Red Flags Library

Purpose#

This library gives Tom Custos practical indicators that should increase risk, trigger EDD or support MLRO escalation. Red flags are not proof of wrongdoing. They are prompts for deeper review.

Severity scale#

Customer identity red flags#

• Customer avoids providing basic identity information.
• Documents are expired, inconsistent or unverifiable.
• Customer uses multiple names, transliterations or unexplained aliases.
• Registered address is a mass registration address without plausible business explanation.
• Customer refuses to explain purpose of relationship.

Beneficial ownership red flags#

• Ownership chain is unusually complex for a simple business.
• Nominee shareholders/directors are used without clear commercial reason.
• Control appears to sit outside formal ownership documents.
• UBO changes shortly before onboarding or transaction.
• Trust, foundation or holding structure lacks clear settlor/protector/beneficiary information.

PEP red flags#

• Customer or UBO is a foreign PEP with unexplained wealth.
• Customer is a close associate or family member of a high-risk PEP.
• Wealth source is inconsistent with public income or declared business activity.
• PEP status is hidden until adverse media or screening reveals it.
• Customer seeks urgent onboarding or transaction before EDD completion.

Sanctions / TFS / CPF red flags#

• Name, identifiers or ownership link match a sanctions target.
• Customer is owned or controlled by a sanctioned person or entity.
• Goods, route, vessel, bank or intermediary connects to restricted geographies or sectors.
• Transaction appears structured to avoid sanctions screening.
• Counterparty uses shell companies, transshipment or unclear end user in a PF-sensitive trade.

Adverse media red flags#

• Credible reports of fraud, corruption, organised crime, sanctions evasion or financial crime.
• Regulatory enforcement or criminal proceedings involving customer/UBO/director.
• Repeated allegations across credible and independent sources.
• Media is recent and directly connected to the proposed relationship.
• Customer explanation contradicts public record.

Transaction red flags#

• Activity is inconsistent with customer profile or declared purpose.
• High-value transaction with no clear economic rationale.
• Circular movement of funds with no obvious commercial purpose.
• Payments from or to unrelated third parties.
• Rapid pass-through of funds.
• Frequent changes to payment instructions.
• Split payments that appear linked.

Crypto/VASP red flags#

• Exposure to sanctioned wallet, darknet market, mixer, scam, ransomware or high-risk exchange cluster.
• VASP is unlicensed or claims licensing in a market that does not regulate the activity.
• Customer cannot explain source of crypto funds.
• Wallet movement appears designed to obscure trail.
• Funds originate from multiple newly created wallets and converge before fiat off-ramp.

TBML red flags#

• Price inconsistent with market value without commercial explanation.
• Goods description is vague or inconsistent across invoice, contract and shipping documents.
• Trade route is unnecessarily complex.
• Counterparty has no apparent experience in the traded goods.
• Payment route does not match goods route.
• Multiple intermediaries are added without economic rationale.
• Goods are dual-use, restricted, high-value, portable or easy to misdescribe.

Agent warning#

A single red flag may be explainable. Several red flags across different categories should increase risk and may justify EDD or MLRO escalation.

Digital infrastructure and DNS red flags#

• Public DNS records contradict the customer's declared operating geography.
• MX records point to a provider in a higher-risk or restricted geography without explanation.
• SPF/TXT records include unexplained email relays, SaaS vendors or legacy providers.
• NS, SOA or CNAME records reveal infrastructure dependencies inconsistent with the customer profile.
• PTR records reveal hosting provider names or geography inconsistent with the declared footprint.
• Digital infrastructure exposure appears together with adverse media, sanctions proximity, opaque UBOs or source-of-funds inconsistencies.

These indicators should be treated as supporting evidence for analyst review, not as automatic suspicion by themselves.