What are the red flags for suspicious transactions?

Behaviour can be revealing: a customer who is unusually nervous, avoids calls and contact, asks about the firm's record-keeping or reporting duties in a way that suggests they want to avoid them, threatens an employee to discourage record-keeping or reporting, or offers an employee a gratuity.

Identification problems are another group. An agent, lawyer or financial adviser acts for the customer without proper authority such as a power of attorney. The customer provides unusual identity documents, cannot or will not produce originals, gives minimal or misleading information that is hard to verify, will not explain its business or group structure, has no fixed address or does not want mail, uses many offshore accounts, or keeps changing professional advisers. Unexplained inconsistencies between identity documents, residence and travel history, and complex trust or nominee networks, point the same way.

A customer being a politically exposed person is not in itself a red flag of suspicion; it is a risk factor that calls for enhanced due diligence.

The core signs are transactions with no discernible purpose or that are unnecessarily complex, transactions whose size or pattern does not match the customer's usual business, large volumes that the customer's activity does not justify, relationships with only one transaction or a very short life, and customers whose occupation does not match the size of their dealings.

In investment services, look for churning (frequent trading in the same instrument without obvious reason), orders out of line with market conditions, settlement in cash or by someone other than the customer, payments to unrelated third parties, an investor indifferent to fees or suitability, cash or monetary instruments kept just below thresholds used to fund an account, trading accounts funded and then left almost idle before withdrawals begin, several well-funded accounts with little activity, and a large position liquidated through many small transactions. In the securities sector, add customers acting for a principal they will not identify, many accounts with frequent transfers between them, sudden heavy wire activity on dormant accounts, requests to bypass documentation requirements, penny stocks or bearer bonds without a clear reason, and high account activity with few actual securities trades.

Money that passes through quickly, with high movement but low opening and closing balances, suggests the account is a conduit for layering.

Cash red flags centre on structuring: repeated deposits kept just under thresholds, several accounts opened to take them, deposits at different branches or ATMs on the same day, and funds gathered from several accounts into one and then wired abroad. Large deposits in high-denomination notes, or large cash movements for a business that does not normally handle cash, are also signs. For non-cash deposits, watch for sequential traveller's cheques or money orders, and cheques inconsistent with the account's stated purpose. Cyprus has no amount below which suspicion need not be reported; the thresholds criminals try to stay under are those that trigger checks, such as €15,000 for occasional transactions, and the €10,000 limit on cash payments for goods and services.

Wire transfer red flags include large sums sent to secrecy havens, many small incoming transfers followed by one large outgoing transfer abroad, incoming funds to be turned into cheques posted to someone who is not a customer, immediate purchase of monetary instruments for a third party, and a sudden rise in international transfers with no business reason. In lending, a problem loan suddenly repaid without a plausible source, loans secured by cash or offshore collateral, and loan proceeds moved offshore unexpectedly all deserve questions.

Staff can be part of the problem. Warning signs include a lifestyle that the employee's salary cannot support, avoiding holidays or time away from the office, frequently overriding controls or approval limits, an unusual number of unresolved exceptions, overstating a customer's credentials in internal reports, using company resources for private interests, and helping transactions where the ultimate beneficiary or counterparty is not disclosed.

For terrorist financing, the CySEC Directive highlights non-profit organisations: funds raised or moved that do not match the organisation's apparent sources, transactions whose size or type does not fit its stated purpose, sudden increases in activity, large unexplained cash transactions, and no donations from the country where it is based. Terrorist groups also launder criminal proceeds with the same methods as other criminals, such as cash couriers, structured deposits and front companies.