Red Flags from Staff Reports and External Sources

Why This Topic Matters

Automated transaction monitoring systems catch only part of the suspicious activity flowing through a financial institution. Many of the most important investigations begin with a human observation: a teller who notices a customer sweating while depositing cash just under the reporting threshold, a relationship manager who hears a client give three different explanations for the same wire, or an internal auditor who spots an employee overriding controls. Equally important are signals that arrive from outside the institution, such as a law enforcement subpoena, a regulator inquiry, a request from another financial institution, a whistleblower tip, or an adverse news article. The CAMS exam tests this area because an effective AML/CFT program depends on recognizing these triggers, escalating them through proper channels, protecting confidentiality, and converting them into well-documented investigations and, where warranted, suspicious activity reports (SARs/STRs). Regulators consistently cite failures to act on employee referrals and law enforcement information as root causes of enforcement actions, so this is both a practical and an examinable skill.

What Red Flags Are (and Are Not)

A red flag is an indicator or warning sign that activity may be connected to money laundering, terrorist financing, fraud, sanctions evasion, or other financial crime. A red flag is not proof of wrongdoing. It is a reason to look more closely. The CAMS curriculum emphasizes that a single red flag rarely justifies a conclusion; the investigator must assess the indicator in the context of the customer profile, expected activity, and other available information before deciding whether the activity is truly suspicious.

Red flags that trigger investigations typically come from two broad categories of sources:

1. Internal (Staff) Sources
Front-line employees such as tellers, branch managers, relationship managers, private bankers, loan officers, trade finance staff, and customer service representatives.
Operations and back-office staff who process wires, cheques, account openings, and reconciliations.
Compliance analysts reviewing alerts, KYC refresh files, or negative news hits.
Internal audit and the second line of defense testing controls.
Human resources and security departments observing employee conduct.
Internal whistleblower hotlines and ethics reporting channels.

2. External Sources
Law enforcement agencies issuing subpoenas, search warrants, production orders, or informal requests for information.
Financial intelligence units (FIUs), including feedback on prior filings or specific requests such as FinCEN 314(a) requests in the United States.
Regulators and supervisors raising concerns during examinations or through formal notices.
Other financial institutions sharing information, for example under FinCEN 314(b) voluntary information sharing or through correspondent banking inquiries.
Media and adverse news reports, court records, and public databases.
Customers, counterparties, or members of the public who complain or report concerns.
External whistleblowers and former employees.
Government sanctions lists, advisories, typology reports, and industry alerts.

Common Red Flags Reported by Staff

Because staff interact directly with customers, they observe behavioral indicators that systems cannot capture. Examples frequently referenced in the CAMS material include:

A customer is reluctant or refuses to provide identification, source of funds, or the purpose of a transaction.
A customer appears nervous, is accompanied by someone who seems to be directing them, or asks unusual questions about reporting thresholds and record keeping.
A customer structures deposits or withdrawals just below reporting thresholds, or splits a transaction across multiple branches or days.
A customer offers a gift, bribe, or unusual favor to an employee, or asks the employee to skip a step.
The explanation for a transaction changes, is inconsistent with the customer profile, or does not make economic sense.
A business customer deposits cash far exceeding what its stated business could generate, or uses third parties to conduct transactions.
Account opening information is vague, uses a shared address, or the beneficial owner cannot be identified.
Transactions involve high-risk jurisdictions, shell companies, or nominees without clear rationale.

Internal Red Flags about Employees

Staff reports also surface indicators that an employee may be complicit in or facilitating financial crime. These include a lifestyle inconsistent with salary, reluctance to take vacation, resistance to having their work reviewed, frequent overrides of controls or exceptions for particular customers, unusually close relationships with high-risk clients, processing transactions outside their normal duties, and attempts to disable or bypass monitoring. Institutions must have a process to investigate employees discreetly, often with legal, HR, and senior management involvement, while preserving evidence and avoiding alerting the employee prematurely.

How the Process Works: Staff Reports

Step 1 - Identification. The employee recognizes a red flag based on training, typologies, and knowledge of the customer. Regular, role-specific AML training is what makes this step possible, which is why training is a core pillar of the compliance program.

Step 2 - Internal escalation. The employee submits an internal referral, often called an unusual activity report (UAR), internal suspicious activity report, or escalation form, to the compliance department or Money Laundering Reporting Officer (MLRO). The employee should document facts objectively: who, what, when, where, how much, and why it seemed unusual. The employee should not confront the customer, conduct their own investigation, or discuss the matter with colleagues who do not need to know.

Step 3 - Compliance review and investigation. Compliance reviews the referral, gathers KYC information, transaction history, related accounts, public records, and prior alerts. The investigator determines whether the activity has a reasonable explanation or whether it meets the standard for suspicion under local law.

Step 4 - Decision and documentation. Compliance decides whether to file a SAR/STR, close the matter with documented rationale, enhance monitoring, or take other action such as exiting the relationship. Both filing and no-filing decisions should be documented. Feedback to the reporting employee should be limited; in most jurisdictions the employee must not be told whether a SAR was filed in a way that could lead to tipping off.

Step 5 - Confidentiality and protection. The existence of a SAR and the internal referral must be kept confidential. Staff who report in good faith should be protected from retaliation, and many jurisdictions provide statutory safe harbor for good-faith reporting.

How the Process Works: External Sources

Law enforcement requests and subpoenas. Receipt of a subpoena, production order, or informal inquiry about a customer is itself a red flag that should trigger an internal review of the customer's activity. The institution should route the request to a designated point of contact, typically legal or compliance, verify that the request is legitimate and properly authorized, respond only through official channels, produce only what is legally required, and retain copies of the request and response. The institution should not automatically close the account simply because of the inquiry, should not notify the customer, and should consider whether a SAR/STR is warranted based on its own review. Law enforcement may send a 'keep open' or 'maintain account' letter asking the institution not to close an account so that the investigation can continue; the institution should document this and periodically confirm it remains in effect.

FIU requests and feedback. FIUs may request additional information on filed reports or circulate names of subjects of interest. In the United States, FinCEN 314(a) requests require institutions to search their records for matches and report positive matches to FinCEN within a set timeframe. A match should prompt the institution to review the relationship and consider filing a SAR, even though the request itself is not proof of wrongdoing.

Information from other institutions. Correspondent banks may ask about the underlying activity of a respondent's customers, or an institution may receive a request under a voluntary information-sharing regime such as 314(b). Sharing should occur only within the legal framework, with proper registration where required, and the information must be used solely for AML/CFT purposes and protected from disclosure.

Regulatory examinations. Regulators may identify customers or patterns of concern. Findings should be escalated to senior management and the board, remediated, and tracked, and any customers identified should be investigated.

Adverse media and public sources. Negative news about a customer, beneficial owner, or counterparty, including arrests, indictments, sanctions, regulatory penalties, or credible journalism, should be verified and assessed for relevance. The institution should confirm the match is the actual customer and not a name collision, evaluate whether the allegations relate to financial crime, update the customer risk rating, and review account activity for related indicators.

Whistleblowers. Tips from employees, contractors, or outsiders may arrive through hotlines or directly to regulators. Institutions should treat tips seriously, protect the identity of the reporter where possible, investigate independently, and avoid any retaliation. Several jurisdictions, including the United States under the Anti-Money Laundering Act of 2020, provide monetary awards and anti-retaliation protection for AML whistleblowers.

Key Principles Tested on the Exam

Escalate, do not investigate alone. Front-line staff report; compliance investigates and decides.
Never tip off. Do not tell the customer or unauthorized colleagues that a report has been made, that a subpoena has been received, or that an investigation is under way.
Verify external requests. Confirm the identity and authority of law enforcement before releasing information, and respond through legal or compliance.
A red flag is a trigger, not a conclusion. Investigate before filing; do not file reflexively, but do not ignore indicators either.
Document everything. Referrals, investigative steps, decisions, and communications with authorities must be recorded and retained.
Protect the reporter. Good-faith reporters are protected; retaliation undermines the culture of compliance.
Do not automatically close the account. An inquiry or subpoena should lead to a risk-based review and possibly consultation with law enforcement before any exit decision, and 'keep open' letters must be honored.
Coordinate internally. Compliance, legal, HR, audit, and senior management each have roles, especially in employee-related investigations.

Exam Tips: Answering Questions on Red Flags from Staff Reports and External Sources

Tip 1 - Identify the role of the person in the question. If the scenario describes a teller, relationship manager, or other front-line employee, the correct action is almost always to document the facts and escalate to compliance or the MLRO through the internal referral process. Answers that have the employee question the customer about money laundering, refuse the transaction with an accusation, call the police directly, or discuss the matter with colleagues are usually wrong.

Tip 2 - Watch for tipping-off traps. Any option that involves informing the customer that a SAR was filed, that a subpoena was received, or that their account is under review is incorrect. Also be careful with options that tell the reporting employee the outcome of the SAR decision in detail; confidentiality applies internally too.

Tip 3 - When law enforcement contacts the institution, think 'verify, route, review.' The best answer typically involves verifying the legitimacy of the request, directing it to the legal or compliance point of contact, producing only what is legally required, retaining records, and reviewing the customer's activity to determine whether a SAR/STR should be filed. Distractors include immediately closing the account, giving the officer everything they ask for over the phone, or ignoring the inquiry because the customer appears legitimate.

Tip 4 - Distinguish 'red flag' from 'suspicion.' If a question asks what the institution should do after receiving a 314(a) match, an adverse news hit, or an employee referral, the right answer usually involves conducting an investigation or review, not automatically filing a report and not automatically dismissing the indicator. The exam rewards the risk-based, evidence-gathering step.

Tip 5 - For adverse media, verify the match and relevance. Correct answers emphasize confirming that the news relates to the actual customer, assessing whether the conduct relates to financial crime, updating the risk rating, and reviewing activity. Reacting to an unverified name match by closing the account or filing immediately is a common distractor.

Tip 6 - For employee misconduct scenarios, think discreet and coordinated. The best answers involve confidential investigation by compliance in coordination with legal, HR, internal audit, and senior management, with preservation of evidence and restriction of the employee's access if needed. Confronting the employee first or allowing the employee's manager to handle it informally is usually wrong.

Tip 7 - Remember 'keep open' letters. If law enforcement asks the institution to keep an account open, the institution should honor the request, document it, obtain it in writing, set a review date, and continue monitoring and filing SARs as required. Closing the account anyway is incorrect.

Tip 8 - Information sharing has rules. Questions about sharing with other institutions test whether you know sharing must be within a legal framework (for example, registration under 314(b) in the United States), limited to AML/CFT purposes, and protected from onward disclosure. Sharing SAR contents or sharing informally with a friend at another bank is wrong.

Tip 9 - Culture and training are the foundation. If a question asks how an institution can increase the quality or number of staff referrals, look for answers about targeted training, clear escalation procedures, accessible reporting channels, management support, feedback where permissible, and protection from retaliation. Answers about rewarding employees per SAR filed or disciplining those who file 'unnecessary' referrals are distractors.

Tip 10 - Read for the 'best' answer, not just a 'correct' one. CAMS questions often present several reasonable steps; choose the one that is the first or most appropriate action for the role described. Documenting and escalating almost always precedes investigating, which precedes filing, which precedes any decision to exit the relationship.

Quick Review Summary

Red flags are indicators requiring review, not proof.
Staff reports arise from trained front-line observation and must be escalated through internal referral channels to compliance.
External sources include law enforcement, FIUs, regulators, other institutions, media, and whistleblowers.
Receipt of a subpoena or external inquiry is itself a red flag that triggers an internal review.
Verify external requests, route them through legal or compliance, and respond only as legally required.
Never tip off customers or unauthorized staff.
Do not automatically close accounts; honor 'keep open' requests.
Document all referrals, investigations, and decisions, and protect good-faith reporters.

Master these principles and you will be well prepared for CAMS questions on how an AFC organization detects, escalates, and responds to red flags from both inside and outside the institution.