Retail and Commercial Banking

High inbound velocity from unrelated personal accounts, same-day outbound to newly added payees, values clustered just under the threshold.

Third-party cash deposits into an ordinary customer's account, in values below the reporting threshold, made by people with no relationship to the accountholder, matching an expected inbound remittance that never arrives.

Deposit volumes far exceeding what the trade supports, physical tells at the counter, and transaction monitoring that misclassifies the deposit type.

Merchant acquiring data, utilisation meters, headcount or occupancy flat while account credits multiply. The business has not grown; only the account has.

Nothing, at a single institution. Each account shows a plausible business banking its daily receipts. The pattern exists only across banks, so it surfaces through consortium data sharing or a merger of two of the institutions involved.

Newly opened accounts with immediate inbound-outbound throughput and no other life, device and IP reuse across unconnected customers, and a demographic skew toward students and young adults.

Settlement legs only: periodic net transfers between broker accounts, trade invoices used to square positions, and cash aggregation ahead of settlement.

Sequences of small value-varying transactions preceding a step change in volume, activity that settles just below alerting thresholds across several distinct rules at once, and customers whose behaviour changes within days of a rule being retuned.

Funnel accounts taking cash deposits below the reporting threshold in one location and withdrawn immediately in another; multiple unrelated accountholders sharing an address, device or telephone number; wage payments returned to the employer shortly after credit; customers who never attend alone and whose account is operated by a third party.

Small repeated payments, often at unusual hours, to money transfer beneficiaries in a small number of jurisdictions with no family or trade connection to the customer; use of prepaid instruments or virtual assets by a customer with no other digital activity; and payment values clustered in narrow bands.

Money service business accounts with corridor concentration inconsistent with any diaspora trade, third-party cash payments made on behalf of individuals with no relationship to the payer, and settlement transfers between broker accounts along known routes.

The banking exposure sits either side of the movement: aggregation of cash before departure through connected accounts and businesses, and placement afterwards in the destination jurisdiction with no corresponding trade.

Operator settlements to customers whose deposits and withdrawals net close to zero over time, betting patterns designed to minimise variance rather than to win, and third-party funding of accounts.

An account in good standing whose signatory died in a jurisdiction the firm does not search, filings continuing for a director with no verifiable life, and mandates never refreshed because the account never triggered a review.

An established account whose entity no longer exists at the registry. Detectable only by re-verifying incorporation status across the existing book, which is a batch job most firms have never run.

A structure chart that never evidences control, a nominee shareholder defeating verification, and a customer who offers further documents instead of an answer.

Statements with no fees or charges across months, running balances consistent to the penny, logos at incorrect aspect ratio, institution codes in the wrong format, identity photographs internally inconsistent or inconsistent with stated age, third-party webcam plugins during liveness checks.

Emulator and virtual-camera artefacts in the capture stream, device and app-integrity signals that contradict a genuine handset, repeated onboarding attempts from the same device fingerprint under different identities, and capture metadata inconsistent with the phone the customer claims to hold.

Thin-file customers who behave impeccably for months, clusters sharing partial attributes such as address, device or contact details, credit files that begin abruptly in adulthood, and accounts whose only real purpose emerges long after onboarding.

A corporate customer or merchant whose entire evidenced existence post-dates its application, imagery and copy that cannot be traced to any real premises or product, a domain registered shortly before onboarding, and referees who exist only online.

Voice authentication passing on a call whose channel or device signals are inconsistent with the customer, callbacks answered on newly registered numbers, and instructions confirmed by voice that the customer later disputes entirely.

Multiple urgent same-day transfers to new beneficiaries authorised by one employee, outside normal approval patterns, following a confidential instruction the payer cannot corroborate internally.

Due diligence closed out on an assertion of state ownership, and transaction volumes exceeding the plausible revenue of the entity the name resembles.

Source of wealth evidenced principally by the qualifying investment itself, onboarding shortly after grant of status, and jurisdiction of residence inconsistent with any economic or family connection.

Payments to an EMI incorporated months earlier with no filed accounts, no plausible commercial relationship to the payer, and volumes out of line with its stated business.

Counterparty IBANs whose country differs from the customer's stated location, payments that appear domestic but settle cross-border, and beneficiary names that cannot be reconciled to the underlying account.

Royalty or licensing receipts from a platform with no corresponding audience, and licence fees between connected entities with no arm's-length benchmark.

Bulk purchases of stored-value products at retail, card-load patterns inconsistent with any consumer use, and programme manager settlement accounts with volumes exceeding the plausible cardholder base.

Payment volumes and corridors inconsistent with the respondent's own customer base, beneficiary and originator fields naming institutions that are not the respondent, and activity in currencies or jurisdictions outside the stated relationship.

Platform settlements to a merchant whose sales concentrate among a small set of repeat buyers, pricing that discourages genuine customers, and shipping weights and destinations inconsistent with the goods described.

Transaction sequences with machine timing and sizing characteristics, activity that reshapes itself shortly after a control is changed, and volumes of small movements that exceed what any manual operation could sustain.

Exposure is indirect and sits at the fiat edges: payment institutions, exchanges and correspondent relationships with entities in the group's network. The prohibition itself is the compliance obligation.

Victim-side outbound payments escalating over weeks to newly added payees and exchange accounts, followed by indemnity claims and recall requests once the victim realises. The collection accounts show inbound from many unconnected individuals.

Victim-side: an urgent, unexplained payment to an exchange or a specialist incident-response intermediary. Insurer and IR-firm accounts are a concentration point.

ATM operator and OTC broker settlement accounts with cash deposit volumes inconsistent with a retail customer base, and customers whose card spending continues after banked income stops.

Numerous customers each receiving modest, regular exchange settlements with no other economic profile, sharing device, address or beneficiary characteristics.

Round-figure invoices, no schedule of services, fee levels the file does not justify, and counterparties incorporated shortly before the contract date.

Card accounts repaid in cash or by unrelated third parties, purchase volumes far exceeding personal use, and paired domestic flows in two jurisdictions with no instrument connecting them.

Offshore receipt accounts holding balances well above production cost, cover purchases of high-value goods with no commercial logic, and settlement rates away from market.

Commodity trade finance where volumes exceed the licensed or certified capacity of the stated source, certification and permit documentation that cannot be reconciled to the shipment, and front companies with no operational footprint at origin.

Wholesale accounts with purchase volumes inconsistent with declared duty, rapid movement of goods between connected traders, and cash takings at retail exceeding what the site can support.

Merchant accounts with high chargeback and dispute rates against a narrow product range, settlement to beneficiaries unrelated to the listed merchant, and rapid rotation of storefronts under the same banking relationship.

Bullion dealer and refiner accounts with volumes inconsistent with declared sourcing, and national export statistics exceeding any domestic mining or refining capacity.

Repossession followed by continued occupation or management by the former owner, debt routed through a professional intermediary, and funds flowing back to the supposedly dispossessed party.

Rent credits inconsistent with occupancy or utility data, tenants who never pay late, and payments originating from accounts connected to the landlord.

Dealer accounts taking third-party payments for goods delivered to someone else, part-exchange chains that never settle in cash, and customers whose purchases exceed any evidenced income.

Single premium payments from third parties or unrelated jurisdictions, early surrender accepted at a material penalty, frequent changes of beneficiary, and cooling-off cancellations with refunds directed to a different account from the one that paid.

Deposits gifted by parties with no evidenced means, income documentation that cannot be corroborated with the employer or HMRC, valuations materially above comparable sales, and early full repayment shortly after completion.

The same tooling signature across customers with no other connection: identical document templates, shared device or capture characteristics, and mule accounts appearing in coordinated batches rather than individually.

Large inbound settlements supported by foreign court orders. The control weakness is that court-ordered recoveries are assumed clean and rarely receive enhanced due diligence.

Client account movements with no underlying legal or accountancy transaction, funds returned to source shortly after receipt, and pooled balances that cannot be reconciled to matters.

Clusters of customers sharing a registered office, a formation agent or a nominee, incorporated in batches, and presenting near-identical onboarding documentation.

Filed accounts showing turnover a business of that size, premises or headcount could not generate; certificates of confirmation supporting figures no independent record corroborates; and a cash-intensive client whose declared takings rise without any matching change in the operation.

Assets and trade transferred to a newly incorporated company with the same operation and different directors shortly before insolvency; directors with a history of successive failed companies in the same trade; and a company whose final months show payments to connected parties rather than to creditors.

Customers whose trades consistently lose money on fees and spreads, identical baskets bought and sold across branches, and no economic rationale beyond currency conversion.

Consultancy receipts from jurisdictions where the recipient holds influence, payments unconnected to any deliverable, and timing correlated with contract awards.

Small recurring outbound payments to campaigns, appeals or virtual asset addresses associated with proscribed causes; a charity whose disbursement pattern does not match its stated programme; and clusters of small transfers converging on a single beneficiary.

Donation inflows inconsistent with any visible fundraising activity, grant disbursements to unverifiable overseas partners, trustee turnover with no succession, and cash withdrawals in conflict-adjacent jurisdictions.

Club funding by shareholder loan from opaque structures, sponsorship values with no commercial benchmark, agent and image-rights payments routed through unrelated jurisdictions, and transfer fees inconsistent with market.

Borrowing from an offshore entity with no lending business, security or guarantees provided by parties connected to the borrower, interest paid to a jurisdiction unrelated to the transaction, and loans that are never enforced when they fall into arrears.

Rapid high-value trading between newly incorporated counterparties in the same goods, payments that pass through in hours, margins too thin to support the businesses, and directors with no trading history in the sector.

Large numbers of newly incorporated companies sharing directors, addresses or formation agents, each running modest payroll, appearing and dissolving on a cycle.

Scheme proceeds received by a company with no prior trading history, immediately dispersed to directors or connected parties, followed by dissolution.

Ownership changes closely following a designation date, incoming owners with no commercial history, and unchanged management across the restructuring.

Trade finance and insurance exposure to vessels with dark intervals during loading, attestations that cannot be reconciled with position history, charterers and shipowners incorporated shortly before the voyage, and repeated changes of flag and name.

Sudden growth in trade finance for electronics and machinery through transhipment jurisdictions, buyers incorporated after the export controls took effect, and end-user statements inconsistent with the buyer's business.

For VASPs: deposits traceable to designated addresses, and institutional counterparties who cannot evidence their own inbound provenance. For banks: correspondent exposure to intermediaries in the cash-out chain.

Payroll and contractor payments to accounts whose device and location signals contradict the stated worker location, several apparently unrelated contractors sharing payment infrastructure, and rapid onward transfer of net pay.