Identifying Unusual and Suspicious Activity

Why This Topic Matters

Identifying unusual and suspicious activity sits at the heart of every anti-financial crime (AFC) program. A financial institution can have excellent policies, well-trained staff, and sophisticated systems, but if it cannot recognize when a customer's behavior or a transaction departs from what is expected, it cannot protect itself or the financial system from money laundering, terrorist financing, fraud, sanctions evasion, and other predicate crimes.

From a regulatory standpoint, the obligation is universal. FATF Recommendation 20 requires that if a financial institution suspects, or has reasonable grounds to suspect, that funds are the proceeds of criminal activity or are related to terrorist financing, it must report promptly to the Financial Intelligence Unit (FIU). In the United States this obligation flows from the Bank Secrecy Act and is operationalized through Suspicious Activity Reports (SARs); in most other jurisdictions the equivalent filing is a Suspicious Transaction Report (STR) or Suspicious Activity Report. Failure to detect and report exposes an institution to enforcement actions, monetary penalties, loss of licenses, personal liability for compliance officers, and severe reputational damage.

For the CAMS exam, this topic is heavily tested because it is where theory becomes practice. Questions frequently present a scenario and ask you to decide whether activity is unusual, whether it has risen to the level of suspicious, and what the correct next step is. Mastering the red flags and the escalation logic is essential to passing.

What It Is: Key Definitions

Unusual activity is activity that is inconsistent with the customer's known profile, the expected nature and purpose of the account, or the normal pattern for that customer segment, product, or geography. Unusual activity is a trigger for review, not a conclusion. Many unusual transactions turn out to have a legitimate explanation once examined.

Suspicious activity is activity for which, after review, the institution has no reasonable or lawful explanation and which gives rise to a reasonable suspicion that it may involve the proceeds of crime, terrorist financing, or an attempt to evade reporting or recordkeeping requirements. Suspicious activity triggers the reporting obligation.

The relationship between the two is a funnel: a large volume of unusual activity is detected, a smaller portion is escalated and investigated, and a smaller portion still is determined to be suspicious and reported. Two important principles follow:

1. Not every red flag means suspicion. A red flag is an indicator that should prompt closer scrutiny and comparison against the customer's profile and documented expected activity.
2. The institution does not need to prove that a crime occurred, identify the specific predicate offense, or determine that the funds are definitely illicit. The standard is reasonable suspicion, not proof.

Sources of Detection

Suspicious activity can come to an institution's attention through many channels, and exam questions often test whether you recognize non-system sources:

- Automated transaction monitoring systems generating alerts based on rules, thresholds, scenarios, or behavioral analytics.
- Employee referrals from front-line staff (tellers, relationship managers, loan officers, trade finance staff) who observe behavior that software cannot see, such as nervousness, evasive answers, or a customer bringing a companion who appears to control the transaction.
- Customer due diligence and KYC refresh revealing inconsistencies between stated and actual activity.
- Law enforcement requests, subpoenas, warrants, or in the US, Section 314(a) information requests and 314(b) information sharing among institutions.
- Negative news and adverse media screening.
- Correspondent bank inquiries or requests for information from counterparties.
- Internal audit, compliance testing, or regulatory examinations.
- Whistleblower reports and internal hotlines.

Red Flags: How to Recognize Unusual Activity

The CAMS body of knowledge organizes red flags by customer behavior, transaction type, product, and industry. You should be able to recognize the following categories.

Customer behavior red flags
- Reluctance to provide identification or beneficial ownership information, or providing documents that appear altered or inconsistent.
- Unusual concern about the institution's reporting requirements or compliance policies, or asking what thresholds trigger reports.
- Requesting exemptions from reporting or recordkeeping.
- A customer whose stated business, occupation, or income does not match the size or nature of the activity.
- Accounts opened by individuals who appear to act on behalf of an undisclosed third party, or where a third party accompanies the customer and directs the transaction.
- Customers who maintain multiple accounts under several names or at several branches without a clear business reason.
- Sudden, unexplained changes in activity following a change in ownership, signatories, or management.

Cash-related red flags
- Structuring (also called smurfing): deposits or withdrawals deliberately kept just below a reporting threshold, such as repeated deposits of 9,000 to 9,900 in a jurisdiction with a 10,000 reporting threshold, or splitting a single transaction across multiple branches, days, or individuals.
- Frequent exchanges of small denomination bills for large denominations.
- Large cash deposits inconsistent with the business type, for example a consulting firm depositing substantial cash.
- Cash deposits followed quickly by wire transfers out, especially to high-risk jurisdictions.
- Businesses that do not deposit cash when cash-intensive peers normally would, or that deposit far more than their locations could plausibly generate.

Wire transfer and funds transfer red flags
- Transfers to or from jurisdictions with weak AML controls, FATF-listed jurisdictions, or tax havens with no business rationale.
- Incoming wires immediately followed by outgoing wires with little or no balance retained (pass-through or funnel account behavior).
- Wires with incomplete, missing, or inconsistent originator or beneficiary information.
- Round-dollar transfers of significant size, or numerous transfers in repetitive amounts.
- Payments received from unrelated third parties, or payments to beneficiaries unrelated to the customer's stated business.

Account and product red flags
- Dormant accounts that suddenly become active with large or frequent transactions.
- Loans secured by cash collateral or by assets in offshore jurisdictions, followed by early repayment with no economic rationale, or sudden repayment of a problem loan.
- Purchase of large single-premium insurance products followed by early surrender regardless of penalties, or frequent changes of beneficiary.
- Securities accounts used primarily to move funds rather than to invest, or trading in low-priced, thinly traded securities with matching buy and sell orders.
- Prepaid cards loaded in large amounts or in patterns inconsistent with normal consumer use.
- Use of virtual assets through mixers, tumblers, privacy coins, or unregistered exchanges, or rapid conversion between fiat and crypto.

Trade-based money laundering red flags
- Over- or under-invoicing of goods relative to market value.
- Multiple invoicing of the same shipment.
- Goods shipped do not match the description on documents, or shipments to and from high-risk jurisdictions via unnecessarily complex routes.
- Letters of credit amended frequently or for amounts that do not match shipping documents.
- Payments made by third parties not party to the trade.

Correspondent banking red flags
- Respondent bank activity inconsistent with its size, customer base, or market.
- Nested correspondent relationships where the respondent allows other banks to use its account without disclosure.
- Dealing with shell banks, which should be prohibited.

Shell company and beneficial ownership red flags
- Companies with no physical presence, no employees, and no apparent business purpose.
- Layers of corporate ownership across multiple jurisdictions, use of bearer shares, or nominee directors and shareholders.
- Multiple companies sharing the same address, directors, or registered agent.

Terrorist financing red flags
- Often small transactions that are difficult to distinguish from normal activity.
- Transfers to or from conflict zones or regions bordering them, charitable or NPO accounts with unexplained transfers to high-risk areas, or funds collected in small amounts from many sources and sent to a single recipient.
- Accounts used by individuals who appear on, or are closely linked to, designated persons.

Human trafficking and smuggling red flags
- Multiple individuals sharing a single account or address with wages deposited and immediately withdrawn.
- Payments to hotels, transportation, and advertising websites at odd hours; an employer controlling the financial accounts of workers.

How It Works: The Detection to Reporting Process

Understanding the lifecycle is critical because many exam questions ask for the next appropriate step.

Step 1 - Detection. An alert is generated, a referral is received, or an inquiry arrives. The event is logged.

Step 2 - Initial review and triage. An analyst compares the activity against the customer's KYC profile, expected activity, transaction history, and peer behavior. Many alerts are closed here as false positives with documented rationale. Documentation of why an alert was closed is as important as documentation of why one was escalated.

Step 3 - Escalation. If the activity cannot be explained, it is escalated to the compliance or financial intelligence unit for investigation. Front-line staff should escalate internally rather than conduct their own investigation or confront the customer.

Step 4 - Investigation. The investigator gathers internal information (account opening documents, transaction records, prior alerts, related accounts) and external information (public records, adverse media, corporate registries, and where permitted, information shared under safe harbor provisions such as US Section 314(b)). The investigator may seek clarification from the customer through routine business inquiries that do not reveal that a suspicion exists.

Step 5 - Decision. The institution decides whether the activity is suspicious and whether a SAR or STR must be filed. The decision, including a decision not to file, must be documented and defensible. Many institutions use a SAR committee or designated decision maker.

Step 6 - Reporting. The report is filed with the FIU within the required timeframe. In the United States, a SAR must generally be filed within 30 calendar days of the initial detection of facts that constitute a basis for filing; this may extend to 60 days if no suspect has been identified. If the activity continues, a continuing activity report is reviewed and filed on roughly a 90-day cycle (filed within 120 days of the prior filing). Jurisdictions differ, so know the principle that reporting must be prompt and that continuing activity requires follow-up filings.

Step 7 - Post-filing actions. The institution decides whether to continue monitoring, restrict the account, or exit the relationship, balancing regulatory expectations against the risk of tipping off. Supporting documentation must be retained, typically for five years in the US.

Critical rules throughout the process

- Confidentiality and no tipping off. Employees must never disclose to the customer, or to anyone outside those with a need to know, that a SAR has been filed or is being considered. Tipping off is a criminal offense in most jurisdictions. The SAR narrative and its existence are confidential, and even confirming a SAR exists in response to a civil subpoena is prohibited in the US.
- Safe harbor. Institutions and employees that file in good faith are protected from civil liability. This encourages reporting when in doubt.
- Independence from the business. Compliance should make the final filing decision free from pressure by relationship managers worried about losing revenue.
- Quality narrative. A good SAR narrative answers who, what, when, where, why, and how, and clearly explains why the activity is suspicious so an FIU analyst can act on it.

Exam Tips: Answering Questions on Identifying Unusual and Suspicious Activity

1. Distinguish unusual from suspicious. If a question describes activity that deviates from the profile but offers no investigation yet, the correct answer is usually to review, investigate, or escalate, not to file immediately or close the account. If the scenario states that the review found no legitimate explanation, the correct answer moves toward filing a SAR or STR.

2. Compare activity to the customer profile. The examiners want you to anchor on KYC. A large cash deposit is not suspicious for a supermarket but is highly unusual for a software consultancy. Always ask: is this consistent with what the institution knows about this customer?

3. Never choose an answer that tips off the customer. Options such as telling the customer that a report will be filed, asking the customer why they are structuring, or warning them about monitoring are always wrong. Asking routine, non-accusatory business questions is acceptable; revealing suspicion is not.

4. Front-line staff escalate; they do not investigate or decide. If the question is from the perspective of a teller or relationship manager, the best answer is to document observations and escalate to the compliance or AML officer according to internal procedures.

5. Do not close the account as a first response. Prematurely closing an account can tip off the customer, destroy an investigative trail, and may be contrary to law enforcement interests. Account exit is a decision made by compliance after assessment, and sometimes after consultation with law enforcement.

6. You do not need proof of a crime. Eliminate answers that say the institution should wait until it confirms the source of funds is illegal, identifies the predicate offense, or obtains evidence from law enforcement. Reasonable suspicion is the standard.

7. Watch for structuring language. Amounts repeatedly just under a threshold, transactions split across branches or days, or a customer asking about reporting thresholds are classic structuring indicators and almost always the correct red flag to select. Remember that structuring is itself a crime regardless of whether the underlying funds are illicit.

8. Think in patterns, not single transactions. Exam scenarios often hide the red flag in aggregation: multiple small wires, several accounts at different branches, or a series of deposits over weeks. Look for the cumulative picture.

9. Know the filing mechanics and timing. Be ready for questions on the 30-day and 60-day US timeframes, continuing activity reviews, record retention, safe harbor, and confidentiality. Remember that the SAR is filed with the FIU (FinCEN in the US), not with the police directly, although law enforcement may be notified immediately for urgent matters such as ongoing terrorist financing.

10. Recognize sector-specific typologies. Expect scenarios involving insurance (early surrender), securities (matched trades, penny stocks), trade finance (invoice manipulation), casinos (minimal play with chip cash-out), real estate (all-cash purchases through shell companies), MSBs, and virtual assets. Identify the typology, then map it to the red flag.

11. Choose the most complete and most compliant answer. CAMS questions frequently offer several plausible options. The best answer is typically the one that follows the proper sequence (document, escalate, investigate, decide, report), preserves confidentiality, and is risk-based. Answers that are extreme (immediately report everything, immediately close all accounts) or passive (ignore because the customer is long-standing or profitable) are usually distractors.

12. Be alert to pressure and conflicts of interest. If a scenario involves a relationship manager or senior executive urging compliance not to file because the customer is valuable, the correct answer upholds the independence of the compliance function and files when the suspicion standard is met.

13. Documentation is always a correct component. Whether an alert is closed or escalated, whether a SAR is filed or not, the decision and its rationale must be recorded. An answer that includes thorough documentation is rarely wrong.

Quick Review Summary

- Unusual activity deviates from the expected profile and triggers review; suspicious activity has no reasonable explanation and triggers reporting.
- Detection sources include monitoring systems, employee referrals, KYC refresh, law enforcement requests, and adverse media.
- Red flags cluster around customer behavior, cash and structuring, wires and pass-through accounts, trade finance, correspondent banking, shell companies, and sector-specific products.
- The process is detect, review, escalate, investigate, decide, report, and monitor, with documentation at every stage.
- Never tip off, never require proof of crime, never let the business override compliance, and always compare activity against what you know about the customer.

If you can apply these principles to a scenario and identify both the correct red flag and the correct next action, you will be well prepared for this portion of the CAMS examination.