2026 Guide to Transaction Monitoring Typologies and Red Flags

A suspicious transaction is rarely obvious. Effective transaction monitoring compares activity with customer context and expected behaviour to identify unusual patterns, AML red flags and potential risks. Understanding money laundering typologies helps compliance teams distinguish isolated activity from broader suspicious transaction patterns.

Financial crime is evolving through faster payments, digital accounts, virtual assets and cross-border networks. Ongoing monitoring can identify unusual patterns, but a single alert does not prove money laundering. Reviewing activity against relevant money laundering typologies can help teams assess whether transactions reflect legitimate behaviour or require further investigation.

In this guide, we explain the most common transaction monitoring typologies, the AML red flags associated with each pattern and how compliance teams can use customer context, behavioural analysis and risk-based monitoring to investigate alerts more effectively.

What Are Transaction Monitoring Typologies?

A transaction monitoring typology is a recognised method or behavioural pattern associated with potential financial crime. Examples include structuring, pass-through accounts, money mule networks, cross-border layering, trade-based laundering and suspicious virtual asset activity. These money laundering typologies help compliance teams understand how illicit funds may be moved, concealed or integrated into the financial system.

A typology describes the method; a red flag is an observable indicator. For example, structuring is the typology, while repeated deposits just below a reporting threshold are the red flag. Monitoring scenarios use these indicators alongside transaction data, customer risk and expected activity to identify potential concerns. In practice, transaction monitoring typologies provide the framework, while AML red flags help identify activity that may warrant review.

No single alert proves money laundering. Teams must assess the wider customer context before deciding whether further investigation, enhanced due diligence or a SAR/STR is appropriate. A transaction associated with one of these money laundering typologies may have a legitimate explanation, so investigators should consider the full relationship and surrounding circumstances.

Why Transaction Monitoring Typologies Matter in 2026

Transaction monitoring typologies help compliance teams identify evolving AML risks, suspicious transaction patterns and financial crime red flags. 

Reviewing relevant money laundering typologies also helps institutions design monitoring scenarios that reflect the risks associated with their customers, products and channels.

Cyber-Enabled Fraud Is Feeding AML Risk

Cyber-enabled fraud creates money laundering risk when stolen funds are moved or disguised. Monitor for money mule networks, rapid transfers, new accounts receiving third-party payments, sudden activity spikes, account takeovers and scam proceeds being consolidated or dispersed. These patterns are among the transaction monitoring typologies that may connect fraud prevention with AML investigations. FATF identifies cyber-enabled fraud as a major ML risk.

Virtual Asset Risk Continues Evolving

Virtual asset monitoring should cover exchanges, P2P platforms, mixers, DeFi, bridges and cross-chain activity. AML red flags include rapid conversions, unregistered VASPs, anonymity-enhancing services and activity inconsistent with the customer’s profile or source of funds. These activities may form part of emerging money laundering typologies involving virtual assets and decentralised financial services.

Monitoring Is Moving Beyond Static Rules

Modern AML monitoring looks beyond fixed thresholds to assess whether activity fits the customer’s profile and history. It considers transaction size, frequency, velocity, counterparties, geography and payment channels. A small payment may be suspicious if it signals unusual behaviour or connects to a wider network. This broader approach helps identify transaction monitoring typologies that may not involve large individual transactions.

Regulators Expect Scenarios to Stay Relevant

Regulators expect transaction monitoring scenarios to be risk-based, tested and regularly updated. The FCA highlights the need for appropriate coverage, clear thresholds, accurate data and ongoing reviews. Outdated scenarios or poor data can miss AML risks and create unnecessary false positives. Regular reviews should consider whether existing scenarios still detect relevant money laundering typologies and associated AML red flags.

Common Transaction Monitoring Typologies and Red Flags

Transaction monitoring typologies are recurring methods used to move or disguise illicit funds. Red flags are behaviours that may indicate these methods, while monitoring scenarios turn them into rules or behavioural models. No single indicator proves money laundering; investigators must assess the full customer context.

The following money laundering typologies illustrate how different transaction patterns may create AML red flags. They should be used as investigation prompts rather than automatic conclusions.

1) Structuring and Smurfing

Typology

Structuring, or smurfing, involves splitting large amounts into smaller transactions to avoid scrutiny or reporting thresholds. It may involve one customer, linked accounts or multiple individuals. This is one of the most commonly discussed transaction monitoring typologies because it can create identifiable patterns across accounts, locations and time periods.

Red Flags

• Repeated transactions just below relevant thresholds
• Multiple deposits over a short period
• Similar amounts deposited repeatedly
• Funds divided among several accounts
• Unrelated individuals depositing into one account
• Activity inconsistent with expected income or turnover
• Deposits followed quickly by transfers or withdrawals

Monitoring Signals

Monitor transaction frequency, amount clustering, velocity, common beneficiaries, linked accounts and shared customer details. These signals can help identify AML red flags associated with structuring and other money laundering typologies. Transactions below a threshold are not automatically suspicious; risk depends on repetition, coordination, timing and customer context.

2) Rapid Movement and Pass-Through Accounts

Typology

Pass-through accounts receive funds and transfer them elsewhere shortly afterwards, often without a clear economic purpose. They may be used for layering, fraud proceeds or money mule activity. This pattern is a common example of transaction monitoring typologies involving rapid movement and limited account activity.

Red Flags

• Rapid movement of incoming funds
• Low balances despite high turnover
• Same-day deposits and withdrawals
• Incoming funds followed by international transfers
• Little ordinary account activity
• Transactions inconsistent with the customer's profile or stated account purpose

These AML red flags may indicate that an account is being used to move funds rather than support the customer’s stated financial activity. Monitoring should consider timing, destinations, geography, balances and relationships between senders and recipients.

3) Funnel Account Activity

Funnel accounts receive deposits from distant locations or unrelated individuals before quickly consolidating and transferring the funds elsewhere. This is one of the transaction monitoring typologies that may involve several connected AML red flags rather than one isolated transaction.

Red flags include unusual deposit locations, unrelated depositors, rapid fund movement and activity inconsistent with the customer’s known business or residence. Investigators should also consider whether similar activity appears across linked accounts, devices or counterparties, as these connections may reveal broader money laundering typologies.

4) Money Mule Networks

Money mule networks use individuals or businesses to receive and transfer funds for fraudsters or other criminals. They are increasingly relevant as cyber-enabled fraud, scams and account takeovers rely on mule accounts to move proceeds. Money mule activity is therefore an important area of focus when developing transaction monitoring typologies for fraud-related AML risk.

Red Flags

Potential indicators include newly opened accounts receiving unusually high volumes, multiple unrelated senders paying one account, rapid onward transfers, customers retaining only a small share of funds and unexplained cross-border payments.

Similar timing, counterparties, devices or payment descriptions across multiple accounts may indicate coordination. These are AML red flags that may become more significant when they appear together or across a wider network. Compare activity with the customer's age, occupation, income, account history and stated purpose, without relying on demographic assumptions.

5) Unusual Cash Activity

Cash activity may present AML risk when it conflicts with a customer's profile or normal behaviour. Red flags include sudden increases in deposits, substantial cash activity by low-cash businesses, deposits far from the customer's usual location, repeated deposits followed by transfers and activity spread across multiple branches. These patterns may overlap with structuring, funnel accounts and other money laundering typologies.

Context matters: a restaurant may reasonably handle more cash than a software company. Compliance teams should therefore assess cash activity against the customer’s expected business model, historical behaviour, location, turnover and known sources of funds rather than treating cash usage alone as an AML red flag.

6) Third-Party Payments and Counterparty Concentration

Third-party payments may indicate hidden ownership, fraud, mule networks or layering, all of which are common money laundering typologies. AML red flags include numerous unrelated senders, unexplained payments made on behalf of a customer, frequent transfers to unrelated third parties and multiple customers sending funds to one beneficiary.

Shared contact details, devices, IP addresses or payment information may reveal hidden connections. Circular transfers between related accounts are also important. Network analysis can help identify relationships and transaction monitoring typologies that individual transaction reviews may miss.

7) Dormant Accounts and Sudden Behavioural Changes

A dormant or low-activity account that suddenly becomes active may indicate fraud, account takeover, money mule activity or a change in ownership. AML red flags include new payment destinations, international transfers, larger transactions, unfamiliar counterparties or activity that differs from the customer's history.

Previously inactive businesses processing large volumes should also be reviewed. Behavioural monitoring helps identify these deviations beyond fixed thresholds and can reveal transaction monitoring typologies associated with account takeover, layering or other money laundering typologies.

8) Cross-Border Layering

Layering increases transaction complexity to obscure the origin, ownership or destination of funds. Common money laundering typologies include transfers through multiple jurisdictions, unclear commercial rationale, repeated movements between related entities, routing through unrelated countries and funds leaving shortly after arrival. These patterns may represent AML red flags when combined with opaque ownership, higher-risk counterparties or inconsistent trade documentation.

Important Compliance Point

FATF grey-list status is not automatic evidence of suspicious activity. Institutions should avoid blanket enhanced due diligence or indiscriminate de-risking and instead apply a proportionate, risk-based approach that considers the customer, transaction purpose, counterparties, source of funds and overall circumstances.

9) Shell Companies and Complex Corporate Structures

Transaction monitoring is stronger when combined with KYB, beneficial ownership and corporate registry data. AML red flags include high-value payments through inactive entities, limited operating activity, transactions disproportionate to company size, repeated transfers between related companies and opaque ownership structures.

FATF/Egmont identifies complex structures, shell companies, minimal business activity and unexplained dormancy as potential warning signs. Assess transaction activity alongside ownership, company purpose, expected turnover, industry profile and related counterparties. These factors can help identify money laundering typologies that may not be visible from individual payments alone.

10) Trade-Based Money Laundering

Trade-based money laundering (TBML) uses legitimate-looking commercial transactions to transfer value or disguise criminal proceeds. Common money laundering typologies include over- or under-invoicing, multiple invoicing, phantom shipments and false descriptions.

AML red flags include payments that do not match invoices, unexplained third-party transfers, opaque counterparties, repeated payments to related overseas entities, unusual trade routes and inconsistent pricing. FATF/Egmont indicators also highlight mismatches between a company’s business activity, ownership, payment behaviour and stated trade. These indicators can support transaction monitoring typologies designed to identify suspicious trade activity.

11) Virtual Asset and Cryptocurrency Typologies

Virtual asset activity can create AML risks as funds move rapidly across exchanges, wallets, jurisdictions and asset types. Transaction monitoring typologies in this area may involve rapid fiat-to-crypto-to-fiat conversion, unexplained use of multiple exchanges, mixers, anonymity-enhancing assets, unregistered or high-risk VASPs and unexplained peer-to-peer transfers. AML red flags include activity that does not match the customer's profile, particularly where funds move quickly without a clear economic purpose.

DeFi adds risks involving protocols, bridges, self-hosted wallets and cross-chain activity. Repeated movement across chains or protocols without a clear economic purpose may warrant further review, particularly when linked to mixers, sanctioned addresses or unregistered providers.

12) Cyber-Fraud Proceeds

Cyber-fraud proceeds may come from phishing, business email compromise, account takeover, investment scams or impersonation fraud. AML red flags include multiple victims paying one account, rapid dispersal or withdrawal of funds, newly opened accounts receiving unrelated payments and similar activity across connected accounts. Linking fraud signals with AML monitoring helps identify mule accounts and coordinated networks.

These patterns may form part of broader transaction monitoring typologies involving rapid movement of funds, pass-through accounts and layering. Reviewing customer behaviour, counterparties and connected accounts together can help distinguish isolated fraud events from organised money laundering typologies.

13) Terrorist Financing Indicators

Terrorist financing may involve legitimate or illicit funds, meaning transactions can be small and difficult to detect through value-based rules. Potential AML red flags include unusual payment networks, rapid collection and dispersal of funds, unexplained donations, multiple small payments to common recipients and activity inconsistent with the customer's stated purpose. Assess counterparties, geography, payment channels and relationships objectively, without making assumptions about any country, religion, charity or community.

Transaction monitoring typologies for terrorist financing should therefore consider relationships, timing, geography and payment purpose rather than relying only on transaction value or fixed thresholds.

14) Sanctions Evasion and Proliferation Financing Patterns

Sanctions screening and transaction monitoring are distinct but complementary controls. Potential AML red flags include unexplained intermediaries, complex ownership structures, sudden counterparty changes, multi-jurisdiction payment routes and transactions inconsistent with known trade activity. Unusual shipping routes, newly inserted third parties and payment chains that obscure origin or destination may also warrant review. Transaction monitoring adds behavioural context to sanctions screening, beneficial ownership checks and counterparty due diligence.

These patterns may overlap with money laundering typologies involving layering, opaque ownership and trade-based value transfer. Reviewing them alongside relevant transaction monitoring typologies can help identify activity that requires further investigation.

How to Build Effective Transaction Monitoring Scenarios

Effective transaction monitoring scenarios help compliance teams identify suspicious transaction patterns while keeping alerts relevant to each customer’s risk profile.

The strongest AML monitoring scenarios combine transaction data, KYC and KYB information, customer behaviour, counterparty relationships and risk-based thresholds to detect meaningful financial crime typologies, including relevant transaction monitoring typologies and money laundering typologies.

Step 1: Understand Financial Crime Risk

Begin with a documented AML risk assessment covering your customers, products, services, delivery channels, jurisdictions and business models. Assess factors such as customer type, transaction volume, source of funds, geographic exposure, payment methods and the likelihood of money laundering, terrorist financing, fraud or sanctions evasion.

Risk is not uniform across an organisation. A crypto exchange, private bank, payment institution and online marketplace may face different transaction monitoring risks, so monitoring scenarios should reflect the institution’s specific customer base, products and operating model. This helps ensure that AML red flags are assessed according to the surrounding customer and business context.

Step 2: Identify Relevant Typologies

Map the risks identified in the assessment to relevant AML typologies, such as structuring, smurfing, pass-through accounts, money mule networks, rapid movement of funds, cross-border layering, trade-based money laundering and suspicious virtual asset activity. These are common transaction monitoring typologies and money laundering typologies, but not every business needs every transaction monitoring scenario.

For example, a crypto exchange may prioritise mixer exposure, rapid asset conversion, peer-to-peer transfers and unregistered VASPs, while a private bank may focus on complex corporate structures, beneficial ownership, high-value transfers and unexplained cross-border activity. Scenario coverage should be proportionate to the customer and business risk profile, with relevant AML red flags built into the monitoring approach.

Step 3: Determine Required Data

Effective transaction monitoring depends on accurate, connected data. Required inputs may include transaction details, KYC, KYB, customer risk ratings, beneficial ownership, counterparties, devices, geographic information, source of funds, source of wealth and historical customer behaviour.

The quality and completeness of this data directly affect AML monitoring outcomes. Combining transaction data with customer profiles, business information, counterparty relationships and behavioural history helps compliance teams identify unusual activity, detect linked accounts and assess AML red flags in context rather than treating individual alerts as proof of financial crime. It also helps investigators recognise broader transaction monitoring typologies and money laundering typologies that may not be visible in a single transaction.

Step 4: Create Monitoring Logic

Build transaction monitoring scenarios around the AML typologies and customer risks most relevant to your business. Use risk-based thresholds, ratios, transaction frequency, velocity, rolling windows, peer-group analysis, behavioural baselines and network relationships to identify suspicious transaction patterns. Combine these techniques with KYC, KYB, customer risk ratings, counterparties and geographic data so alerts reflect context rather than isolated transactions.

Effective AML transaction monitoring should detect patterns such as structuring, rapid movement of funds, money mule activity, unusual cross-border payments and suspicious virtual asset transactions. These patterns may represent transaction monitoring typologies or money laundering typologies and should be evaluated alongside relevant AML red flags. Document the purpose of each rule, the threshold rationale, the data used and the expected escalation path so investigators can understand why an alert was generated.

Step 5: Test and Tune

Test each transaction monitoring scenario regularly to assess alert volumes, false positives, detectable false negatives, SAR/STR conversion, scenario effectiveness, investigator workload and data quality. Review whether alerts identify meaningful financial crime risks or simply create repetitive, low-value investigations. Segment results by customer type, product, channel, geography and risk level to identify gaps in AML monitoring.

Tuning should reduce unnecessary alerts without weakening coverage of important transaction monitoring red flags. Use investigator feedback, case outcomes and data-quality reviews to adjust thresholds, rolling windows, peer groups and behavioural models. Keep a clear record of changes, testing results and approvals to support governance, auditability and regulatory review.

Step 6: Reassess Typologies

Reassess AML typologies, transaction monitoring typologies and monitoring scenarios whenever criminal methods, products, customer segments or transaction channels change. Review the impact of new jurisdictions, payment methods, virtual asset services, cyber-enabled fraud patterns and regulatory guidance. Investigations should also feed new suspicious transaction patterns and emerging AML red flags back into the risk assessment and monitoring framework.

The FCA specifically highlights the importance of reviewing transaction monitoring rules and typologies, understanding threshold and scenario rationales, and testing data quality. A regular risk-based review helps ensure that AML transaction monitoring remains relevant, detects emerging red flags and continues to reflect the institution’s actual financial crime exposure.

Why a Single Red Flag Does Not Mean a Transaction Is Suspicious

A transaction monitoring red flag signals the need for review, not proof of financial crime. A large international transfer may be legitimate if it matches the customer’s normal activity and supporting documentation. Several smaller transfers may warrant investigation when they occur quickly, cluster below a relevant threshold, involve multiple accounts, move rapidly elsewhere or differ from historical behaviour.

Effective AML monitoring considers transaction size, frequency, velocity, geography, counterparties, customer risk, source of funds and expected activity together. One unusual payment does not automatically require a SAR or STR; it should prompt a proportionate review of relevant customer and account information. Risk usually emerges from the context and combination of AML red flags, not one signal alone.

Common Transaction Monitoring Mistakes to Avoid

Effective AML transaction monitoring depends on more than generating alerts. Understanding common mistakes helps compliance teams improve monitoring scenarios, reduce false positives and identify suspicious transaction patterns more accurately.

The following errors can weaken transaction monitoring controls and make it harder to detect relevant AML red flags, transaction monitoring typologies and money laundering typologies.

Using fixed thresholds without customer context - Fixed thresholds can generate unnecessary transaction monitoring alerts when they do not reflect a customer’s normal activity, income, business model or risk profile. A large payment may be routine for an international company but unusual for an individual customer, so AML monitoring should combine thresholds with behavioural analysis and customer information. This contextual approach helps distinguish meaningful AML red flags from ordinary activity.

Running identical scenarios across every customer segment - Different customers face different financial crime risks. A crypto exchange, charity, retailer and private bank should not necessarily use the same transaction monitoring scenarios. Segmenting customers by products, services, geography and risk profile helps compliance teams identify relevant AML typologies and transaction monitoring typologies while reducing false positives.

Ignoring beneficial ownership and counterparty information - Transaction activity can appear legitimate until the parties behind it are examined. Reviewing beneficial ownership, related entities and counterparties can reveal shell companies, hidden relationships, unusual payment networks or transactions inconsistent with the customer’s stated business purpose. These relationships may also expose money laundering typologies that are not apparent from transaction values alone.

Creating alerts without clear escalation logic - Every transaction monitoring alert should have a defined review process, including what information investigators must assess, when additional customer information is required and when a case should be escalated. Clear escalation logic helps teams distinguish routine alerts from potential suspicious activity and supports consistent SAR or STR decisions where required.

Optimising only for alert volume - A high number of AML alerts does not necessarily indicate an effective monitoring programme. Compliance teams should also measure alert quality, investigation outcomes, false-positive rates, scenario effectiveness and the identification of meaningful suspicious transaction patterns. The objective is to identify relevant AML red flags and financial crime risks, not simply to produce more alerts.

Relying exclusively on transaction-by-transaction monitoring - Reviewing individual transactions in isolation can miss broader financial crime patterns. Effective suspicious activity monitoring should also consider customer behaviour over time, transaction velocity, linked accounts, counterparties, geography, devices and changes from the expected customer profile. This broader approach improves the detection of transaction monitoring typologies, money laundering typologies and connected AML red flags.

Bottom Line

Transaction monitoring typologies help compliance teams identify potential financial crime, including structuring, money mule activity, cyber fraud, trade-based money laundering and suspicious virtual asset transactions. These money laundering typologies provide a framework for understanding how illicit funds may be moved, disguised or integrated into the financial system.

AML red flags do not prove wrongdoing; they indicate where further investigation may be needed. Effective monitoring combines transaction data with KYC, KYB, customer risk and behavioural patterns to identify meaningful activity and reduce false positives. Binderr Services helps businesses streamline these compliance processes with practical tools for managing KYC, KYB, screening and ongoing risk monitoring.

FAQs -  Transaction Monitoring Typologies & Red Flags