We’ve created suspicious activity indicators for remittance service providers to help you identify potential money laundering, terrorism financing, proliferation financing and other serious criminal activities. 

On this page

These indicators can inform your transaction monitoring alerts that trigger further review. To complement these indicators, you must also ensure your transaction monitoring systems alert you to unusual, large or complex transactions or patterns of transactions. 

This indicators list isn’t exhaustive. You should consider other indicators specific to your business’s individual risk profile and circumstances. 

Customer identification and behaviour

Read our list of suspicious activity indicators for customer identification and behaviour.

Customer identification indicators

A customer:

  • provides identification information that’s false, misleading, vague or cannot be verified
  • refuses or is reluctant to provide the identification information required
  • has inconsistencies in information across different identification documents
  • displays a pattern of name variations or uses aliases from one transaction to another
  • alters the transaction amount after being asked for identity documents
  • is identified in adverse media
  • has sources of wealth or sources of funds that are unexplained or inconsistent with their profile
  • provides post office box information instead of residential address information. 

A company customer:

  • refuses or is reluctant to provide information about beneficial ownership
  • provides beneficial ownership information that is false, misleading, vague or cannot be verified.

Multiple customers with no familial links provide the same hotel or residential address.

Customer behaviour indicators

A customer:

  • appears to be acting under the direction of a third party
  • appears to be in doubt or nervous when asked for further details about the transaction
  • is in a hurry to complete the transaction, or enquires if they can provide identification information later
  • shows no interest in fees or the exchange rate or is happy with a poor exchange rate
  • is unwilling to or cannot provide reasonable explanation for remittances
  • appears nervous, overly defensive or evasive when questioned
  • is the subject of law enforcement enquiries, or their activity
  • makes an unusual enquiry to venue staff about whether they report to government authorities. For example, AUSTRAC, the Australian Taxation Office or law enforcement agencies

Multiple customers:

  • who don’t appear to be related have common identifiers
  • making similar transactions have common identifiers.

Money laundering

Read our list of suspicious activity indicators for money laundering.

Money laundering indicators 

A customer:

  • has a sudden and significant increase or decrease in account activity with little to no logical explanation or economic rationale
  • makes frequent transactions just below the $10,000 reporting threshold to avoid being reported (known as structuring)
  • makes transactions that are inconsistent with their established patterns of behaviour
  • has a sudden spike in remittance activity to or from higher-risk jurisdictions including those that border a conflict zone
  • has a sudden spike in remittance activity to or from countries with less stringent AML/CTF regimes
  • sends or receives funds to or from countries known for high levels of corruption and money laundering
  • makes multiple, rapid transactions to obscure the origin or destination of their funds
  • splits larger transactions into multiple smaller transactions to avoid scrutiny
  • makes transactions that have no reasonable or logical explanation or apparent economic rationale
  • has discrepancies between the declared purpose of the transaction and their profile
  • whose size, frequency or patterns of transactions appear to indicate unusual or suspicious activity
  • sends or receives funds to or from jurisdictions inconsistent with their profile
  • funds transfers with multiple debit cards or cash payments
  • cannot explain or provide evidence for the source of their funds
  • enquires about reporting thresholds, or a potential customer does
  • requests that their name be omitted from the transaction
  • makes multiple transactions through multiple agents often on the same day
  • makes multiple high-value transactions in a short time period using an account that was recently created or has been dormant.

Multiple customers:

  • remit funds to a single beneficiary, with no apparent connection between the sender and beneficiary
  • open accounts or undertake transactions in an apparently coordinated manner.

Trade-based money laundering indicators

A customer:

  • makes fund transfers for products shipped to or from a higher-risk jurisdiction for money laundering or trade-based money laundering
  • has apparent discrepancies between the goods shipped and the descriptions of the goods on the bill of lading or invoice that accompanies the transaction
  • makes transactions involve the use of front or shell companies
  • ships products through one or more jurisdictions, including special economic zones, with no apparent economic rationale
  • makes transactions that involve repeatedly amended or extended letters of credit
  • remits or receives funds to or from a country that borders a high-risk jurisdiction.

Serious financial and organised crimes

Read our suspicious activity indicators for serious financial and organised crime.

Child exploitation indicators

A customer:

  • makes same-day payments to multiple beneficiaries
  • makes low-value transactions between $15 and $500
  • attempts to obfuscate their identity, such as using name variations
  • has no work or family links with the jurisdiction they’re sending funds to
  • transfers funds to a higher-risk jurisdiction for child exploitation
  • attempts to disguise their activity through describing payments as ‘accommodation’, ‘education’, ‘school’, ‘uniform’ or 'medical bills'
  • remits payments for virtual private network software, screen capture and livestreaming programs, or metadata stripping and anonymising software.

Terrorism, national security and international crime

TRead our suspicious activity indicators for terrorism, national security and international crime.

Terrorism financing indicators

A customer:

  • makes transactions in the name of an entity, foundation or association which may be linked to or suspected of being involved with a terrorist organisation
  • has account activity that indicates attempts to raise donations in an unofficial or unregistered manner
  • donates to a cause that’s subject to adverse media
  • sends or receives funds to or from countries known to be high risk for terrorism financing
  • sends funds to multiple beneficiaries in higher-risk jurisdictions for terrorism or terrorism financing
  • is matched through screening against an Australian or international sanctions list
  • remits funds to geographical locations in high-risk jurisdictions or countries where formal banking channels may not operate
  • who’s remittance instructions include references to ideologically or religiously motivated extremism terms and/or items
  • makes sudden unexplained remittances with little or no economic rationale to a high-risk country or a country that borders a conflict zone. 

Open-source information indicates a customer:

  • or parties to the customer’s transaction may have links to known terrorist entities or terrorist activities
  • displays extremist ideologies. For example, social, political, environmental etc.

Other indicators:

  • a non-profit organisation customer uses funds inconsistent with the declared purpose for which it was established
  • multiple customers send funds to a single beneficiary in higher-risk jurisdictions for terrorism or terrorism financing.  

Proliferation financing indicators

Proliferation financing is when a person makes available an asset, provides a financial service or conducts a financial transaction that’s intended to facilitate the proliferation of weapons of mass destruction, regardless of whether the activity occurs or is attempted. 

A customer:

  • is matched through screening against an Australian or international sanctions list
  • transacts through countries of proliferation financing concern
  • enquires about due diligence processes when transacting with individuals, networks, companies or countries of proliferation concern
  • enquires about how to avoid the financial system to transact with individuals, networks, companies or countries of proliferation concern
  • remits funds to companies linked to countries of proliferation financing
  • uses complex company or trust structures to obscure the source and beneficial ownership of funds
  • uses remittance services or conducts transactions that are physically distanced from the actual trade of goods. For example, an Australian registered company may ship goods from an offshore operational location but use onshore remittance services to receive payment
  • conducts business in dual use goods (goods suitable for both civilian and military purposes) listed on the Defence and Strategic Goods List
  • has trade or shipment activity that does not align with the customer’s profile or stated purpose, based on enhanced customer due diligence information
  • has trade documentation that lists unusual routes or transhipment points
  • has trade documentation that’s without clear end use or end user
  • is connected to industries with higher proliferation financing risks. This includes but is not limited to those identified in Australia’s proliferation financing national risk assessments and the Australian Sanctions Office advisory note on sanctions and proliferation financing.

Corporations:

  • share directors and management, addresses, emails, phone numbers or financial infrastructure with other entities in their networks
  • obscure their identities and activities by:
    • using aliases and using alternate spellings or versions of company names
  • using subsidiaries or branches
    • including third-country nationals in ownership structures
    • registering in jurisdictions with opaque corporate registers where information on ultimate beneficial ownership is not easily accessible.

Suspicious matter reporting

If you suspect on reasonable grounds that a customer or a transaction involving your customer is linked to a crime, submit a suspicious matter report (SMR) to us within the required timeframes. This includes where you suspect on reasonable grounds that a person:

  • is committing a crime
  • isn’t who they claim to be
  • could be the victim of a crime.

On their own, one of these indicators may not suggest suspicious activity. If you’re unsure whether there are reasonable grounds for a suspicion, you should conduct further monitoring and examination. This may include applying enhanced customer due diligence (ECDD) measures. 

For more information on complying with your reporting obligations, see our suspicious matter reporting reference guide and suspicious matter reporting checklist.

The Department of Foreign Affairs and Trade’s Australian Sanctions Office has also published a Guidance Note for remittance service providers to alert them to their obligations to comply with Australian sanctions laws.

This guidance sets out how we interpret the Act, along with associated Rules and regulations. Australian courts are ultimately responsible for interpreting these laws and determining if any provisions of these laws are contravened. 

The examples and scenarios in this guidance are meant to help explain our interpretation of these laws. They’re not exhaustive or meant to cover every possible scenario.

This guidance provides general information and isn't a substitute for legal advice. This guidance avoids legal language wherever possible and it might include generalisations about the application of the law. Some provisions of the law referred to have exceptions or important qualifications. In most cases your particular circumstances must be taken into account when determining how the law applies to you.

Last updated: 5 Feb 2026
Page ID: 1104

Was this page helpful?

Please note that feedback you provide here will be used only for the purpose of improving our website. If you have a specific question about your AML/CTF obligations, please contact us.