Suspicious Reporting, Terrorism Financing, Trafficking

Overview
This guide covers three closely connected topics tested in the Financial Transactions and Fraud Schemes section of the Certified Fraud Examiner (CFE) exam, under the Money Laundering chapter of the ACFE Fraud Examiners Manual: (1) suspicious activity reporting, (2) the financing of terrorism, and (3) trafficking, particularly human trafficking and how its proceeds are laundered. You will learn why these topics matter, the key definitions, how the mechanisms and reporting regimes work, the red flags the ACFE expects you to recognize, and a practical strategy for answering exam questions.

Part 1: Why This Topic Is Important

Money laundering is the process of making illegally obtained funds appear legitimate. Governments fight it largely through the financial system itself: banks, money services businesses, casinos, broker-dealers and other institutions are required to know their customers, monitor transactions and report suspicious activity to a Financial Intelligence Unit (FIU). These reports are among the most important sources of intelligence for detecting fraud, terrorism financing and trafficking networks.

For a fraud examiner, this matters for several reasons:
- Fraud produces proceeds that must be laundered. Tracing how fraudsters move and disguise money often leads back to the underlying scheme.
- Compliance duties create legal exposure. Institutions and individuals who fail to report, who tip off a suspect, or who assist with structuring face criminal and civil penalties.
- Terrorism financing turned anti-money laundering (AML) on its head. After 2001, regulators realized that clean money can be used for dirty purposes, requiring new detection methods and new laws (for example, Title III of the USA PATRIOT Act).
- Human trafficking is a major predicate offense. Trafficking generates an estimated $150 billion or more per year worldwide, and financial institutions are now expected to recognize its financial footprint.
- Exam weight. The money laundering chapter is a reliable source of exam questions, and these three sub-topics are heavily tested because they involve precise definitions, thresholds and distinctions.

Part 2: What It Is - Core Concepts and Definitions

2.1 Suspicious Activity Reporting
A Suspicious Activity Report (SAR) (called a Suspicious Transaction Report or STR in many countries) is a confidential report filed by a financial institution or other covered business with its national FIU when it knows, suspects, or has reason to suspect that a transaction involves funds from illegal activity, is designed to evade reporting requirements (structuring), has no apparent lawful purpose, or involves the use of the institution to facilitate criminal activity.

In the United States the framework comes from the Bank Secrecy Act (BSA) of 1970, as amended by the Money Laundering Control Act of 1986, the Annunzio-Wylie Anti-Money Laundering Act of 1992 (which introduced SARs), the USA PATRIOT Act of 2001, and the Anti-Money Laundering Act of 2020. Reports go to FinCEN (the Financial Crimes Enforcement Network), the U.S. FIU. Internationally, FIUs cooperate through the Egmont Group, and the Financial Action Task Force (FATF) sets global standards through its 40 Recommendations.

Key reports you must distinguish:
- Currency Transaction Report (CTR): Filed by financial institutions for cash transactions (deposits, withdrawals, exchanges) exceeding $10,000 in a single business day by or on behalf of one person. It is objective, not based on suspicion, and must be filed within 15 days. The customer is not told it is a secret; a CTR is simply a routine record.
- Form 8300: Filed by trades or businesses (not banks) that receive more than $10,000 in cash in one transaction or related transactions, within 15 days.
- Report of International Transportation of Currency or Monetary Instruments (CMIR): Required when physically transporting more than $10,000 across the U.S. border.
- Report of Foreign Bank and Financial Accounts (FBAR): For U.S. persons with foreign accounts exceeding $10,000 in aggregate.
- SAR: Subjective, based on suspicion, confidential, and the central topic of this guide.

2.2 Terrorism Financing
Terrorist financing is the provision or collection of funds, by any means, with the intention or knowledge that they will be used to carry out terrorist acts or support terrorist organizations. The crucial conceptual point: the funds may be entirely legitimate in origin. This is why terrorism financing is often described as reverse money laundering: traditional laundering takes dirty money and makes it look clean, whereas terrorist financing frequently takes clean money (donations, charity proceeds, legitimate business profits, salaries) and directs it toward a dirty purpose. Amounts are often small, transactions can appear routine, and the intent, not the origin, is what makes the activity criminal.

2.3 Trafficking
The exam focuses on human trafficking, defined as the recruitment, transportation, transfer, harboring or receipt of persons by means of force, fraud, coercion, abduction or abuse of power for the purpose of exploitation. The two main forms are sex trafficking and labor trafficking (also debt bondage, forced marriage, organ removal, child soldiers). You must be able to distinguish it from human smuggling:
- Smuggling is a crime against a state: it involves consent and illegal border crossing; the relationship usually ends on arrival.
- Trafficking is a crime against a person: consent is irrelevant once coercion or fraud is present, no border crossing is required, and exploitation continues after arrival.
Other trafficking offenses (drugs, weapons, wildlife, counterfeit goods, cultural property) are predicate offenses whose proceeds are laundered using the same techniques, and some also fund terrorism.

Part 3: How It Works

3.1 How Suspicious Reporting Works

Who must file: Banks, credit unions, savings associations, broker-dealers, futures commission merchants, mutual funds, insurance companies (for certain products), casinos and card clubs, money services businesses (MSBs - check cashers, money transmitters, currency exchangers, prepaid access providers, including many virtual currency businesses), dealers in precious metals and jewels, and residential mortgage lenders and originators.

U.S. SAR dollar thresholds (know these):
- Depository institutions: $5,000 or more when a suspect can be identified; $25,000 or more regardless of whether a suspect is identified; any amount for insider abuse involving an institution employee, officer or director.
- MSBs: $2,000 or more (a $5,000 threshold applies to issuers reviewing clearance records of money orders and traveler's checks).
- Casinos, broker-dealers, mutual funds, insurance companies: $5,000.
- Institutions may voluntarily file below thresholds.

Timing: A SAR must be filed within 30 calendar days after the initial detection of facts that constitute a basis for filing. If no suspect is identified, the institution may delay up to an additional 30 days to identify one, but the total may not exceed 60 days. For ongoing activity, institutions file continuing activity reports every 90 days (reviewed at 120-day intervals under current FinCEN guidance). Situations requiring immediate attention, such as ongoing money laundering or terrorist financing, should also be reported to law enforcement by telephone.

Confidentiality and tipping off: It is a federal crime to disclose to the subject, or to any person involved in the transaction, that a SAR has been filed or to reveal any information that would disclose its existence. This is often called the prohibition against tipping off. Even in litigation, SARs are generally not discoverable. Institutions may share SARs with their regulators, with FinCEN, with law enforcement, and, under specified conditions, within their corporate family for compliance purposes.

Safe harbor: The BSA provides a safe harbor protecting institutions and their employees from civil liability for filing a SAR (or for failing to notify the customer), as long as the report was made in good faith. This encourages reporting without fear of lawsuits by customers.

Record retention: A copy of the SAR and all supporting documentation must be kept for five years from the date of filing. Supporting documentation is deemed filed with the SAR and must be provided to FinCEN or law enforcement on request.

Structuring: Breaking transactions into amounts below a reporting threshold to avoid a report is a crime in itself under 31 U.S.C. 5324, regardless of whether the underlying funds are legal. Related terms: smurfing (using multiple people to make small deposits) and the bank practice of filing SARs on apparent structuring even when each transaction is under $10,000.

Know Your Customer (KYC) and Customer Due Diligence (CDD): SARs rest on a foundation of customer identification. The USA PATRIOT Act Section 326 requires a Customer Identification Program (CIP). FinCEN's CDD Rule (effective 2018) requires identification and verification of beneficial owners of legal entity customers (generally each individual with 25 percent or more ownership, plus one individual with significant control). Enhanced Due Diligence (EDD) is required for higher-risk customers such as politically exposed persons (PEPs), correspondent accounts for foreign banks (Section 312), private banking accounts for non-U.S. persons, and customers from high-risk jurisdictions. Section 313 prohibits accounts for foreign shell banks (banks with no physical presence and no affiliation with a regulated group). Section 311 allows the Treasury to impose special measures against jurisdictions or institutions of primary money laundering concern. Sections 314(a) and 314(b) permit information sharing between law enforcement and institutions and voluntarily among institutions.

Common suspicious activity red flags: cash deposits just under $10,000; a customer who asks about reporting thresholds or becomes nervous when asked for ID; activity inconsistent with the customer's stated business; frequent wire transfers to or from high-risk jurisdictions with no business reason; use of multiple accounts without a purpose; large round-dollar transactions; rapid movement of funds in and out (pass-through accounts); reluctance to provide beneficial ownership information; sudden activity in a dormant account; third parties conducting transactions on behalf of the customer; use of nominees or shell companies.

3.2 How Terrorism Financing Works

Sources of funds:
1. State sponsorship (historically the largest source, now less significant).
2. Legitimate sources: charitable donations, religious and community contributions, legitimate businesses owned or controlled by sympathizers, personal salaries and savings.
3. Criminal activity: drug trafficking (narco-terrorism), kidnapping for ransom, extortion and protection rackets, smuggling of cigarettes, oil, antiquities and people, credit card and identity fraud, counterfeit goods, robbery, and trafficking in weapons and natural resources.
4. Abuse of non-profit organizations (NPOs): sham charities, diversion of funds from genuine charities, or using the charity's status to move money across borders with little scrutiny. FATF Recommendation 8 specifically addresses NPO vulnerability.

Methods of moving funds:
- Formal financial system: wire transfers, often in small amounts and layered through multiple accounts and jurisdictions; use of student accounts, personal accounts and front companies.
- Informal Value Transfer Systems (IVTS) such as hawala (South Asia and Middle East), hundi, fei chien (Chinese flying money) and the black market peso exchange. In a hawala, a customer gives money to a hawaladar in one country; the hawaladar contacts a counterpart in another country, who pays the recipient. No money physically crosses the border; the hawaladars settle periodically through netting, trade invoices or other means. The system is based on trust, leaves few records, is fast and inexpensive, and is legal in many places if registered. Unregistered hawalas operating in the U.S. are illegal money transmitting businesses.
- Cash couriers and bulk cash smuggling.
- Trade-based money laundering: over- and under-invoicing, multiple invoicing, misrepresenting quality or quantity of goods, and phantom shipments to move value under the cover of trade.
- Prepaid cards, mobile payments, virtual currencies, online payment platforms, crowdfunding and social media fundraising.
- Precious metals, gems, commodities and high-value goods.

Legal framework: The UN International Convention for the Suppression of the Financing of Terrorism (1999); UN Security Council Resolutions 1267 (sanctions lists) and 1373 (requiring states to criminalize terrorist financing and freeze assets); FATF's original Nine Special Recommendations on Terrorist Financing (2001-2004), now integrated into the 40 Recommendations (notably Recommendations 5, 6 and 8); in the U.S., 18 U.S.C. 2339A, 2339B (material support) and 2339C (financing), the Office of Foreign Assets Control (OFAC) Specially Designated Nationals (SDN) list that institutions must screen against, and Title III of the USA PATRIOT Act, formally the International Money Laundering Abatement and Anti-Terrorist Financing Act of 2001.

Red flags of terrorist financing: accounts that receive many small deposits and then make large wires to high-risk regions; dormant accounts suddenly used for international transfers; charities whose fundraising, stated purpose and geographic activity do not match; NPOs with vague beneficiaries or links to sanctioned persons; transactions involving conflict zones or FATF high-risk jurisdictions; multiple individuals sharing an address or sending funds to the same beneficiary abroad; purchase of dual-use goods, weapons components or large quantities of prepaid cards; use of unlicensed money transmitters; media reports or sanctions screening hits on a customer or counterparty.

3.3 How Trafficking Generates and Launders Money

Business model: Traffickers earn revenue from commercial sex, forced labor in agriculture, construction, hospitality, domestic service, manufacturing and illicit massage businesses, and from debt bondage where victims repay inflated travel, housing or recruitment fees. Victims' documents are often confiscated and their earnings controlled by the trafficker.

Laundering techniques typical of trafficking:
- Cash-intensive front businesses: massage parlors, nail salons, restaurants, bars, hotels and motels, farms and labor contractors, used to commingle illicit cash with legitimate receipts.
- Funnel accounts: cash deposited into an account in one geographic area (often just below reporting thresholds, in multiple branches) and quickly withdrawn in another area or country.
- Use of victims as account holders or nominees: accounts opened in victims' names but controlled by the trafficker; a third party is present and speaks for the customer; the same phone number, email or address appears on many accounts.
- Third-party payroll: multiple employees' wages deposited into a single account or paid by check to one person; employer controls employees' cards or benefits.
- Prepaid cards, mobile payments, virtual currency and money transmitters used to receive payments from customers and send funds to recruiters abroad.
- Trade-based and real estate transactions for larger-scale networks.

FinCEN red flags (Advisories FIN-2014-A008 and FIN-2020-A008): frequent payments to online classified advertising or escort services; hotel and motel charges in multiple cities over short periods combined with payments for cheap food, condoms, pharmacy items and prepaid phones; a customer accompanied by a controlling third party who holds the ID and does the talking; numerous individuals paid from one account with no explanation of the business; an employer paying workers in cash or withholding wages; inconsistent or no payroll taxes for a labor-intensive business; cash deposits made at many branches in many cities within a short period; transactions suggesting the customer has no control over their own funds; a business's revenue inconsistent with its size, hours or location; frequent transfers to source countries for trafficking victims. FinCEN requests that institutions use the key term HUMAN TRAFFICKING FIN-2020-A008 in SAR narratives.

Legal framework: the UN Palermo Protocol (2000); in the U.S., the Trafficking Victims Protection Act (TVPA) of 2000 and its reauthorizations; human trafficking is a specified unlawful activity (predicate offense) for money laundering under 18 U.S.C. 1956 and 1957.

Part 4: How to Answer Exam Questions on These Topics

CFE exam questions are multiple choice or true/false, drawn directly from the Fraud Examiners Manual. The questions tend to test (a) precise definitions, (b) distinctions between similar concepts, (c) numerical thresholds and deadlines, and (d) recognition of red flags. Use the following approach.

Step 1: Identify what category the question belongs to. Is it asking about a report (CTR vs. SAR vs. Form 8300), a law (BSA vs. PATRIOT Act vs. Money Laundering Control Act), a method (hawala vs. trade-based vs. smurfing), or a crime definition (trafficking vs. smuggling; laundering vs. terrorist financing)?

Step 2: Look for the discriminating word. Words like legitimate, consent, border, cash, suspicion, confidential, good faith, physical movement and intent usually point directly at the tested distinction.

Step 3: Eliminate answers that contradict a core principle. For example, any answer suggesting a bank may tell a customer that a SAR was filed, that structuring is legal if the money is legitimate, or that terrorist funds must come from crime, is wrong.

Step 4: Be careful with absolutes and NOT questions. Many questions ask which statement is not true or which item is not a red flag. Read every option before choosing.

Part 5: Exam Tips - Answering Questions on Suspicious Reporting, Terrorism Financing, Trafficking

Tip 1: Memorize the thresholds and clocks. CTR: more than $10,000 in cash, 15 days. SAR for banks: $5,000 with suspect, $25,000 without, any amount for insider abuse. SAR for MSBs: $2,000. SAR deadline: 30 days, extendable to a maximum of 60 days if no suspect identified. Retention: 5 years. Form 8300: more than $10,000 cash received by a trade or business, 15 days. Beneficial ownership: 25 percent.

Tip 2: CTR is objective; SAR is subjective. A CTR is triggered by amount alone, with no suspicion needed. A SAR is triggered by suspicion, and can be filed on any amount. If a question describes a routine $12,000 cash deposit by a known business customer, the answer is a CTR, not a SAR.

Tip 3: Structuring is illegal even with clean money. If the exam describes someone deliberately splitting $18,000 into two $9,000 deposits to avoid a CTR, that is structuring and reportable regardless of the source of funds. The intent to evade reporting is the crime.

Tip 4: Never tip off. Any answer in which the institution notifies the customer, the customer's attorney or a co-worker involved in the transaction that a SAR exists is wrong. Also remember the safe harbor: good-faith SAR filers are protected from civil liability.

Tip 5: Terrorist financing is reverse money laundering. The single most tested idea: terrorist funds can be legitimate, transactions are often small, and detection focuses on destination and intent rather than source. If an option says terrorist financing always involves criminal proceeds or large sums, it is false.

Tip 6: Know hawala's defining features. Trust-based, no physical movement of money across borders, little or no documentation, settlement by netting between brokers, fast and cheap, widely used by legitimate migrant workers but also exploited by terrorists and launderers. If a question says hawala requires wire transfers through banks, that is wrong.

Tip 7: Charities are the classic terrorist-financing vehicle. Expect questions on how NPOs are abused and why they are vulnerable (public trust, cash donations, cross-border reach, light regulation). FATF Recommendation 8 addresses this.

Tip 8: Trafficking vs. smuggling. Smuggling = consent, border crossing, crime against the state, relationship ends at destination. Trafficking = force, fraud or coercion, no border required, crime against the person, ongoing exploitation. Many exam questions turn on exactly this distinction.

Tip 9: Recognize trafficking's financial footprint. Funnel accounts, third-party control of victims' accounts, shared contact details across many accounts, payments to online ad sites, multiple hotel charges across cities, cash-intensive front businesses and employers paying many workers into one account. If a scenario describes a customer who cannot speak for themselves while a companion holds their ID and answers every question, think trafficking.

Tip 10: Link the laws to their functions. BSA = recordkeeping and reporting (CTRs). Money Laundering Control Act 1986 = made laundering a federal crime and criminalized structuring. Annunzio-Wylie 1992 = SAR requirement. USA PATRIOT Act Title III = CIP (326), EDD for correspondent and private banking (312), shell bank ban (313), special measures (311), information sharing (314). FATF = international standards and high-risk jurisdiction lists. OFAC = sanctions screening against the SDN list. Egmont Group = network of FIUs.

Tip 11: Watch for predicate offense questions. Human trafficking, drug trafficking and terrorist financing are all specified unlawful activities that support a money laundering charge. Do not confuse the predicate crime with the laundering offense.

Tip 12: Think like the ACFE manual, not like the news. The exam reflects the manual's wording. When two options seem plausible, choose the one that matches standard definitions (for example, the three stages placement, layering and integration; the definition of a PEP; the FATF definition of trafficking).

Part 6: Practice Questions

Q1. A bank teller notices a customer making $9,500 cash deposits every day for a week. What is the most appropriate response?
A. File a CTR for each deposit. B. Nothing, since each deposit is under $10,000. C. Escalate for SAR consideration for possible structuring. D. Inform the customer that the activity will be reported.
Answer: C. No CTR is required because no single transaction exceeds $10,000, but the pattern indicates structuring, which is reportable on a SAR. Telling the customer would be tipping off.

Q2. True or false: Terrorist financing differs from traditional money laundering because the funds involved are frequently derived from legitimate sources.
Answer: True. This is the reverse money laundering concept.

Q3. Which of the following best distinguishes human trafficking from human smuggling?
A. Trafficking always involves crossing an international border. B. Smuggling involves the victim's consent and ends on arrival, whereas trafficking involves exploitation through force, fraud or coercion. C. Smuggling is a crime against the person. D. Trafficking is limited to sex work.
Answer: B.

Q4. Within how many days of initial detection must a U.S. bank generally file a SAR?
Answer: 30 calendar days, extendable to no more than 60 days if no suspect has been identified.

Q5. Which characteristic is NOT typical of a hawala system?
A. Settlement between brokers through netting. B. Reliance on trust and personal relationships. C. Physical shipment of currency to the recipient's country for each transaction. D. Minimal documentation.
Answer: C.

Q6. A nail salon deposits large amounts of cash at several branches in different cities within a few days, and the funds are withdrawn almost immediately in another state. The owner's phone number appears on the accounts of six employees. These are red flags of:
Answer: Human trafficking (funnel accounts, cash-intensive front business and third-party control of workers' accounts).

Summary
Suspicious activity reporting is the backbone of AML and counter-terrorist financing: know the thresholds, deadlines, confidentiality rules and safe harbor. Terrorist financing is reverse money laundering in which legitimate or illegitimate funds are directed toward violence, often through charities, hawalas, couriers and trade. Human trafficking is exploitation through force, fraud or coercion, distinct from smuggling, and it leaves a recognizable financial trail of funnel accounts, controlled victims' accounts and cash-heavy front businesses. Master the definitions, distinctions and numbers, read each exam question for its discriminating word, and you will handle this section of the CFE exam with confidence.