What transaction patterns should trigger an AML alert?
Updated 23 May 2026
Quick answer
Key patterns that warrant an AML alert include structuring (splitting transactions to stay below reporting thresholds), unusual cash volumes, rapid layering of funds across accounts, transactions inconsistent with the client's known financial profile, and unexplained payments involving high-risk jurisdictions.
Effective transaction monitoring is about knowing your client well enough to spot when something doesn't fit. A large transfer from an accountant with a small suburban practice and no international clients should raise very different questions than the same transfer from a corporate client with documented export activities.
Structuring
Structuring is the deliberate splitting of a single transaction into multiple smaller ones to avoid the $10,000 threshold that triggers a Threshold Transaction Report (TTR). It is illegal under section 142 of the AML/CTF Act — you cannot knowingly facilitate it, and you must file an SMR if you detect it. Look for:
- Multiple cash deposits or transfers of $9,000–$9,900 by the same client within a short period
- A client who asks you to process multiple smaller payments instead of a single larger one
- Multiple transactions on the same day that together exceed $10,000 but are individually just below the threshold
Inconsistency with client profile
The most reliable red flag is a transaction that does not fit what you know about your client. Alert indicators include:
- A client on a modest salary receiving large unexplained transfers
- Transaction volumes that are inconsistent with the client's declared business size or turnover
- Payments or receipts involving countries not connected to the client's known business activities
- A client who is reluctant to explain the purpose of a transaction
High-risk jurisdiction involvement
Any transaction involving a counterparty in a FATF grey or black-listed jurisdiction warrants enhanced scrutiny, even if the transaction itself appears routine. The risk is not necessarily in the transaction type — it is in the inability to verify the legitimate origin or destination of the funds.
Rapid movement of funds
Money is often 'layered' to obscure its origin — moved quickly through multiple accounts and jurisdictions. Patterns such as funds arriving and being transferred out again within 24–48 hours, with no apparent commercial purpose, are a classic layering indicator.
What to do when an alert fires
An alert is not the same as a suspicion — it is a prompt to investigate. Document your investigation. If, after reviewing the alert, you form a reasonable suspicion that the transaction relates to ML/TF, you must file an SMR. If the alert is resolved as benign, document why.
How ClearAML helps
ClearAML's transaction monitoring module applies configurable rule-based alerts to client activity, flags structuring patterns automatically, and creates an investigation workflow so every alert is reviewed and documented — whether or not it results in an SMR.