Language selection

Search

Money laundering and terrorist financing indicators—Money services businesses

Overview

ML/TF indicators are potential red flags that could initiate suspicion or indicate that something may be unusual in the absence of a reasonable explanation. Red flags typically stem from one or more factual characteristics, behaviours, patterns or other contextual factors that identify irregularities related to financial transactions or attempted transactions. These often present inconsistencies with what is expected of your client based on what you know about them.

The ML/TF indicators in this guidance were developed by FINTRAC through a three-year review of ML/TF cases, a review of high quality STRs, published literature by international organizations such as the Financial Action Task Force (FATF) and the Egmont Group, and consultation with reporting entity sectors. These ML/TF indicators do not cover every possible situation but were developed to provide you with a general understanding of what is or could be unusual or suspicious. On its own, a single ML/TF indicator may not appear suspicious. However, observing an ML/TF indicator could lead you to conduct an assessment of the transaction(s) to determine whether there are further facts, contextual elements or additional ML/TF indicators that assist in establishing reasonable grounds to suspect the commission or attempted commission of an ML/TF offence, which requires the submission of an STR.

Criminal organizations often combine various methods in different ways in order to avoid the detection of ML/TF. If you detect unusual or suspicious behaviour or a transaction that prompts the need for an assessment, ML/TF indicators combined with facts and context can help you determine if there are reasonable grounds to suspect that the transaction is related to the commission or attempted commission of an ML/TF offence. These ML/TF indicators may also be used to explain or articulate the rationale for your reasonable grounds to suspect in the narrative portion of an STR, as they provide valuable information from a financial intelligence perspective.

In addition to the ML/TF indicators in this guidance, you are expected to use the National Risk Assessment and risk assessment guidance to inform your risk-based approach (see Related guidance). You are also expected to use FINTRAC’s strategic intelligence which includes additional indicators, and guidance to identify trends and typologies associated with specific threats and vulnerabilities.

Who is this guidance for

In this guidance

Related guidance

Important considerations

One piece of the puzzle

The ML/TF indicators in this guidance are not an exhaustive list of ML/TF indicators to support all suspicious scenarios. These ML/TF indicators should be considered as examples to guide the development of your own process to determine when you have reasonable grounds to suspect that the transaction or attempted transaction is related to the commission or attempted commission of an ML/TF offence. These ML/TF indicators are one piece of the puzzle and are designed to complement your own STR process and can be used in conjunction with other publicly available ML/TF indicators.

During an assessment, FINTRAC will review your compliance policies and procedures to see how you use ML/TF indicators within your STR process. Part of the assessment will include evaluating how the actual policies follow your documented approach and determining its effectiveness with respect to the use of ML/TF indicators. This can include a review of transactions to determine how your STR process identifies potential STRs and assesses them using facts, context and ML/TF indicators. For example, you may be asked to provide an explanation if you have not reported an STR for a client you have assessed as high risk and that client's activity also matches against multiple ML/TF indicators.

Combination of facts, context and ML/TF indicators

If the context surrounding a transaction is suspicious, it could lead you to assess a client's financial transactions. Facts, context and ML/TF indicators need to be assessed to determine whether there are reasonable grounds to suspect that the transaction is related to the commission or attempted commission of an ML/TF offence. On its own, a single financial transaction or ML/TF indicator may not appear suspicious. However, this does not mean you should stop your assessment. Additional facts or context about the client or their actions may help you reach the reasonable grounds to suspect threshold.

Alert or triggering system

FINTRAC acknowledges that a reporting entity may have developed a system that relies on specific alerts or triggering events to signal when to assess a transaction to determine if an STR should be submitted to FINTRAC. If you rely on such a system, FINTRAC expects that you review the alerts in a timely manner in order to determine if an STR should be submitted. Regardless of how you choose to operationalize these ML/TF indicators, FINTRAC expects that you will be able to demonstrate that you have an effective process to identify, assess and submit STRs to FINTRAC.

General ML/TF indicators

The ML/TF indicators in the following section are applicable to both suspected ML and/or TF. The ability to detect, prevent and deter ML and/or TF begins with properly identifying the person or entity in order to review and report suspicious financial activity.

As an MSB, you may observe these ML/TF indicators over the course of your business activities with a client. It is important to note that depending on your business activities, some of these ML/TF indicators may not apply.

ML/TF indicators related to identifying the person or entity

The following are examples of ML/TF indicators that you may observe when identifying persons or entities.

ML/TF indicators related to client behaviour

The contextual information acquired through the know your client (KYC) requirements or the behaviour of a client, particularly surrounding a transaction or a pattern of transactions, may lead you to conduct an assessment in order to determine if you are required to submit an STR to FINTRAC. The following are some examples of ML/TF indicators that are linked to contextual behaviour and may be used in conjunction with your assessment and your risk-based approach.

ML/TF indicators surrounding the financial transactions in relation to the person/entity profile

Clearly understanding the expected activity of a person or entity will allow you to assess their financial activity with the proper lens. For example, an entity involved in an industry that is not normally cash intensive conducting excessive cash transactions or a person conducting financial transactions atypical of their financial profile. The following are some examples of ML/TF indicators surrounding the financial transactions related to the person/entity profile.

ML/TF indicators related to products and services

Your process to evaluate risk for products and services you provide should be documented as part of your KYC and risk assessment requirements. The following ML/TF indicators will focus on products or services that may be applicable within your business.

ML/TF indicators based on atypical transactional activity

There are certain transactions that are outside the normal conduct of your everyday business. These transactions may be indicative of a suspicious transaction, and would require additional assessment. Some examples of ML/TF indicators based on atypical transactional activity are listed below.

ML/TF indicators related to transactions structured below the reporting or identification requirements

Structuring of transactions to avoid reporting or identification requirements is a common method for committing or attempting to commit an ML/TF offence. There are multiple thresholds which trigger reporting/identification requirements by a reporting entity. Some examples of ML/TF indicators which may be indicative of a person or entity attempting to evade identification and/or reporting thresholds are listed below.

ML/TF indicators involving wire transfers (including electronic funds transfers)

In our current global environment, it is increasingly easier to transfer funds to, from or through multiple jurisdictions (municipal, national or international) in a rapid fashion. This presents an increased ML/TF risk as transactions through multiple jurisdictions increases the difficulty for reporting entities and law enforcement to trace illicit funds. Examples of these types of transactions which may require further assessment include the following.

ML/TF indicators related to transactions that involve non-Canadian jurisdictions

There are certain types of transactions that may be sent or received from jurisdictions outside of Canada where there is higher ML/TF risk due to more permissible laws or the local ML/TF threat environment. The following are examples to consider when making an assessment of the financial transaction conducted by a person/entity through your business.

Due to the ever-evolving nature of the ML/TF environment, high risk jurisdictions and trends are often subject to change. To ensure that you are referencing accurate information, FINTRAC encourages you to research publicly available sources on a regular basis to support these ML/TF indicators as part of your STR process. There are multiple sources that identify jurisdictions of concern, including the FATF, which publishes contextual information on high-risk jurisdictions in relation to their risk of ML and TF. You may also observe funds coming from or going to jurisdictions that are reported in the media as locations where terrorists operate/carry out attacks and/or where terrorists have a large support base (state sponsors or private citizens). Identifying high-risk jurisdictions or known trends can also be included as part of your risk-based approach and internal STR process.

ML/TF indicators related to the use of other parties

In the course of a "normal" financial transaction, there are a "normal" number of parties who engage in the transaction, depending on the nature of the transaction at hand. Transactions that involve parties not typically associated with a transaction can present an elevated risk of ML and/or TF. These additional parties can be used to allow a criminal to avoid being identified or being linked to an asset. This section includes examples of how the involvement of other parties may be indicative of the structure of a criminal enterprise. Some examples of such other parties include the use of a third party, nominee or gatekeeper.

Use of third party

A third party is any person or entity that instructs someone to act on their behalf for a financial activity or transaction. There are some situations where there is an apparent and discernable rationale for the inclusion of the third party in a transaction and this may not be suspicious. However, you may become suspicious in a situation where the reason for a person or entity acting on behalf of another person or entity does not make sense based on what you know about the client or the third party. Use of third parties is one method that money launderers and terrorist activity financiers use to distance themselves from the proceeds of crime or source of criminally obtained funds. By relying on other parties to conduct transactions they can distance themselves from the transactions that can be directly linked to the suspected ML/TF offence. Some examples of ML/TF indicators related to the use of a third party can be found below.

Use of nominee

A nominee is a particular type of other party that is authorized to conduct transactions on behalf of a person or entity. There are legitimate reasons for relying on a nominee to conduct financial activity on behalf of someone else. However, this type of activity is particularly vulnerable to ML/TF as it is a common method used by criminals to distance themselves from the transactions that could be linked to suspected ML/TF offences. The following is an example of ML/TF indicators relating to the misuse of nominees.

Use of gatekeeper

A gatekeeper is a person who controls access to the financial system and can act on behalf of a client. Such services can be abused so that criminals have access to the financial system without being identified. Gatekeepers may include lawyers, accountants and other professions which can access the financial system on behalf of a client. While there are many transactions where it is "normal" to have a gatekeeper represent the interests of a client, such an appearance of normalcy can also be utilized to the advantage of criminals to provide the veneer of legitimacy to their transactions. The use of gatekeepers themselves is not an indicator of an ML/TF offence. However, entities should consider the following examples which can indicate misuse of the financial system access provided to gatekeepers.

ML indicators related to bribery and corruption

Bribery and corruption represent significant risks to the integrity of financial systems and the global economy. When assessing whether a client presents a risk of laundering the proceeds of corruption, reporting entities should:

High-risk jurisdictions for corruption

A client operates in, or is related to companies operating in, jurisdictions identified as high-risk for corruption. These jurisdictions may include those that:

High-risk industries for bribery

A client operates in a high-risk industry for bribery, particularly those requiring government authorizations or licenses. Examples of industries with elevated bribery risks include:

Politically exposed domestic or foreign persons

A client is a politically exposed foreign person operating in a high-risk jurisdiction where they are responsible for granting authorizations, licenses, or contracts to businesses.

A client is a family member or known associate of a politically exposed foreign person.

A client engages in high-value transactions with politically exposed domestic or foreign persons, including their family members or known associates. These transactions may signal attempts to influence decision-making, conceal illicit proceeds, or provide undue benefits.

Indicators of transactions related to foreign corruption

Foreign corruption often involves the misuse of public office or authority for personal gain, frequently facilitated through financial transactions designed to obscure the origin, movement, or ownership of illicit funds. These transactions may involve politically exposed domestic or foreign persons, or entities operating in high-risk environments and/or industries. Identifying such transactions is critical for detecting and mitigating the risks of laundering proceeds derived from corrupt activities.

The following indicators can assist reporting entities in recognizing suspicious transactions that may be linked to foreign corruption:

Opaque long-term government contracts

Transactions involving long-term government contracts that may have been awarded through an opaque selection process to a legal entity or multiple legal entities with similar beneficial owners.

Services provided to state-owned entities in high-risk jurisdictions for corruption

Transactions involving services provided to state-owned companies or public institutions by companies registered in high-risk jurisdictions for corruption.

Government business conducted through personal accounts

Transactions involving government business being conducted through personal accounts, which may indicate an attempt to divert or misuse public funds.

Involvement of unrelated entities, intermediaries, or consultants

Transactions involving entities, intermediaries, or consultants that:

High-value payments in high-risk jurisdictions

A client makes high-value payments for services, such as consulting fees, in jurisdictions identified as high-risk for corruption.

Commission payments to offshore bank accounts

A client makes commission payments into offshore bank accounts, particularly when the accounts are located in jurisdictions with weak anti-money laundering and anti-terrorist activity financing controls or secrecy laws.

Transactions with opaque or newly established entities

A client transacts with newly established, opaque, or unidentified entities. This includes entities registered at the address of an offshore company service provider, especially when there is no apparent business relationship between the client and the entity.

Funds routed through intermediaries in unrelated countries

Funds move through intermediaries in third countries or through countries with which the client does not appear to have any legitimate business or personal ties.

Use of fictitious email addresses and false invoices

Transactions involve fictitious email addresses or false invoices used to justify payments, particularly in the context of international transactions.

Use of third parties or legal entities to obscure ownership

A client uses intermediaries, professional facilitators, or complex legal entity structures to hide the origin or ownership of funds. For example, the client may use such structures to obscure the purchase or sale of real estate.

Transactions with vague or fraudulent documentation

 A client conducts transactions that involve:

Indicators related to domestic and foreign politically exposed persons

Domestic and foreign politically exposed persons are individuals who, due to their prominent positions or influence, may present a higher risk of involvement in corruption, bribery, or other illicit financial activities. These risks are heightened when such individuals use their authority or connections to access financial systems for personal gain, often involving complex schemes to conceal the origin, movement, or ownership of illicit funds.

The following indicators can assist reporting entities in identifying suspicious behaviours or transactions involving domestic and foreign politically exposed persons that warrant further scrutiny or reporting:

Unexplained growth in net worth

A client who is a politically exposed domestic or foreign person exhibits a significant increase in net worth that cannot be reasonably explained by their reported income, assets, or legitimate sources of wealth.

Connections to politically exposed foreign persons

A client employs or has business connections with a politically exposed foreign person, or their family members or close associates.

Payments for travel and lodging of politically exposed domestic or foreign persons

Payments are made for the travel and lodging of politically exposed domestic or foreign persons, or their family members, which may indicate attempts to curry favor or provide undue benefits.

High-value asset transactions

Transactions involving politically exposed domestic or foreign persons related to the acquisition of high-value assets, such as real estate, luxury vehicles, or other luxury goods, that are:

Ownership of entities with little or no commercial purpose

A client who is a politically exposed domestic or foreign person owns or controls a legal entity, particularly one located offshore, which appears to serve little or no legitimate commercial purpose.

Assets held in the names of intermediate legal entities

Assets are held in the name of legal entities whose beneficial owners are tied to a politically exposed domestic or foreign person, their family members, or close associates.

Use of multiple bank accounts without commercial justification

A client who is a politically exposed domestic or foreign person maintains multiple bank accounts, particularly when there is no apparent commercial or legitimate reason for doing so.

Suspicious transaction patterns inconsistent with the client’s profile

Transactions involving politically exposed domestic or foreign persons that deviate significantly from the individual’s expected financial profile. Examples may include:

Indicators related to TF

In Canada, TF offences make it a crime to knowingly collect or provide property, which can include financial or other related services, for terrorist purposes. This section is focused on examples that are specific to the possible commission of a TF offence. However, please note that the other ML/TF indicators in this guidance may also prove relevant in determining when you have reasonable grounds to suspect the commission of TF as the methods used by criminals to evade detection of ML are similar.

Indicators specifically related to TF:

The indicators below are some examples of indicators relating to TF.

ML/TF indicators specific to MSBs

In addition to the general ML/TF indicators that have been highlighted in this guidance, there may be more specific ML/TF indicators related to your MSB, including foreign exchange dealers, money remitters, issuers of traveller's cheques, and agents of the Crown that sell or redeem money orders. Below are some examples of sector-specific ML/TF indicators that you should consider as part of your STR process.

For assistance

If you have questions about your suspicious transactions reporting obligations, please contact FINTRAC by email at guidelines-lignesdirectrices@fintrac-canafe.gc.ca.

Date Modified: