Trade-based money laundering red flags are signs that a trade may be moving value rather than goods: a price far from what the goods are worth, goods described one way on the invoice and another on the bill of lading, a voyage routed through a free-trade zone for no commercial reason, a payment from someone who is not party to the trade, money that leaves a country and comes back, and a customer suddenly trading in goods it has never handled. The lists come from FinCEN's 2010 advisory, the FFIEC's BSA/AML examination manual and the FATF and Egmont Group risk indicators of 2021. What the lists do not say clearly is that a bank sees only some of them, and which ones depends on its role in the trade. Botminds' Trade-Based Money Laundering Detection screens trade against 86 red flags drawn from those sources, each cited on screen, and this page sorts them by who can actually see them.
Where the page shows a red flag at work, the example is a fictional sample bank, Corvane National Bank, in the solution.
Three official lists, and one warning about all of them
4
trade-document red flags FinCEN lists first in its 2010 TBML advisory, before its payment and deposit indicators
10
items the FFIEC manual tells trade finance monitoring to give greater scrutiny, beyond sanctions filtering
35
FATF and Egmont risk indicators in four groups: structural, trade activity, documents and commodities, accounts and transactions
What are the red flags of trade-based money laundering?
The red flags of trade-based money laundering fall into five families: price and quantity that do not fit the goods, documents that do not agree with each other, routes and shipments that make no commercial sense, payments that do not follow the trade, and parties whose structure or behaviour does not fit their business. Each official list covers all five, in different words and with different emphasis. FinCEN's advisory grew out of US trade with Mexico and Central and South America and leans towards payments and deposits; the FFIEC list is written for banks in the letter of credit process; the FATF and Egmont list is written for everyone, banks included.
FATF's own introduction to its list is the most useful sentence in any of them, because it tells a bank where to stop: "Some of the risk indicators require the cross-comparison of various data elements (e.g. financial transactions, customs data, and open market prices) often held in external sources. Due to this reliance on external data, the private sector will not observe all of the indicators identified below" (FATF and Egmont, TBML Risk Indicators, 2021).
Which TBML red flags can a bank see?
A bank can see the red flags that live in what it holds, and what it holds depends on its role. The Egmont Group's working group sorts the reports banks send to financial intelligence units into three kinds: reports on trade finance, where the bank is directly involved and has the underlying documents; reports on open account settlements, where "Underlying documents are not generally available to the financial institution"; and reports on trade payments passing through correspondent banking, where the bank has neither the documents nor information on the customer (FATF and Egmont, TBML: Trends and Developments, 2020). The table applies that sorting to the red flags themselves.
Each family of TBML red flag, by who can actually see it
| Red flag | Bank holding the documents (credit or collection) | Bank moving an open account payment | Needs data outside the bank |
|---|---|---|---|
| Price far from the market for the goods | Partly: the invoice price is there; a benchmark is needed, and only obvious cases are reliable | No: there is usually no invoice | Customs unit values, mirror statistics |
| Goods described differently across documents | Yes: invoice, bill of lading, packing list, certificate of origin | No | — |
| Goods out of line with the customer’s business | Yes, against the due diligence profile | Partly: from the payment narrative and the counterparty | — |
| Route through jurisdictions with no commercial reason | Yes: the bill of lading and voyage records | No | Customs and port data |
| Payment from a party not in the trade | Yes: who reimburses or pays | Yes: the ordering customer on the wire | — |
| Credit amended or extended without a reason | Yes, only the bank that holds the credit | Not applicable | — |
| Imports declared do not match payments made | No | No | Customs declarations against bank transfers |
| Money routed in a circle through other countries | Only its own leg | Only its own leg | An FIU, joining reports from several banks |
| Account used as a pass-through | If the customer banks there | Yes, on the customer’s own account | — |
| Same documents financed at more than one bank | Only within its own book | No | Registries, or information shared between banks |
Three things follow from the table. The bank holding the documents can see more than anyone else in the payment chain, which is why the FFIEC asks it to read them for anomalies and not only for compliance with the credit. The open account bank sees the payment and the parties, so its red flags are about who pays, how much and how often. And several of the most telling indicators, mismatches between declared imports and payments, and money that goes round in a circle, are visible only to authorities that hold customs data or reports from many banks.
What are the FFIEC trade finance red flags?
The FFIEC manual lists ten things that trade finance monitoring "should give greater scrutiny to" in addition to sanctions filtering, and it frames them as a monitoring list rather than a checklist of suspicion (FFIEC BSA/AML Manual, Trade Finance Activities). Six of them are about the trade itself, and the manual's wording is worth knowing exactly:
Six of the FFIEC's ten trade finance monitoring items, in the manual's words
- “Items shipped that are inconsistent with the nature of the customer’s business”
The manual’s examples: a steel company that starts dealing in paper products, or an information technology company that starts dealing in bulk pharmaceuticals.
- “Obvious over- or under-pricing of goods and services.”
Obvious is the operative word: the manual does not ask banks to price every invoice.
- “Obvious misrepresentation of quantity or type of goods imported or exported.”
Quantity against the customer’s history and capacity; type against the other documents.
- “Transaction structures that appear unnecessarily complex and designed to obscure the true nature of the transaction.”
Layers of intermediaries, back-to-back credits, or mixed products for no visible reason.
- “Customer directs payment of proceeds to an unrelated third party.”
The export side of the third-party problem: the beneficiary asks to be paid somewhere else.
- “Customers shipping items through higher-risk jurisdictions, including transit through noncooperative countries.”
Routing, not only origin and destination.
The manual also says what these signals are worth on their own. Anomalies in shipping documents, obvious mispricing, licences or descriptions "may not, in itself, require the filing of a SAR, but may suggest the need for further research and verification." The list is a reason to look harder, which is why the solution's first move on any flag is to look for the explanation that would clear it. The four items about the credit itself, including amendments and shipments inconsistent with it, are covered with the roles that see them in letter of credit money laundering risk.
What are FinCEN's trade-based money laundering red flags?
FinCEN's 2010 advisory lists four red flags tied to trade documents, then a longer list about payments and deposits drawn from black market peso exchange cases. The four are short and still cited in every training course:
"Third party payments for goods or services made by an intermediary (either an individual or an entity) apparently unrelated to the seller or purchaser of goods." · "Amended letters of credit without reasonable justification." · "A customer's inability to produce appropriate documentation (i.e., invoices) to support a requested transaction." · "Significant discrepancies between the descriptions of the goods on the transport document (i.e., bill of lading), the invoice, or other documents (i.e., certificate of origin, packing list, etc.)."
FinCEN Advisory FIN-2010-A001, February 18, 2010
FinCEN gave the list a context that is easy to drop. The red flags were seen "in conjunction with shipments of high dollar merchandise (such as electronics, auto parts and precious metals and gems) to duty free trade zones, such as in the Colon Free Trade Zone in Panama" (FinCEN FIN-2010-A001). A third-party payment for a container of electronics bound for a free-trade zone is a different alert from a third-party payment for coal shipped to a utility. What FinCEN asks filers to write in a report on these patterns, and how rarely they do, is the subject of what the FinCEN advisory and the SAR data say.
What are the FATF TBML risk indicators?
The FATF and Egmont Group indicators of March 2021 are the broadest list, 35 indicators in four groups, and the most candid about their limits. The structural group is about the trading company itself: unusually complex ownership, mass registration addresses, nominee directors, no online presence or one copied from elsewhere, too few staff for the volumes traded, unexplained dormancy. The trade activity group is about what it does: trade inconsistent with its line of business, routes or methods inconsistent with standard practice, margins too thin to be commercial, a new company suddenly trading in volume in a sector with high barriers to entry. The document and commodity group covers mismatched prices and descriptions, vague goods, missing, counterfeit or resubmitted documents, and imports that do not match payments. The account group covers late changes to payment instructions, pass-through accounts, round amounts and money that comes back.
For a bank, the structural group is due diligence work on its own customer and only partly visible for the counterparty. The trade activity and document groups are where the bank holding the documents has an advantage over everyone except customs. The account group is where the open account bank does most of its work.
Each red flag on an alert names the published source it comes from
What is a third-party payment red flag?
A third-party payment red flag is a payment for goods made by, or to, someone who is not the buyer or the seller and has no visible reason to be involved. FATF's version is precise about where the oddity lies: "Payment for imported commodities is made by an entity other than the consignee of the commodities with no clear economic reasons, e.g. by a shell or front company not involved in the trade transaction." Third-party payment has legitimate forms, such as a parent company paying for a subsidiary's imports or a factor paying an exporter, so the red flag is the absence of a recorded reason, not the third party itself.
On the sample alert the reimbursement for a USD 2,208,000 import credit came from Velmara Holdings FZE in the Jebel Ali Free Zone, a company the credit never names. Over the previous 11 months the beneficiary had sent that same company USD 1,960,000 in four wires, and the notify party on nine of the beneficiary's eleven presentations shared its registered address. The innocent explanation, that Velmara was the applicant's group treasury, would have been proved by a group structure chart; none was in the file, and the due diligence record names no affiliate outside Singapore.
A third-party payer, and value that comes back to it
What red flags apply to open account trade?
In open account trade the red flags are the ones visible in payments and accounts, because the bank does not normally see the invoice or the bill of lading. GAO reported in 2019 that, according to the Wolfsberg Group, 80% of international trade processed through banks is open account, and that banks' ability to identify TBML indicators in it is limited (GAO-20-314R). The indicators that still work are the account and transaction group: payments from parties with no connection to the trade, last-minute changes to payment instructions, round amounts in sectors where they are unusual, accounts that pass money through with a small balance at the end of each day, and activity that rises fast and then stops.
The bank's own records are what make these visible. A single wire for "goods" from a free-zone company is unremarkable. The same company paying for a customer's imports while the customer's supplier pays that company back is a pattern, and it is visible only to a bank that links its customers' counterparties across months of payments.
One red flag is not suspicion
Every official list says the same thing about its own items, and a bank's procedures should say it too. FATF and Egmont: "The existence of a single indicator in relation to a customer or transaction may not alone warrant suspicion of TBML, nor will the indicator necessarily provide a clear indication of such activity, but it could prompt further monitoring and examination, as appropriate." FinCEN asked institutions to weigh its indicators against the customer's expected activity before deciding anything, and the FFIEC calls anomalies a reason for "further research and verification."
That is why the sample bank's overnight run cleared seven of its ten alerts. A price outside the band was a unit error, a port call was a scheduled rotation, a third-party payer was the customer's own parent, each proved by a document in the file. The three that remained carried several red flags that no document explained. For the full library of 86 red flags, each with its source, threshold and history, start at Trade-Based Money Laundering Detection.
Questions people ask
Is one red flag enough to file a SAR?
Not usually. FATF and the Egmont Group say a single indicator may not alone warrant suspicion, and the FFIEC says anomalies may not in themselves require a SAR but suggest further research. The decision to file rests on what the research finds, judged against the customer's expected activity.
What are TBML red flags for free-trade zones?
FinCEN's 2010 advisory tied its trade red flags to high-value goods such as electronics, auto parts and precious metals shipped to duty-free zones, naming the Colon Free Trade Zone in Panama. A transshipment through a free zone with no commercial reason, or a payer registered in one, is a common trigger for further research.
Can a correspondent bank see TBML red flags?
Very few. The Egmont Group notes that a bank handling trade payments through correspondent banking has no access to the underlying documents or customer information, so it can only spot irregular cross-border payments and parties linked to known networks. The documentary red flags belong to the bank holding the credit or collection.
What is a red flag for multiple invoicing?
The same goods or shipment invoiced more than once to justify several payments. FATF and Egmont note that criminals reuse the documents across several banks, which makes the scheme hard for any one bank to identify; a bank can catch reuse within its own book. At the sample bank one open alert is an invoice presented at two banks, and confirming it is waiting on the other bank's answer.
Are TBML red flags the same as trade fraud red flags?
They overlap. Forged or reused documents and phantom shipments are both fraud and laundering techniques. The difference is the victim: in trade fraud the bank or a financier loses money; in TBML the documents are used to move value, often with the bank paid in full.