rationale.
• Goods are dual-use, restricted, high-value, portable or easy to misdescribe.

Reviewer warning#

A single red flag may be explainable. Several red flags across different categories should increase risk and may justify EDD or MLRO escalation.

Digital infrastructure and DNS red flags#

• Public DNS records contradict the customer's declared operating geography.
• MX records point to a provider in a higher-risk or restricted geography without explanation.
• SPF/TXT records include unexplained email relays, SaaS vendors or legacy providers.
• NS, SOA or CNAME records reveal infrastructure dependencies inconsistent with the customer profile.
• PTR records reveal hosting provider names or geography inconsistent with the declared footprint.
• Digital infrastructure exposure appears together with adverse media, sanctions proximity, opaque UBOs or source-of-funds inconsistencies.

These indicators should be treated as supporting evidence for analyst review, not as automatic suspicion by themselves.