We have created suspicious activity indicators to help you identify potential money laundering, terrorism financing and other serious criminal activities. These indicators can inform your transaction monitoring alerts that trigger further review.
To complement these indicators, you must also ensure your transaction monitoring systems alert you to unusual, large or complex transactions or patterns of transactions.
If you suspect a customer or a transaction involving your customer is linked to a crime, submit a suspicious matter report (SMR) to AUSTRAC within the required timeframes. This includes where you reasonably suspect a person is:
- committing a crime
- is not who they claim to be
- could be the victim of a crime.
On their own, one of these indicators may not suggest suspicious activity. If you are unsure whether there are reasonable grounds for a suspicion, you should conduct further monitoring and examination, including applying enhanced customer due diligence (ECDD) measures. If you have clear and reasonable grounds for a suspicion, you must submit a suspicious matter report (SMR) to AUSTRAC.
For more information on complying with your reporting obligations, see our suspicious matter reporting reference guide and suspicious matter reporting checklist.
This indicators list is not exhaustive. You should consider other indicators specific to your business’s individual risk profile and circumstances.
On this page
Customer identification and behaviour
Customer identification indicators
A customer:
- provides an identification document cannot be authenticated
- makes an unusual enquiry to staff about whether they report to government authorities. For example, AUSTRAC, the Australian Taxation Office or law enforcement agencies
- or their activity, is the subject of law enforcement enquiries
- provides identification information that is false, misleading, vague, or cannot be verified
- provides a post office box address for their residential address
- is suspected of purchasing insurance using a fake name, a figurehead, a fictitious business or entity
- provides documents that are suspicious or unclear, or the customer refuses to provide other supporting documents, or the documents provided cannot be authenticated
- is classified as higher-risk by the insurer/intermediary, or operates in a higher risk industry or profession.
- uses intermediaries who are not subjected to the same AML/CTF obligations as the insurer
- has complex ownership and control structures involving multiple layers that make it difficult to identify the beneficial owner of the policy or the beneficiary
- is matched through screening against an Australian or international sanctions list
- is identified in adverse media
Customer behaviour indicators
A customer:
- makes similar types of claims at a noticeable frequency
- purchases a product that requires a large lump-sum premium payment, with no reasonable explanation provided
- purchases a product without concern for the coverage or benefits, or the customer only cares about the procedures for policy loan, cancellation or changes to the policy
- who usually pays premium through regular payments, suddenly requests to purchase a large-sum policy paying the premium in one payment
- asks if they can pay premium payments in cash
- purchases an insurance product that makes no economic sense or would not be of any value to them given their circumstances
- or claimant refuses to provide necessary information or documentation, or to cooperate with the internal investigation for the claim inquiry
- purchases products with high-value cash premiums over a short period of time, which do not appear to align with their status, income and/or are unrelated to the nature of their business
- provides documents that have inconsistencies, or are inconsistent with information in the claim
- makes a claim shortly after taking out a policy
- frequently changes beneficiaries, to beneficiaries who have no apparent connection to them
- asks whether an exclusion period on an insurance policy can be reduced, or whether a benefit can be paid to someone other than the stated beneficiary or policy owner
- asks how long they need to pay premiums on an insurance policy before a claim can be made
- or claimant has an undisclosed relationship with the service provider. For example, a relationship with the doctor, as part of a life insurance claim.
- appears nervous, overly defensive, or evasive when questioned
Money laundering
Money laundering indicators
A customer:
- makes multiple smaller payments in a short period, potentially structured to avoid detection
- makes payments using unusual or uncommon methods. For example, using multiple credit cards or prepaid cards
- specifically buys products designed for the accumulation of large funds and/or allows large transactions, when there may be other products more suited to their apparent circumstances
- specifically buys products which allow for early surrender and have a significant surrender value, when there may be other products more suited to their apparent circumstances
- chooses a premium payment that does not appear to align with the customer’s status and income or is unrelated to the nature of the customer’s business
- makes claims where the damage or injury is difficult to verify
- has an unclear or suspicious source of wealth and/or source of funds that are involved in the business relationship
- attempts to purchase an insurance product with cash
- makes transactions involving third parties with no apparent relationship with them
- pays premiums in cash and in several payments marginally below the TTR reporting threshold, and cannot reasonably explain the sources of funds
- makes transactions that do not appear to be commensurate with their status and income and/or are unrelated to the nature of their business
- applies for a large loan or cancels a large loan policy in a short period of time after purchasing it, with no reasonable explanation provided
- buys policies sold through intermediaries, accepting cash payments and/or payments in their own accounts
- accepts losses with no economic rationale. For example, an early surrender for a large amount without understandable rationale, or transactional activity causing economic losses
- is referred by a company established in a higher-risk jurisdiction
- shows up on watch list for terrorism or terrorism financing, or the funds for a transaction appears to, or is reasonably suspected to, have a connection with terrorism financing
- opens an account in the name of an off-shore company or an off-shore account held by a foreign legal person or individual
- remits a premium payment from a higher-risk jurisdiction
- uses intermediaries based in higher-risk jurisdictions
- specifically buys products that may allow cash payments, third party payments and/or has features that allow for pay-outs not limited to a pre-defined event, when there may be other products more suited to their apparent circumstances
- specifically buys products or services that may inherently favour anonymity, can readily cross international borders, and/or are easily transferred, when there may be other products more suited to their apparent circumstances
- beneficiary, policy holder and/or related third parties are based in higher-risk jurisdictions, or jurisdictions considered to be uncooperative in providing beneficial ownership information. For example, a customer uses a foreign-based trust in an attempt to obscure the ultimate beneficial owner
Fraud and scams
Identify fraud indicators
A customer:
- or claimant provides identification information that is false, misleading, vague, or cannot be verified
- provides residential address details of a vacant or non-existent property
- or claimant is willing to settle claims for an inexplicably low settlement amount in exchange for a quick resolution
- or claimant provides inconsistent statements or information to relevant parties such as the insurer or police
- or claimant makes several claims of similar nature within a relatively short period of time
Other indicators:
- Third parties use stolen identity documents to gain access to a customer’s account, in an attempt to steal funds
- Multiple customers use the same identification details such as mobile numbers, email addresses or IP addresses
Scams indicators
A customer:
- makes a claim following changes in their identification information, including email address or phone number
- frequently changes their identification information, including email addresses, phone number or IP address which may also indicate an account takeover
- provides minimal, inconsistent information and/or avoids answering questions about the purpose of a transaction
- is linked to a higher-risk jurisdiction for scams via their IP address
- appears coached or rehearsed when answering personal and on-boarding questions.
Related pages
The Financial Action Task Force has also published risk-based guidance for the life insurance sector, which provides examples of risks for a range of life insurance products.
The content on this website is general and is not legal advice. Before you make a decision or take a particular action based on the content on this website, you should check its accuracy, completeness, currency and relevance for your purposes. You may wish to seek independent professional advice.