Indicators of suspicious activity for the banking sector

On this page

• Customer identification and behaviour
• Money laundering
• Tax crimes, fraud and scams
• Serious financial and organised crime
• Terrorism, national security and international crime
• Related pages

Customer identification and behaviour

Customer identification indicators

A customer:

• provides an identification document that cannot be authenticated
• refuses or is reluctant to provide identification information or documents
• provides identification information that is false, misleading, vague, or cannot be verified
• has inconsistencies in information across different identification documents
• provides a post office box address for their residential address
• displays a pattern of name variations or uses aliases from one transaction to another
• has sources of wealth or sources of funds that are unexplained and/or inconsistent with their profile
• has common identifiers in their customer identification information with another customer that appears to be unrelated 

Customer behaviour indicators

A customer:

• makes an unusual enquiry to staff about whether they report to government authorities. For example, AUSTRAC, the Australian Taxation Office or law enforcement agencies
• and/or their activity is the subject of law enforcement enquiries
• provides cash that has a distinct or unusual odour 
• appears nervous, overly defensive, or evasive when questioned
• appears to be directed by a third party, or makes a transaction in a branch while accompanied, overseen or directed by a third party
• who is a signatory to a relative’s account makes large cash deposits into it
• becomes defensive when questioned over their financial transactions
• undertakes transactions that appear inconsistent with their profile and/or transactional history 
• knows few details about a transaction and/or its purpose 
• is reluctant to identify the source of funds for a transaction and/or their source of wealth
• enquires about reporting thresholds or attempts to persuade the reporting entity not to file mandated reports
• alters the transaction amount after being asked for identification information or documents
• makes transactions at different branches and/or approaches different tellers within the same branch 
• frequently exchanges small cash denominations for larger cash denominations 
• appears to be collaborating with third parties to deposit lower amounts of cash to avoid customer identification or reporting thresholds 
• makes numerous outgoing payments to apparently unrelated parties shortly after they receive incoming funds
• has a third party or relative conducting transactions on their account, who appears to be nervous

Money laundering

Money laundering indicators

A customer:

• who holds a visitor or other short-term visa, opens an account during a short stay in Australia 
• is suspected of using a personal account for business purposes, or vice-versa
• uses large amounts of cash to pay for international funds transfers
• makes frequent cash deposits and/or withdrawals over multiple days
• has unusually large volumes of cash deposits and withdrawals, inconsistent with their profile
• has third parties who structure cash deposits into their bank account
• has third-party transfers to and from their account with no apparent economic rationale
• has transactions that are inconsistent with their profile and/or transaction history
• makes a rounded-sum transaction that appears inconsistent with what is expected from the customer
• appears to use their accounts to transfer money through to other accounts only, in an attempt to layer illicit funds
• has an inactive account that begins to see frequent financial activity
• makes transactions that are unnecessarily complex for their declared purpose 
• makes transactions that involve persons or entities identified by media, law enforcement and/or intelligence agencies as being linked to criminal activities
• uses complex company and/or trust structures and associated banking arrangements in an attempt to obscure the source and beneficial ownership of their funds 
• opens accounts using front or shell companies
• purchases high-value assets that are inconsistent with their profile
• attempts to layer funds through both domestic and international funds transfers to accounts held with multiple domestic and foreign banks 
• splits large cash deposits into multiple smaller deposits below the $10,000 reporting threshold (this is known as structuring)
• makes multiple transactions when one transaction would suffice 
• makes rapid or complex funds transfers through multiple accounts
• makes unusually rapid funds transfers in a manner inconsistent with their profile, and/or that have no economic rationale 
• makes rapid and complex funds transfers between multiple companies linked by shareholders, trusts and/or beneficial owners 
• makes rapid international funds transfers immediately after a deposit
• makes large or rapid domestic funds transfers between their personal and business transaction accounts 
• transfers funds between accounts held with multiple domestic and foreign banks 
• makes cash deposits on the same day across multiple branches and/or ATMs 
• makes cash deposits at both the branch (teller) and the same branch’s ATM/s 
• makes multiple cash deposits at the same location over a short period of time 
• makes cash deposits via ATMs across multiple accounts using a single card (issued by a domestic or international financial institution) or mobile number
• has an account that receives deposits from multiple third parties
• or small group of customers who control and attempt to layer funds between multiple accounts 

A business customer:

• has a newly opened account that receives large cash deposits and/or frequent cash deposits where the customer has no prior financial profile, or has a newly registered ABN/ACN 
• has transactions that appear inconsistent with their declared business

Trade-based money laundering indicators

A customer:

• has transactions and accompanying documents that show evidence of over- or under-invoicing 
• has overly complex company or directorship structures 
• has trading activity that is inconsistent with their profile and/or market trends, or via relationships with no economic rationale 
• sends or receives funds to or from higher-risk jurisdictions for trade-based money laundering, including jurisdictions with free trade zones, special economic zones, foreign trade zones, and/or export processing zones
• is suddenly involved in the import or export of goods, without having been involved in this type of activity previously
• is unable to produce appropriate documentation to support a transaction
• has international payments that involve multiple entities which appear to have connected addresses, contact details and/or key personnel
• provides supporting documentation for transactions that includes unreasonably high and/or additional charges 
• upon receiving an incoming international funds transfer, immediately:
  • splits and transfers funds to multiple domestic company bank accounts; or 
  • sends funds back overseas, often to the ordering company or to the same country (this is known as ‘u-turn’ activity or ‘carouseling’)

A company customer:

• appears to conduct business exclusively with a single counterparty
• prefers to pay in cash even if they qualify for credit facilities
• has significant domestic transfers or cash transactions in excess of expectations for their declared business (possible co-mingling of illicit and licit funds) 
• operates in porous border regions close to higher-risk jurisdictions for trade-based money laundering 
• trades goods to or from higher-risk sectors for trade-based money laundering
• trades in goods where prices may be subjective 
• appears from open source information to be operating in a different industry compared to the goods they import or export

Tax crimes, fraud and scams

Tax evasion (personal) indicators

A customer:

• makes international funds transfers to or from tax secrecy jurisdictions 
• based domestically uses non-resident accounts to receive cash deposits 
• makes funds transfers between personal and business accounts in an attempt to obfuscate the source and/or destination of funds
• uses business accounts for personal transactions
• makes cash deposits and withdrawals at branches below the $10,000 reporting threshold (this is known as structuring) 
• uses agent banking arrangements to deposit cash for no apparent logical reason or economic rationale

Tax evasion (business) indicators

A customer:

• has business transactions that involve foreign jurisdictions with no economic rationale 
• has a business that sends international transactions to or from tax secrecy jurisdictions 
• cannot provide a reasonable explanation about why they are making transfers to professional facilitators in Australia and overseas
• uses complex corporate or legal structures for no logical reason or economic rationale 
• has complex corporate or legal structures located in known tax secrecy jurisdictions 
• has transactions that appear to be linked to the shadow economy 
• uses personal accounts for business transactions
• receives international funds transfers described as ‘loan’, ‘loan draw down’ or ‘loan advance’ 
• sends or receives funds internationally described as 'consulting fees' or ‘management fees’ 
• makes complicated funds transfers with no apparent economic rationale 
• uses third-party company accounts 
• transfers funds to international entities, followed soon after by incoming funds transfers of similar amounts from the same international entities
• is both the ordering and beneficiary customer for multiple outgoing international funds transfers 
• makes cheque deposits into a business account followed immediately by cash withdrawals of an equivalent value, on the same day 
• makes regular large cash withdrawals which may indicate wage payments for non-existent employees, in an attempt to lower their tax liability

A company customer:

• transfers funds internationally to tax secrecy jurisdictions or business centres described as ‘set up fees’ or ‘annual registration fees,’ often involving online service providers
• transfers funds domestically to a facilitator such as a lawyer or an accountant, who will then send the funds internationally to a tax secrecy jurisdiction on the customer’s behalf
• has a transaction history that lacks evidence of compulsory regulatory payment transactions. For example, pay-as you-go instalment payments, employee superannuation payments, etc.

Identify fraud indicators

A customer: 

• provides identification information that is false, misleading, vague, or cannot be verified 
• provides residential address details of a vacant or non-existent property 

Other indicators include:

• Third parties use stolen identity documents to gain access to a customer’s bank account in an attempt to steal funds
• Multiple customers use the same identification details such as mobile numbers, email addresses or IP addresses, to open accounts 
• A third party conducts a micro-transaction as a ‘test payment’ to confirm if a customer’s account is active

Welfare fraud indicators

A customer:

• receiving government benefits has transactions that are inconsistent with the expected profile of a customer receiving government benefits 
• receiving government benefits has additional transactions that may indicate an additional source of income
• withdraws sums of cash to lower their account balance, in an attempt to meet asset test requirements for eligibility for a government benefit
• sends large amounts of NDIS-sourced funds internationally 
• has the majority of their NDIS-sourced funds paid into loan accounts 
• uses NDIS-sourced funds for transactions inconsistent with their profile 
• accumulates NDIS-sourced funds over a period of time, followed by large withdrawals or expenditure on goods or services unrelated to disability support 
• known to be running a NDIS provider business, or providing disability support services has transactions that do not appear to correlate with this

Scams indicators

A customer:

• makes a large withdrawal following changes in their identification information, including email address or phone number 
• frequently changes their identification information, including email addresses, phone number or IP address which may also indicate an account takeover 
• has cash withdrawals from their account immediately following the receipt of apparently stolen funds 
• makes rapid domestic funds transfers from their account following the receipt of apparently stolen funds
• provides minimal, inconsistent information and/or avoids answering questions about the purpose of a transaction
• has an IP address that is linked to a higher-risk jurisdiction for scams
• receives deposits from multiple bank accounts in different names, inconsistent with their profile
• has transactions that are inconsistent with their profile
• advises they are participating in an investment opportunity
• appears coached or rehearsed when answering personal and on-boarding questions
• advises they are sending funds to a friend or family in a higher-risk jurisdiction for scams 

Serious financial and organised crime

Phoenixing indicators

Phoenixing refers to the illegal practice where a new company is created to continue the business of a company that has been deliberately liquidated to avoid paying its debts, including taxes, creditors and employee entitlements. 

A customer:

• makes minimal business payments through bank accounts for daily business operations 
• receives funds from multiple ‘service’ related companies 
• makes multiple funds transfers to third party individual’s bank accounts 

A company customer:

• is in a higher-risk profession for phoenixing, such as property, construction, labour hire, security, mining, agriculture, horticulture and/or transport sectors 
• withdraws and/or transfers all funds from a business account, with little or no balance remaining to cover business expenses
• has a transaction history that lacks evidence of compulsory regulatory payment transactions. For example, pay-as you-go instalment payments, employee superannuation payments, etc.
• cannot explain changes in the name, contact details or signatories to their account
• with a dormant account suddenly has financial activity, despite being a deregistered company
• that is newly-registered has the same, or similar transactions and same contact details (including directors and/or beneficial owners), as a recently closed company

Child exploitation indicators

A customer:

• makes small-value transactions ranging from between $50-$1,500 to higher-risk jurisdictions for child exploitation 
• has transferred amounts that are typically rounded in the native currency of the higher-risk jurisdiction for child exploitation 
• makes payments for use of VPN software, screen capture and live-streaming programs, and/or metadata stripping or anonymising software
• has transactions that correspond to purchases of webcam or livestreaming platforms, including those providing adult entertainment
• has no work or family links to jurisdictions they are sending funds to
• attempts to disguise international funds transfers by describing payments as ‘accommodation,’ ‘education,’ ‘school,’ ‘uniform’ or 'medical bills'
• has a transaction history that includes the use of credit cards or ATMs in higher-risk jurisdictions for child exploitation 
• has travel-related expenses closely before and/or after funds transfers to higher-risk jurisdiction for child exploitation
• makes payments for accommodation in higher-risk jurisdiction for child exploitation
• purchases a travel money card or pre-paid credit card accepted in higher-risk jurisdictions for child exploitation

Terrorism, national security and international crime

International transaction indicators

A customer:

• transfers funds to or from higher-risk jurisdictions 
• transfers funds overseas similar in value to recent cash deposits
• sends multiple low-value international funds transfers
• sends multiple international funds transfers inconsistent with their profile
• sends multiple outgoing funds transfers paid for in cash of amounts below the $10,000 reporting threshold 
• sends or receives high-volume and/or high-value funds transfers with no apparent economic rationale
• deposits or receives funds into several accounts, consolidates into a single account, and then transfers the funds internationally 
• transfers funds to a beneficiary where there is no apparent existing relationship
• uses multiple foreign bank accounts for no apparent logical reason or economic rationale
• sends funds transfers to the same overseas beneficiary as multiple other customers 

Terrorism financing indicators

A customer:

• makes international funds transfers to multiple beneficiaries in the same higher-risk jurisdiction for terrorism financing 
• makes unusual cash withdrawals after a financial institution refuses to conduct an international transfer to a higher-risk jurisdiction for terrorism financing
• has incorrect spelling or provides variations on their name when transferring funds to a higher-risk jurisdictions for terrorism financing
• makes multiple low-value domestic transfers to a single account and/or has cash deposits from multiple third parties
• makes multiple cash deposits into their account described as ‘donations’ or ‘family support’ 
• transfers funds through multiple accounts followed by large cash withdrawals and/or outgoing international funds transfers 
• is identified as a proscribed entity suspected of terrorism or terrorism-financing using a third-party’s account to conduct transfers, deposits and/or withdrawals
• is matched through screening against an Australian or international sanctions list

Open source information:

• identifies a party to a transaction to have links to known terrorist organisations or terrorism activities 
• identifies a customer to have links to known terrorist organisations or terrorism activities
• indicates a customer displays extremist ideologies (for example, social, political or environmental)

Other indicators:

• Multiple customers make international funds transfers to the same beneficiary in a high-risk jurisdiction for terrorism financing 
• Company customer transfers funds between business and personal accounts inconsistent with the type of account held and or the expected transaction volume
• A newly-established company customer transfers funds to a higher-risk jurisdiction for terrorism financing, where open-source information indicates the company appears to sell dual-use materials 

Proliferation financing indicators

Proliferation financing is when a person makes available an asset, provides a financial service or conducts a financial transaction that is intended to facilitate the proliferation of weapons of mass destruction, regardless of whether the activity occurs or is attempted. 

All reporting entities must have risk-based systems and controls in their transaction monitoring programs to identify and report suspicious matters. This includes monitoring for suspicions that individuals or businesses are attempting to avoid Australia’s sanctions laws in connection with the provision of a designated service, or a request to provide a service.

A customer:

• uses complex company and/or trust structures and associated banking arrangements in an attempt to obscure the source and beneficial ownership of their funds 
• uses financial services and/or conducts transactions that are physically distanced from the actual trade of goods. For example an Australian registered company may ship goods from an offshore operational location, but use onshore financial services to receive payment.
• is matched through screening against an Australian or international sanctions list
• transfers funds to or from higher-risk jurisdictions 
• transfers funds overseas similar in value to recent cash deposits

Corporations:

• sharing directors and management, addresses, emails, phone numbers and financial infrastructure with other entities in their networks
• obfuscating their identities and activities by: 
• using aliases and transliteration of company names; 
• using subsidiaries or branches; 
• using third-country nationals in corporate ownership structures; or 
• registering in jurisdictions with opaque corporate registers where information on ultimate beneficial ownership is not easily accessible.

Related pages

• Your industry
• Suspicious matter reports (SMRs)
• Enhanced customer due diligence (ECDD) program
• Proliferation financing in Australia national risk assessment 2022
• Terrorism financing in Australia national risk assessment 2024
• Money laundering in Australia national risk assessment 2024