We have created suspicious activity indicators to help you identify potential money laundering, terrorism financing and other serious criminal activities. These indicators can inform your transaction monitoring alerts that trigger further review.
To complement these indicators, you must also ensure your transaction monitoring systems alert you to unusual, large or complex transactions or patterns of transactions.
If you suspect a customer or a transaction involving your customer is linked to a crime, submit a suspicious matter report (SMR) to AUSTRAC within the required timeframes. This includes where you reasonably suspect a person:
- is committing a crime
- is not who they claim to be
- could be the victim of a crime.
On their own, one of these indicators may not suggest suspicious activity. If you are unsure whether there are reasonable grounds for a suspicion, you should conduct further monitoring and examination, including applying enhanced customer due diligence (ECDD) measures. If you have clear and reasonable grounds for a suspicion, you must submit a suspicious matter report (SMR) to AUSTRAC.
For more information on complying with your reporting obligations, see our suspicious matter reporting reference guide and suspicious matter reporting checklist.
This indicators list is not exhaustive. You should consider other indicators specific to your business’s individual risk profile and circumstances.
On this page
- Customer identification and behaviour
- Money laundering
- Serious financial and organised crimes
- Terrorism, national security and international crime
- Related pages
Customer identification and behaviour
Customer identification indicators
A customer:
- provides identification information that is false, misleading, vague, or cannot be verified
- refuses or is reluctant to provide the identification information required
- has inconsistencies in information across different identification documents
- displays a pattern of name variations or uses aliases from one transaction to another
- alters the transaction amount after being asked for identity documents
- is identified in adverse media
- has sources of wealth or sources of funds that are unexplained and/or inconsistent with their profile
- provides post office box information instead of residential address information
A company customer:
- refuses or is reluctant to provide information about beneficial ownership
- provides beneficial ownership information that is false, misleading, vague, or cannot be verified
Multiple customers:
- with no familial links provide the same hotel or residential address
Customer behaviour indicators
A customer:
- appears to be acting under the direction of a third party
- appears to be in doubt or nervous when asked for further details about the transaction
- is in a hurry to complete the transaction and/or enquires if they can provide identification information later
- shows no interest in fees or the exchange rate and/or is happy with a poor exchange rate
- is unwilling to or cannot provide reasonable explanation for remittances
- appears nervous, overly defensive, or evasive when questioned
- and/or their activity is the subject of law enforcement enquiries
- makes an unusual enquiry to venue staff about whether they report to government authorities. For example, AUSTRAC, the Australian Taxation Office or law enforcement agencies
Multiple customers:
- who do not appear to be related have common identifiers
- making similar transactions have common identifiers
Money laundering
Money laundering indicators
A customer:
- has a sudden and significant increase or decrease in account activity with little to no logical explanation or economic rationale
- makes frequent transactions just below the $10,000 reporting threshold in an attempt to avoid being reported (known as structuring)
- makes transactions that are inconsistent with their established patterns of behaviour
- has a sudden spike in remittance activity to or from higher-risk jurisdictions including those that border a conflict zone
- has a sudden spike in remittance activity to or from countries with less stringent AML/CTF regimes
- sends or receives funds to or from countries known for high levels of corruption and money laundering
- makes multiple, rapid transactions in an attempt to obscure the origin or destination of their funds
- splits larger transactions into multiple smaller transactions to avoid scrutiny
- makes transactions that have no reasonable or logical explanation or apparent economic rationale
- has discrepancies between the declared purpose of the transaction and their profile
- whose size, frequency or patterns of transactions appear to indicate unusual or suspicious activity
- sends or receives funds to or from jurisdictions inconsistent with their profile
- funds transfers with multiple debit cards or cash payments
- cannot explain and/or provide evidence for the source of their funds
- or a potential customer enquires about reporting thresholds
- requests that their name be omitted from the transaction
- makes multiple transactions through multiple agents often on the same day
- makes multiple high value transactions in a short time period using an account that was recently created or has been dormant
Multiple customers:
- remit funds to a single beneficiary, with no apparent connection between the sender and beneficiary
- open accounts or undertake transactions in an apparently coordinated manner
Trade-based money laundering indicators
A customer:
- makes fund transfers for products shipped to or from a higher-risk jurisdiction for money laundering and/or trade-based money laundering
- has apparent discrepancies between the descriptions of the goods on the bill of lading or invoice that accompany transactions, and the goods shipped
- makes transactions involve the use of front or shell companies
- ships products through one or more jurisdictions, including special economic zones, with no apparent economic rationale
- makes transactions that involve repeatedly amended or frequently extended letters of credit
- remits or receives funds to or from a country that borders a high risk jurisdiction
Serious financial and organised crimes
Child exploitation indicators
A customer:
- makes same-day payments to multiple beneficiaries
- makes low-value transactions between $15 and $500
- attempts to obfuscate their identity, such as using name variations
- has no work or family links with the jurisdiction they are sending funds to
- transfers funds to a higher-risk jurisdiction for child exploitation
- attempts to disguise their activity through describing payments as ‘accommodation’, ‘education’, ‘school’, ‘uniform’, or 'medical bills'
- remits payments for use of virtual private network software, screen capture and livestreaming programs, and/or metadata stripping and anonymising software
Terrorism, national security and international crime
Terrorism financing indicators
A customer:
- makes transactions in the name of an entity, foundation or association, which may be linked to or suspected of being involved with a terrorist organisation
- has account activity that indicates attempts to raise donations in an unofficial or unregistered manner
- donates to a cause that is subject to adverse media
- sends or receives funds to or from countries known to be high risk for of terrorism financing
- sends funds to multiple beneficiaries in higher-risk jurisdictions for terrorism and/or terrorism financing
- is matched through screening against an Australian or international sanctions list
- remits funds to geographical locations in high risk jurisdictions or countries where formal banking channels may not operate
- who’s remittance instructions includes references to ideologically or religiously motivated extremism terms and/or items
- makes sudden unexplained remittances with little or no economic rationale to a high risk country or a country that borders a conflict zone
Open source information:
- indicates the customer or parties to the customer’s transaction may have links to known terrorist entities or terrorist activities
- indicates the customer displays extremist ideologies (social, political, environmental etc.).
Other indicators:
- A non-profit organisation customer uses funds inconsistent with the declared purpose for which it was established
- Multiple customers send funds to a single beneficiary in higher-risk jurisdictions for terrorism and/or terrorism financing
Proliferation financing indicators
Proliferation financing is when a person makes available an asset, provides a financial service or conducts a financial transaction that is intended to facilitate the proliferation of weapons of mass destruction, regardless of whether the activity occurs or is attempted.
All reporting entities must have risk-based systems and controls in their transaction monitoring programs to identify and report suspicious matters. This includes monitoring for suspicions that individuals or businesses are attempting to avoid Australia’s sanctions laws in connection with the provision of a designated service, or a request to provide a service.
A customer:
- is matched through screening against an Australian or international sanctions list
- transacts through countries of proliferation financing concern
- enquires about due diligence processes when transacting with individuals, networks, companies, or countries of proliferation concern
- enquires how to avoid the financial system to transact with individuals, networks, companies, or countries of proliferation concern
- remits funds to companies linked to countries of proliferation financing
Related pages
The content on this website is general and is not legal advice. Before you make a decision or take a particular action based on the content on this website, you should check its accuracy, completeness, currency and relevance for your purposes. You may wish to seek independent professional advice.