Money Laundering Red Flags in 2026: From Static Indicators to Typology-Led Detection

The investigative value of a red flag increasingly depends on what surrounds it. As payment velocity accelerates, manipulated identity techniques mature, and mule networks disperse proceeds across interconnected accounts, isolated indicators can become less informative than the behavioural patterns they collectively form. Regulatory and enforcement evidence points towards a more demanding detection model built around typologies, temporal behaviour, network relationships, and corroborated investigative judgement.

Key Points

• The investigative significance of a red flag depends increasingly on context. Transaction sequence, customer behaviour, counterparties, identity information and network relationships may carry more evidential weight than the triggering transaction viewed alone.
• Payment velocity changes the investigative problem. Where funds can be received and dispersed within minutes, time-to-transfer, sequencing and the behaviour of subsequent recipients become material analytical variables.
• Identity assessment should not end at onboarding. Later transactional, device or network behaviour may justify reopening assumptions formed when the customer relationship was established.
• Static rules remain useful, but alert production is not evidence of effective detection. Control owners need to understand which behaviours are represented, which remain outside coverage and what investigative outcomes reveal about calibration.
• Typology-led detection begins with suspected criminal methodology and asks what observable behaviours, relationships and data traces it should produce. The alert is therefore an investigative starting point, not an evidential conclusion.

Source: Fraud Intelligence Lab (F.I.L.) original analytical framework. It is not a statutory test, regulatory model or law-enforcement investigation standard.

In This Article

• From Indicator-Level to Relationship-Level Detection
• Model 1 — The High-Velocity Laundering Detection Window
• The Compressed Detection Window: Payment Velocity as an Investigative Variable
• Identity Verification Is Not the End of Identity Investigation
• Fraud, Authentication and Laundering: Keep the Evidential Questions Separate
• Case Study 1 — United Kingdom: When Detection Thresholds Obscure Mule Behaviour
• What Happened
• Why It Matters
• Investigative Lesson
• Wider Implications
• Case Study 2 — Sweden: Klarna and the Upstream Failure Problem
• What Happened
• Why It Matters
• Investigative Lesson
• Wider Implications
• Case Study 3 — United States: TD Bank and the Accumulation of Detection Debt
• What Happened
• Why It Matters
• Investigative Lesson
• Wider Implications
• Model 2 — The Fraud Intelligence Lab Typology-Led Investigative Cycle
• The Investigative Hypothesis: Corroboration and Refutation
• Model 3 — The Fraud Intelligence Lab Account-to-Network Investigation Model
• An Investigative Indicator Framework for High-Velocity Financial Crime
• Following Value Across Channels: The Professional Laundering Environment
• Investigative and Control Implications
• Analyse Sequences, Not Merely Transactions
• Treat Thresholds as Control Decisions
• Connect Identity and Transaction Intelligence
• Make Time an Investigative Data Point
• Develop Network-Level Visibility
• Separate Alert Confidence From Investigative Confidence
• Operationalise Typology Refresh
• Strengthen the Fraud–AML Intelligence Loop
• Preserve Investigative Judgement
• Practitioner Guide
• Conclusion
• Methodology and Sources
• REFERENCES AND FURTHER READING

Introduction

A suspicious transaction is not the same thing as suspicious behaviour, and suspicious behaviour is not proof of money laundering. That distinction should sit at the centre of red-flag analysis in 2026.

Traditional monitoring necessarily reduces complexity. Rules, thresholds and models identify measurable conditions: transaction value, frequency, geography, account age, counterparty characteristics, deviation from expected behaviour or combinations of these factors. Those conditions remain useful. The weakness arises when the condition that generated attention becomes the principal object of investigation rather than the starting point for a wider assessment of what the activity may represent. 

Contemporary laundering can distribute investigative significance across time, accounts, identities and payment channels. A receipt may appear unremarkable until followed by rapid dispersal. An apparently satisfactory customer profile may require reassessment when subsequent activity conflicts with its stated purpose. Several accounts may appear unrelated until device, address, beneficiary or counterparty information establishes associations requiring further enquiry. The practical consequence is not the obsolescence of red flags, but a change in the evidential weight assigned to them as additional context becomes available.

That proposition creates two related but distinct professional obligations. For investigators, the task is to distinguish observation from investigative hypothesis and hypothesis from conclusion. A behavioural pattern may justify further enquiry without establishing what caused the behaviour or whether the customer knowingly participated in criminal activity. The investigative question is therefore not simply whether a recognised indicator is present, but what evidential weight that indicator should carry when assessed against chronology, relationships, customer context, alternative explanations and corroborating or contradictory information.

For control owners, the question is different but equally demanding: does the monitoring architecture remain capable of recognising the behaviour described by current threat intelligence, or does it merely continue to execute scenarios developed against earlier assumptions? A control can remain technically operational while becoming progressively less representative of the criminal methodologies it is expected to detect. The relevant measure of effectiveness is therefore not simply whether alerts continue to be generated, but whether the architecture provides meaningful visibility of the behaviour that matters.

This analysis examines those questions against primary regulatory, enforcement and other official evidence from authorities and institutions in the United Kingdom, Sweden, the European Union and the United States, together with relevant material from FinCEN and FATF. Three original Fraud Intelligence Lab models address different dimensions of the problem: how evidential significance develops through time; how threat intelligence is converted into detection capability and investigative outcomes into control learning; and what becomes visible when apparently separate accounts, transactions and relationships are reconstructed as a network.

From Indicator-Level to Relationship-Level Detection

The fundamental analytical shift is from asking whether an event satisfies a predefined condition to asking what behaviour that event forms part of and what evidential significance it acquires in context.

Consider an account that receives an unexpected payment and transfers most of the funds onwards shortly afterwards. The receipt and onward transfer are observations. Neither independently establishes money laundering, mule activity or knowing participation in criminal conduct. At that stage, they provide information requiring interpretation rather than a conclusion about what the activity represents.

The assessment may change as additional context becomes available. Rapid dispersal across multiple beneficiaries, recent account opening, transaction values inconsistent with the expected customer profile, shared digital identifiers connecting apparently unrelated accounts, or subsequent movement towards common beneficiaries may collectively support a different set of investigative hypotheses. Their significance does not arise because any individual indicator has become proof; it arises because the relationships between those observations create a richer evidential context within which competing explanations can be tested.

The investigator must therefore move beyond identifying characteristics towards reconstructing behaviour. What methodology could plausibly explain the sequence? Which relationships are material? Does the chronology support that interpretation? What evidence would corroborate it, what evidence would weaken it, and what credible legitimate explanation remains consistent with the available information? These questions convert a collection of indicators into a structured investigative enquiry without presuming that the suspected methodology has been established.

The indicator attracts attention. The relationship creates the investigative context.

That distinction also separates detection from investigation. A detection mechanism identifies characteristics or combinations of characteristics that warrant examination. Investigation determines their evidential weight by assessing them against customer information, chronology, counterparties, network associations, alternative explanations and corroborating or contradictory evidence. Recognising the relationship is detection. Testing what it means is investigation.

The practitioner question therefore moves beyond whether a transaction breached a rule. It becomes: what behaviour is being exhibited, what relationships help explain it, and which competing hypotheses remain consistent with the available evidence?

Model 1 — The High-Velocity Laundering Detection Window

Model 1 - F.I.L. High-Velocity Laundering Detection Window

Source: Fraud Intelligence Lab (F.I.L.) original analytical framework. It is not a statutory test, regulatory model or law-enforcement investigation standard.

Model 1 illustrates how the evidential significance of transactional activity can develop over time. An incoming payment may initially present little basis for concern when assessed in isolation. Its significance may increase where funds are rapidly dispersed across multiple beneficiaries, connected accounts exhibit comparable patterns of activity, or apparently unrelated customers are linked through shared devices, addresses or counterparties.

The relevant investigative assessment therefore depends not only on the characteristics of the initial transaction, but on the subsequent behaviour and relationships that place it in context.

This is why temporal analysis matters. The transaction itself does not retrospectively change. The evidence available to interpret it does.

The Compressed Detection Window: Payment Velocity as an Investigative Variable

Payment speed changes more than operational processing. It changes both the period within which potentially relevant behaviour can develop and the time available for detection, investigative enrichment and, where appropriate and lawful, intervention. As that interval contracts, time itself becomes an investigative variable: not because rapid movement is inherently suspicious, but because the relationship between receipt, dispersal and subsequent movement may provide information that individual transactions do not. 

Under Regulation (EU) 2024/886, an instant euro credit transfer falling within the relevant framework is designed to make funds available to the payee within ten seconds. The Regulation also introduced verification-of-payee requirements and permits users to set maximum amounts for instant credit transfers. Implementation dates differ between euro-area and non-euro-area Member States, so the framework should not be understood as having reached a single point of universal implementation. 

The investigative significance of this increased payment velocity lies in what can occur within a compressed period. The FCA found that firms identifying mule activity promptly relied on characteristics including unexpected or unexplained deposits, rapid dispersal of funds through networks of accounts — often within minutes of receipt — international movement and rapid ATM withdrawals. The regulator also identified substantial deposits shortly after account opening, activity inconsistent with the expected nature of the customer or business and multiple rapid transactions as potentially useful indicators.

These characteristics shift the analytical focus from the properties of an individual transaction towards the sequence in which activity develops. An incoming payment may carry limited evidential significance when considered alone. Its investigative relevance may change materially where most of the value is dispersed shortly afterwards, multiple beneficiaries receive funds in rapid succession, connected accounts exhibit comparable behaviour, or value is subsequently aggregated, fragmented, withdrawn, transferred internationally or moved through another mechanism. The amount remains relevant, but chronology and relationships provide the context within which that amount should be interpreted.

This distinction matters for control design. A threshold can determine whether a predefined condition has been met; it cannot, by itself, explain the behavioural sequence within which that condition occurred. A threshold captures a condition. A chronology can reveal behaviour. Controls that evaluate transactions primarily as isolated events may therefore identify individual components of a sequence without recognising the methodology potentially represented by the sequence as a whole.

Rule- or scenario-based transaction monitoring and transaction-sequence analysis should consequently not be treated as synonymous. Rule- or scenario-based monitoring may identify whether predefined characteristics or combinations of characteristics are present. Sequence analysis asks a different question: when events are reconstructed through time, do their timing, order and relationships support a particular investigative hypothesis, and what evidence would corroborate or refute that interpretation?

For practitioners, the implication is not that faster movement should automatically produce greater suspicion. It is that time-to-movement, time-to-dispersal and the order of subsequent events should be capable of contributing to evidential assessment and detection design. Where relevant criminal methodologies can develop within minutes, controls calibrated primarily around transaction value or activity assessed outside its temporal sequence may provide an incomplete representation of the behaviour they are intended to detect.

Identity Verification Is Not the End of Identity Investigation

Identity evidence should not become analytically frozen at onboarding. An identity assessment reflects the evidence available at a particular point in the customer relationship; subsequent transactional, authentication or network information may materially change the weight that should be assigned to it.

In November 2024, FinCEN reported an increase in suspicious activity reporting describing the suspected use of deepfake media, particularly fraudulent identity documents used to circumvent identity-verification and authentication processes. Its analysis of Bank Secrecy Act data also identified accounts successfully opened using fraudulent identities suspected of having been produced with generative AI and subsequently used to receive and launder proceeds from other fraud schemes. FinCEN further noted that financial institutions often detected GenAI and synthetic content in identity documents through re-reviews of customer account-opening documentation.

The practitioner implication extends beyond deepfakes. An apparently satisfactory identity check establishes something about the evidence available when that assessment was performed; it does not make the underlying conclusion immune from later challenge. If subsequent account behaviour becomes materially inconsistent with the customer profile, new information may justify reassessing assumptions formed during onboarding.

That reassessment should itself remain evidence-led. Unexplained receipt and rapid turnover of funds, shared digital infrastructure with apparently unrelated accounts, significant deviation from the stated account purpose or other relevant transactional and network information may increase the reason to revisit earlier identity evidence. None of those characteristics independently establishes that the identity is false, that account control has changed or that the customer is knowingly involved in criminal activity. Their significance lies in whether they materially alter the evidential basis on which the earlier assessment was made.

Customer due diligence should inform transaction monitoring, but transaction behaviour should also be capable of reopening questions arising from customer due diligence. This creates an evidential feedback loop: identity information informs the interpretation of transactions, while subsequent transactions, authentication data, devices and network associations can alter the evidential weight assigned to earlier identity information. 

The practical objective is not continual re-verification without cause, but a control environment in which later evidence can trigger proportionate reassessment when the assumptions underlying the original identity assessment no longer adequately explain what is being observed.

Fraud, Authentication and Laundering: Keep the Evidential Questions Separate

Operational convergence should not produce analytical conflation. A single criminal episode may involve a payment authorised following deception, movement of the resulting proceeds through several accounts and subsequent conversion or transfer through another channel. Those activities may form part of the same broader criminal episode, but they raise different investigative questions.

Authentication asks whether the transaction was authorised by the legitimate customer or through the relevant authenticated process. Fraud analysis asks whether deception, manipulation or another fraudulent mechanism caused or facilitated the payment or loss. Money-laundering analysis asks what subsequently happened to criminal proceeds, how value was moved or controlled, and what evidence supports or refutes the suspected laundering methodology.

An answer to one question does not automatically answer the others. A payment may be successfully authenticated yet have been fraudulently induced. An account may receive proceeds of fraud without the available evidence establishing that its holder knowingly participated in their movement. Equally, a shared device, beneficiary or other network association may justify investigative enrichment without establishing the nature of the relationship or the culpability of those connected to it.

This distinction is particularly important in mule investigations. As the FCA's Proceeds of Fraud: Detecting and Preventing Money Mules review demonstrates, receipt and onward movement of suspected fraud proceeds may justify further investigation, especially when accompanied by rapid dispersal, network associations or other relevant behaviour. It does not, without further evidence, establish that the account holder knowingly participated in criminal activity. The investigative task is to determine what the account holder knew, what role the account played, which alternative explanations remain credible and what additional evidence materially changes that assessment.

Case Study 1 — United Kingdom: When Detection Thresholds Obscure Mule Behaviour

What Happened

The FCA's review of 13 firms provides a practical demonstration of the difference between possessing detection capability and deploying it effectively.

The regulator found that most firms investigated alerts concerning first-generation recipients but were less responsive to later-generation alerts despite clear risk factors. Some firms acted only where alerts exceeded internal thresholds such as transaction value. The FCA identified instances where those thresholds could have been calibrated more effectively to detect genuine mule activity and prompt investigation.

The review also found that several firms regarded the money-mule detection tool as more effective when alerts were corroborated with additional information. They did not treat the alert itself as clear evidence of mule activity.

Why It Matters

Thresholds are not neutral technical settings.

They determine which behaviour becomes visible to investigators and which behaviour remains outside operational attention.

A threshold introduced to reduce false positives or manage workload can therefore change the institution's effective view of the threat.

That does not make thresholds inappropriate. Institutions necessarily have finite investigative capacity. But resource prioritisation and threat detection are different objectives, and control owners need to understand the trade-off between them.

A reduction in alert volume is not evidence that a control has become better at detecting criminal behaviour.

Investigative Lesson

The useful challenge is not simply whether a threshold produces a manageable number of alerts.

A control owner should be able to ask what proportion of relevant known behaviour the scenario identifies, which characteristics distinguish corroborated cases from false positives, what appears in cases discovered through other channels but was absent from the alert population, and what changes when the threshold moves.

Those questions convert threshold setting from operational tuning into control calibration.

Wider Implications

The FCA evidence exposes a broader governance problem: alert efficiency and detection effectiveness can be mistaken for the same thing.

A monitoring environment can become highly efficient at processing the behaviour it is configured to see while progressively losing visibility of the behaviour that matters.

Case Study 2 — Sweden: Klarna and the Upstream Failure Problem

What Happened

In December 2024, Sweden's Finansinspektionen issued Klarna Bank AB a remark and an administrative fine of SEK500 million for breaches of anti-money-laundering requirements.

The authority found significant deficiencies in Klarna's general risk assessment, including an absence of adequate assessment of how the bank's products and services could be used for money laundering or terrorist financing. It also identified deficiencies in procedures and guidelines governing customer due diligence for customers using Klarna's invoice product. Finansinspektionen stated that the violations did not warrant a warning or withdrawal of authorisation.

The case is relevant here as evidence about risk assessment and control architecture, not as evidence of criminal wrongdoing by Klarna.

Why It Matters

Detection quality can be constrained before a monitoring scenario is ever written.

If an institution has not adequately identified how a product or service could be exploited, it becomes difficult to specify what observable behaviour should be detected.

Weak threat or risk analysis therefore propagates downstream.

PRODUCT OR SERVICE CHARACTERISTIC

↓

PLAUSIBLE CRIMINAL EXPLOITATION

↓

OBSERVABLE BEHAVIOUR

↓

AVAILABLE OR OBTAINABLE DATA

↓

DETECTION LOGIC

↓

INVESTIGATIVE RESPONSE

If an institution cannot articulate that chain, describing monitoring as “risk based” says relatively little about what the control is actually capable of detecting.

Investigative Lesson

Typology-led detection begins before the alert.

The control-design question is:

If this product or service were being exploited through the suspected methodology, what observable behaviours, relationships and data traces should that methodology be expected to produce?

Only then can control owners determine whether the necessary data exist, whether the detection logic represents the threat and what investigative enrichment will be required when a signal is generated.

Wider Implications

Typology-led detection is therefore not merely an investigator's technique.

It is a control-design discipline.

The quality of downstream detection is constrained by the quality of the threat analysis from which the control was derived.

Case Study 3 — United States: TD Bank and the Accumulation of Detection Debt

What Happened

The TD Bank case demonstrates a different failure mode: monitoring architecture that remained technically operational while failing to evolve sufficiently with the operating environment.

In October 2024, TD Bank N.A. pleaded guilty to Bank Secrecy Act and money-laundering conspiracy violations. The Department of Justice stated that the bank's transaction-monitoring programme remained effectively static from 2014 through 2022 despite known deficiencies, emerging money-laundering risks and new products and services. The bank added no new transaction-monitoring scenarios and made no material changes to existing scenarios from at least 2014 through late 2022.

The plea materials provide an unusually clear measure of the coverage gap. Between 1 January 2018 and 12 April 2024, automated AML monitoring failed to monitor approximately 92% of transaction volume and 74% of transaction value. That corresponded to more than 14.6 billion unmonitored transactions and more than $18.3 trillion in unmonitored transaction value.

The DOJ also described three money-laundering networks that collectively transferred more than $670 million through TD Bank accounts between 2019 and 2023. FinCEN separately imposed a record $1.3 billion penalty and a four-year independent monitorship.

Why It Matters

A monitoring system can remain technically operational while becoming progressively less representative of the threat environment.

Rules execute.

Alerts are generated.

Cases are closed.

None of those facts independently establishes effective threat coverage.

Automation is not synonymous with coverage. Coverage is not synonymous with detection. Detection is not synonymous with investigation.

Investigative Lesson

The useful governance question is not:

Do we have automated transaction monitoring?

It is:

Which transactions and behaviours can the system see, which current typologies are represented, when were those assumptions last materially challenged, and what relevant behaviour remains outside coverage?

That question forces control owners to examine the relationship between data availability, scenario design, typology coverage and investigative outcomes.

Wider Implications

The case illustrates what Fraud Intelligence Lab terms detection debt: the accumulating divergence between criminal behaviours present in an institution's operating environment and the behaviours its controls are configured, supplied with data and calibrated to recognise.

Detection debt can accumulate while systems remain technically functional.

Legacy scenarios continue to execute, alerts continue to be produced and cases continue to be closed, while products, customer behaviour and criminal methodology move beyond the assumptions embedded in the control architecture.

The appropriate question is therefore not simply whether monitoring is functioning.

It is whether the design remains representative of the risks it is expected to detect.

Model 2 — The Fraud Intelligence Lab Typology-Led Investigative Cycle

Model 2. F.I.L. Typology-Led Investigative Cycle

Source: Fraud Intelligence Lab (F.I.L.) original analytical framework. It is not a statutory test, regulatory model or law-enforcement investigation standard.

The model deliberately reverses a data-first approach to detection design. Rather than allowing existing fields, inherited thresholds or legacy scenarios to determine the boundaries of detection, a typology-led approach begins with suspected criminal methodology and asks:

What observable behaviours, relationships and data traces should this methodology be expected to produce?

Those expected traces can then be mapped against available data, translated into detection logic and tested through investigation.

The distinction matters because a behaviour can be understood by investigators yet remain effectively invisible to automated detection where the necessary temporal, relational or network data are unavailable, fragmented or unused.

The cycle also does not end when an alert is generated or a case is closed. Investigative outcomes provide intelligence about the performance of the detection architecture itself. A corroborated case may strengthen confidence that a typology and its associated detection logic are identifying relevant behaviour, while a false positive may expose weaknesses in specificity, contextualisation or calibration. Equally, a relevant case discovered through another channel may reveal behaviour that existing controls failed to recognise, and an emerging pattern may indicate that assumptions embedded in the current typology no longer adequately represent the threat.

These outcomes should feed back into threat assessment, typology development and control recalibration. Detection therefore becomes a continuing intelligence cycle rather than a static collection of rules and thresholds.

The Investigative Hypothesis: Corroboration and Refutation

Typology-led investigation should provide structure to investigative reasoning without allowing recognised typologies to become presumptions about the conduct they are intended to detect. The presence of behaviour consistent with a known methodology may justify further enquiry, but it does not determine the evidential conclusion.

Consider an account that receives an unexpected credit and rapidly disperses the funds across several beneficiaries. The rapid dispersal is an observed behaviour. Mule activity may be a reasonable investigative hypothesis, particularly where the sequence is consistent with known methods of moving criminal proceeds, but the hypothesis remains an explanation to be tested rather than a conclusion to be adopted.

The investigative task is therefore to determine the evidential weight of that explanation. Relevant enquiries may include the customer's relationship with the counterparties, consistency with the stated purpose and expected use of the account, the recurrence and timing of comparable activity, shared digital or identity infrastructure, the subsequent behaviour of recipient accounts and any internal or external intelligence capable of materially changing the assessment. The same enquiry should actively consider credible legitimate explanations and evidence that weakens, rather than merely supports, the suspected methodology.

This distinction between observation, investigative hypothesis and conclusion is fundamental. Confirmation bias becomes a material investigative risk when an initial classification such as “mule activity” or “layering” begins to determine how subsequent evidence is interpreted. A typology should organise enquiry, not predetermine its outcome.

Corroboration and refutation should therefore operate together. Evidence consistent with the hypothesis may increase its evidential weight; contradictory information or a credible alternative explanation may reduce it or require the hypothesis to be revised. Where uncertainty remains material, the disposition rationale should record not simply which indicators were present, but how competing explanations were assessed and why the preferred interpretation carries greater evidential weight on the information available.

The professional distinction is consequential: an alert establishes a reason to investigate, not a finding of wrongdoing.

The alert identifies the question. The investigation determines the evidential weight of the answer.

Model 3 — The Fraud Intelligence Lab Account-to-Network Investigation Model

Model 3. F.I.L. Account-to-Network Investigation Model

Source: Fraud Intelligence Lab (F.I.L.) original analytical framework. It is not a statutory test, regulatory model or law-enforcement investigation standard.

Network analysis can reveal relationships that remain obscured when accounts are investigated individually, but those relationships must be interpreted with evidential discipline. Apparently unrelated accounts may share beneficiaries, devices, addresses, counterparties or comparable transaction sequences, while repeated rapid dispersal across connected accounts may indicate activity requiring network-level investigation. Link analysis in money-laundering investigations can extend that assessment by mapping how accounts, people, companies and other infrastructure connect around the movement of suspected value.

Such associations constitute investigative enrichment, not evidence of collective culpability. A shared address may reflect a family relationship or communal accommodation; device associations may have legitimate explanations; and common counterparties may arise through employment, commerce or other genuine relationships. The existence of a connection should therefore generate an investigative question rather than determine its answer.

The evidential weight of a network association depends on its context, frequency, directionality and temporal relationship to the activity under investigation, together with any corroborating or contradictory evidence. Investigators should consider not only whether accounts are connected, but whether the nature and timing of those connections materially strengthen or weaken the investigative hypothesis.

The practitioner value of network analysis is therefore not that it produces stronger allegations. It makes previously obscured relationships visible and enables better investigative questions to be asked.

An Investigative Indicator Framework for High-Velocity Financial Crime 

Red flags are most useful when they generate testable investigative hypotheses rather than predetermined conclusions. The following framework therefore does not classify individual behaviours as evidence of money laundering. It asks five questions of each indicator: what has been observed, what might explain it, what credible alternative remains, what evidence would test those explanations, and whether the control environment was capable of recognising the behaviour.

OBSERVATION → INVESTIGATIVE HYPOTHESIS → ALTERNATIVE EXPLANATION → EVIDENTIAL TESTING → CONTROL LEARNING

1. Rapid receipt and dispersal

Observed behaviour: Funds are received and substantially dispersed to multiple beneficiaries within a short period, particularly where the activity is inconsistent with the expected use of the account.

Investigative hypothesis: The account may be functioning as an intermediary through which criminal proceeds are being moved or fragmented.

Alternative explanation: Commercial settlement, treasury activity, family transfers or other legitimate pass-through arrangements may produce superficially similar behaviour.

Investigative test: Establish where the funds originated, how quickly they were transferred onwards, the customer's relationship with the beneficiaries, the apparent economic rationale and whether the pattern recurs. Where visibility permits, examine whether recipient accounts retain, aggregate or further disperse the value.

Control question: Can existing monitoring recognise receipt followed by rapid dispersal as a behavioural sequence, or does it assess the component transactions independently?

2. Rapid movement across multiple accounts

Observed behaviour: Value moves through several accounts within a compressed period, potentially involving repeated onward transfers, fragmentation or convergence towards common destinations.

Investigative hypothesis: The accounts may form part of a coordinated movement-of-funds network rather than representing unrelated transactional activity.

Alternative explanation: Payment processing, marketplace activity, treasury operations or legitimate multi-party commercial arrangements can generate comparable flows.

Investigative test: Reconstruct the chronology of the movement and examine whether apparently separate accounts share beneficiaries, counterparties, devices, addresses or other relevant associations. Determine whether comparable sequences recur and whether the direction and timing of those relationships support or weaken the network hypothesis.

Control question: Can the institution reconstruct multi-account movement as a connected sequence, or does detection effectively stop at the boundary of the individual customer or transaction?

3. New or dormant account with rapid turnover

Observed behaviour: A newly opened or previously dormant account receives material funds followed by rapid outward payments of similar or fragmented value.

Investigative hypothesis: The account may have been opened, acquired or reactivated principally to receive and move funds.

Alternative explanation: A legitimate change in employment, business activity, investment, an asset sale or personal circumstances may explain the change in account behaviour.

Investigative test: Compare the activity with onboarding information, expected account purpose, known source of funds and subsequent counterparties. Establish when the change occurred, whether there is a credible economic explanation and whether the behaviour is isolated or recurring.

Control question: Does monitoring combine account age or previous dormancy with subsequent transactional behaviour, or are those characteristics evaluated separately?

4. Shared digital or identity infrastructure

Observed behaviour: Apparently unrelated customers share devices, addresses, contact information, digital identifiers or other infrastructure.

Investigative hypothesis: The accounts may be connected through common control, facilitation or coordinated activity.

Alternative explanation: Family relationships, shared accommodation, workplaces, professional advisers, communal devices or authorised assistance may create legitimate associations between otherwise separate customers.

Investigative test: Establish the nature of the relationship and assess the association in context. Determine whether the shared infrastructure is accompanied by common beneficiaries, counterparties, transaction sequences or other behavioural similarities, and actively test whether a legitimate explanation better accounts for the connection.

Control question: Can relational information be analysed across customers, or does the control architecture examine each identity predominantly in isolation?

5. Identity or document integrity concerns

Observed behaviour: Identity documents, images, liveness information or other onboarding material contain inconsistencies requiring further examination.

Investigative hypothesis: Identity information may have been manipulated, fabricated or used to misrepresent the person controlling the account.

Alternative explanation: Poor image quality, technical artefacts, document deterioration, administrative error or legitimate changes in personal information may account for individual inconsistencies.

Investigative test: Reassess the identity evidence alongside authentication history, device information and subsequent account behaviour. Determine whether later evidence corroborates the original concern, provides a legitimate explanation for it or materially changes the assessment of who may be controlling the account.

Control question: Can subsequent transactional, authentication or device behaviour trigger reassessment of an identity previously accepted at onboarding?

6. Cross-channel movement of value

Observed behaviour: Value moves between bank transfers, cash, international payments, virtual assets or other mechanisms over a relatively compressed period or as part of an identifiable sequence.

Investigative hypothesis: Different channels may be being used to fragment, convert or distance value from its origin.

Alternative explanation: International commerce, investment activity, remittances, asset purchases and ordinary financial management may legitimately involve movement across several channels.

Investigative test: Follow the movement of value rather than treating each product or channel as a separate analytical endpoint. Examine the economic rationale, counterparties, timing and destination, and determine whether identifiable beneficiaries, controllers or other relationships persist as the mechanism changes.

Control question: Can investigators reconstruct movement across products and channels, or does the institution's architecture fragment the activity across separate monitoring environments?

7. Activity below internal detection thresholds

Observed behaviour: Transactions repeatedly remain below an internal detection threshold while displaying sequencing or other characteristics associated with a recognised typology.

Investigative hypothesis: The activity may reflect fragmentation or another methodology that is poorly represented by the existing threshold.

Alternative explanation: Repeated low-value transactions are common across many legitimate personal and commercial activities; proximity to a threshold does not itself establish deliberate avoidance.

Investigative test: Examine cumulative value, frequency, chronology, counterparties and linked-account behaviour rather than the individual transaction amount alone. Where possible, compare the pattern with corroborated cases, false positives and relevant cases identified through other detection channels.

Control question: Is the threshold reducing irrelevant alert volume while preserving visibility of the target behaviour, or is it unintentionally suppressing activity the scenario was intended to detect?

8. Subsequent behaviour conflicts with the customer profile

Observed behaviour: An account that passed onboarding and customer due diligence subsequently behaves materially differently from its stated purpose, expected activity or established behavioural baseline.

Investigative hypothesis: The original customer-risk or identity assessment may no longer adequately explain who controls the account, how it is being used, or the source and purpose of the activity.

Alternative explanation: Employment, business operations, income, investment activity or personal circumstances may have changed legitimately since the original assessment.

Investigative test: Establish what changed, when it changed and whether the new behaviour has a credible explanation. Where warranted, reassess relevant identity, source-of-funds, counterparty and device information rather than assuming that the original customer assessment remains determinative.

Control question: Can subsequent behaviour feed back into customer and identity assessment, or do onboarding and transaction monitoring operate as functionally separate control processes?

The Practitioner Principle

No observation in this framework independently establishes money laundering or knowing participation in criminal activity. The framework is intended to impose discipline on the progression from signal to conclusion:

OBSERVATION → INVESTIGATIVE HYPOTHESIS → ALTERNATIVE EXPLANATION → EVIDENTIAL TESTING → CONTROL LEARNING

An indicator identifies behaviour requiring explanation. A typology provides a structured hypothesis about what that behaviour may represent. Investigation determines the evidential weight of that hypothesis by seeking both corroborating and contradictory information and by testing credible alternative explanations.

The final stage asks a different question: was the institution's control environment capable of recognising the relevant behaviour in the first place? That distinction matters because an investigation can reach a defensible disposition while simultaneously revealing a weakness in detection coverage, data availability, scenario design or calibration.

The purpose of red-flag analysis is therefore not simply to recognise suspicious characteristics. It is to convert observations into testable investigative hypotheses and investigative outcomes into better-informed controls.

Following Value Across Channels: The Professional Laundering Environment

The contemporary laundering environment should not be understood as a simple migration from traditional finance to digital assets. A more useful analytical interpretation is hybridisation: criminal value may move between regulated financial institutions, payment services, cash, virtual assets and informal value-transfer mechanisms as different stages of a wider laundering process.

In September 2026, FinCEN reported that 33,904 Bank Secrecy Act reports filed between 8 September 2023 and 31 December 2025 described approximately $12.7 billion in financial activity associated with suspected digital-asset investment scams. FinCEN's analysis described the use of fake personas and social engineering within industrial-scale overseas scam operations and situated digital assets within a wider criminal infrastructure for generating and moving proceeds.

Separately, FATF reported in September 2026 that more than 80% of reporting jurisdictions identified underground banking, hawala and other similar service providers among the principal channels or techniques used for professional money laundering. FATF identified cases involving more than €500 million moved through such arrangements within a matter of months, while also recognising that these systems can serve legitimate purposes.

The two sources concern different threat environments and should not be collapsed into a single typology. Their combined significance lies elsewhere: they demonstrate why laundering analysis organised exclusively around individual products or payment rails can provide an incomplete view of the movement of criminal value.

For investigators, continuity may persist even when the mechanism changes. Value may move from a bank account into cash, through an international transfer, into virtual assets or through an informal value-transfer arrangement, while relationships involving beneficiaries, controllers, devices, counterparties, timing or settlement arrangements remain analytically significant. The transition between channels may therefore be as important as the activity occurring within any one of them.

The investigative object is not necessarily the payment rail. It is the movement of value across rails.

This has direct implications for investigative reconstruction. Rather than treating each channel as a separate analytical endpoint, investigators should consider whether apparently fragmented activity forms part of a wider sequence and which relationships remain visible as value changes form or mechanism. Model 1 provides the temporal perspective required to reconstruct that progression, while Model 3 demonstrates how relational analysis can expose connections that remain relevant across accounts, counterparties and channels.

Investigative and Control Implications

Analyse Sequences, Not Merely Transactions

Where the suspected methodology is temporal, detection should preserve chronology.

Investigators should be capable of reconstructing receipt, dwell time, dispersal, aggregation, conversion and exit where relevant. Control owners should determine whether their systems expose those relationships quickly enough to support meaningful investigation and, where lawful and appropriate, intervention.

Treat Thresholds as Control Decisions

A threshold is an embedded judgement about which activity deserves attention.

Threshold validation should therefore examine more than alert volume. Test corroborated cases, false positives, cases discovered outside monitoring, activity immediately below the threshold and whether emerging typologies alter the rationale for the setting.

Connect Identity and Transaction Intelligence

Onboarding and transaction monitoring should not operate as independent evidential worlds.

Material later behaviour should be capable of triggering reconsideration of customer-profile and identity assumptions. Equally, identity, device and customer information should enrich interpretation of transactional behaviour.

Make Time an Investigative Data Point

Time-to-transfer, account age at first significant receipt, recurrence intervals and sequencing across connected accounts can carry investigative significance.

Institutions should determine whether those characteristics are available to detection and case-investigation functions rather than existing only as raw transaction timestamps.

Develop Network-Level Visibility

Account-by-account investigation can obscure distributed behaviour.

Network capability should support proportionate analysis of shared devices, addresses, beneficiaries, counterparties and fund flows while preserving the distinction between association and evidence of knowing participation.

Separate Alert Confidence From Investigative Confidence

A detection model can be highly confident that predefined characteristics are present without establishing what those characteristics mean.

Model confidence concerns whether a specified signal has been detected.

Investigative confidence concerns the evidential interpretation of that signal after context, credible alternatives and corroborating or contradictory information have been assessed.

Conflating the two risks turning technical certainty into evidential certainty.

Operationalise Typology Refresh

A typology should have an operational lifecycle.

For each material emerging methodology, ask what observable behaviours, relationships or data traces it should produce; whether those data are available; which controls represent the behaviour; what subsequent investigations established; and which relevant behaviours existing controls failed to identify.

Model 2 converts those questions into a repeatable intelligence-to-detection cycle.

Strengthen the Fraud–AML Intelligence Loop

Fraud teams may observe the mechanism through which criminal proceeds are generated. AML teams may observe what happens after those proceeds enter or move through accounts.

Separating those intelligence sets too rigidly can fragment the criminal episode.

The objective is not organisational convergence for its own sake. It is the lawful and proportionate movement of relevant intelligence to wherever it improves detection, investigation or control calibration.

Preserve Investigative Judgement

No model removes the need to determine what evidence means.

A practitioner should still be able to answer:

What is the suspected methodology?

What evidence supports the hypothesis?

What evidence contradicts it?

What credible legitimate explanation remains?

What further enquiry could materially change the assessment?

What disposition is proportionate to the available evidence and applicable legal framework?

A control that cannot support those questions may generate signals without generating much intelligence.

Practitioner Guide

A red flag should begin an analytical enquiry rather than determine its outcome. When an indicator is triggered, investigators should establish precisely what behaviour has been detected, why the control considered it significant and what contextual information could materially change that assessment. An apparently ordinary transaction may acquire investigative significance when examined alongside subsequent behaviour, chronology, counterparties or network relationships. Equally, activity that initially appears suspicious may become less significant once a credible explanation and supporting information are established. Context therefore changes evidential weight.

Transaction velocity should be treated as an investigative variable rather than merely an operational metric. Investigators should examine how quickly value is received, divided, transferred, withdrawn or converted, as well as the sequence in which those events occur. A series of individually unremarkable payments may become significant when funds move through several accounts or channels within a compressed period. Time-to-dispersal can therefore reveal behaviour that static value thresholds may fail to identify, particularly where activity is deliberately structured below conventional detection limits.

Identity and transaction intelligence should also interact throughout the customer relationship. Successful identity verification at onboarding establishes information relevant at a particular point in time; it should not prevent investigators from revisiting earlier assumptions when subsequent behaviour creates new questions. Changes in devices, counterparties, transaction patterns, account purpose, geographic activity or relationships may justify reassessing customer-profile information and previous risk assumptions. The investigative question is not simply whether identity verification succeeded, but whether the identity, stated purpose and subsequent behaviour remain coherent when examined together.

Detection performance should be assessed by the quality of the activity identified rather than alert volume alone. A reduction in alerts may reflect better calibration and fewer false positives, but it may also indicate that relevant behaviour has moved outside existing thresholds or typologies. Investigators and control owners should therefore examine what controls detect, what they repeatedly misclassify and what confirmed cases reveal about activity that was not detected early enough. False positives and missed detections should both become sources of control intelligence.

Typology-led detection requires a structured feedback relationship between intelligence, investigation and control design. Emerging threat intelligence should inform hypotheses about how laundering behaviour may appear across accounts, identities, transactions and channels. Investigative outcomes should then test those assumptions: confirmed cases may reveal new indicators or relationships, while refuted hypotheses and false positives may expose weak assumptions or poorly calibrated controls. Typologies should therefore evolve from accumulated evidence rather than become static lists of suspicious characteristics.

Finally, investigators should move from indicator-level detection towards relationship-level assessment where the available information permits it. Individual red flags can identify activity requiring attention, but chronology, shared identifiers, recurring counterparties and movement of value across accounts may reveal a wider structure that transaction-by-transaction review cannot show. These relationships should still be treated as investigative hypotheses requiring corroboration or refutation rather than proof of money laundering. The objective of typology-led detection is not to make red flags more conclusive; it is to make detection more capable of identifying behaviour worth investigating and investigation more capable of explaining what that behaviour actually means.

Conclusion

The evolution of money-laundering red flags in 2026 is fundamentally an evolution in contextual interpretation: how investigators assign evidential weight to transactions, identities and relationships that may appear unremarkable in isolation.

Familiar indicators remain relevant. Unexpected deposits, rapid turnover, behaviour inconsistent with the customer profile, international movement, unusual counterparties and identity anomalies continue to provide legitimate reasons for investigative attention. What has changed is the speed, distribution and interconnectedness with which those characteristics can emerge — and consequently the extent to which their significance depends on chronology, relationships and subsequent behaviour.

The regulatory and enforcement evidence examined in this article exposes different weaknesses in the detection architecture. The FCA's findings demonstrate how thresholds and inconsistent investigative responses can reduce visibility of mule behaviour. The Klarna case illustrates how deficiencies in upstream risk analysis can constrain downstream control design. TD Bank demonstrates how what Fraud Intelligence Lab terms detection debt can accumulate while monitoring systems remain technically operational. FinCEN and FATF evidence, meanwhile, illustrates a threat environment in which criminal value may move through different actors, financial mechanisms and channels. These are different control and threat problems, but they converge on the same practitioner question: does the institution's detection architecture represent the behaviour it is expected to identify?

Static rules and indicators therefore retain an important role, but they should operate within an architecture capable of learning from threat intelligence and investigative outcomes. Model 1 demonstrates how evidential significance can develop through time; Model 2 shows how typologies can be converted into observable behaviours, detection logic and continuing control recalibration; and Model 3 demonstrates what may become visible when apparently separate accounts, counterparties and transactions are examined relationally. The Investigative Indicator Framework provides the discipline connecting those capabilities by requiring practitioners to distinguish observation, investigative hypothesis, alternative explanation, evidential testing and control learning.

The resulting practitioner standard is more demanding than red-flag recognition. It requires controls capable of identifying relevant behaviour and investigators capable of determining what that behaviour means without converting indicators, model outputs or network associations into presumptions of wrongdoing.

In high-velocity financial crime, the red flag is increasingly not the transaction. It is the relationship between transactions, identities, counterparties and time.

The alert identifies the question. The investigation determines the evidential weight of the answer.

Methodology and Sources

This analysis draws primarily on regulatory, enforcement and other official material from authorities and institutions in the United Kingdom, Sweden, the European Union and the United States, together with relevant publications from FinCEN and FATF.

Evidence concerning fraud, mule activity, identity manipulation and money laundering has been kept analytically distinct. In particular, FinCEN's 2024 deepfake alert and its 2026 digital-asset scam analysis are treated as separate evidence bases. They are not presented as establishing a causal relationship between manipulated onboarding identities and accounts or activity identified in the later dataset.

The three Fraud Intelligence Lab models are original analytical constructs developed to translate source evidence into practitioner reasoning. Model 1 addresses temporal interpretation; Model 2 examines the conversion of threat intelligence into detection capability and the feedback of investigative outcomes into control recalibration; and Model 3 addresses relational and network-level investigation. They are not presented as regulatory, law-enforcement or industry-standard models.

The Investigative Indicator Framework is likewise an original Fraud Intelligence Lab analytical construct. It is intended to discipline the progression from observation through investigative hypothesis, alternative explanation and evidential testing to control learning, rather than prescribe conclusions from individual indicators.

Detection debt is used as a Fraud Intelligence Lab analytical concept to describe the accumulating divergence between relevant criminal behaviours and the behaviours an institution's controls are configured, supplied with data and calibrated to recognise. The term is not attributed to the US Department of Justice, FinCEN or any other authority cited in this analysis.

Cross-jurisdictional comparison is used to identify transferable investigative and control questions. It does not imply equivalence between UK, Swedish, EU and US legal, evidential, supervisory or reporting frameworks.

Throughout the analysis, an indicator, alert, anomaly, behavioural pattern, model output or network association is treated as a basis for further assessment rather than proof of money laundering, fraud or knowing participation in criminal activity.

REFERENCES AND FURTHER READING

1. Financial Conduct Authority. Firms’ Use of the National Fraud Database and Money Mule Account Detection Tools. Published 23 January 2025; updated 3 December 2025. 

2. Financial Conduct Authority. Proceeds of Fraud: Detecting and Preventing Money Mules. 

3. Finansinspektionen. Klarna Receives a Remark and an Administrative Fine. 11 December 2024. 

4. European Parliament and Council. Regulation (EU) 2024/886 as regards instant credit transfers in euro. 

5. U.S. Department of Justice. United States of America v. TD Bank, N.A. 10 October 2024.

6. U.S. Department of Justice / TD Bank plea materials. Statement of Facts. 

7. Financial Crimes Enforcement Network. FinCEN Assesses Record $1.3 Billion Penalty against TD Bank. 10 October 2024. 

8. Financial Crimes Enforcement Network. FinCEN Issues Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions. 13 November 2024. 

9. Financial Crimes Enforcement Network. FinCEN Identifies Nearly $13 Billion Linked to Suspected Digital Asset Scams Operated by Overseas Scam Centers. 3 September 2026. 

10. Financial Action Task Force. Investigating Professional Money Laundering, Underground Banking, and the Use of Hawala and Other Similar Service Providers. 3 September 2026.