AML Red Flags Scoring: Assessing Money Laundering Risk in Bank Statements

A checklist of red flags is not a risk score. Knowing that a bank account shows high cash deposits, inter-bank transfers, and a recently activated dormant status tells you what to investigate. It does not tell you how urgent it is relative to the other 40 accounts sitting in the team’s queue. That is the gap an AML red flags scoring framework fills. 

India’s 2024 FATF Mutual Evaluation Report identified the need to improve suspicious transaction detection and increase STR filings, particularly across higher-risk sectors. The gap between identifying flags and acting on them in a structured, timely way is not just an operational inconvenience. It is a documented regulatory concern.

Why a Scoring Approach Matters More Than a Checklist

Most AML checklists in use at Indian financial institutions are binary: a flag is either present or absent. That framing misses the volume dimension and the clustering dimension entirely.

A single large cash deposit on one occasion reads differently from 15 cash deposits across consecutive weekdays with withdrawals the morning after. Both trigger the same checkbox. A scoring framework captures frequency, magnitude, and clustering, including whether multiple AML red flags types appear in the same account simultaneously. An account scoring high across all three dimensions warrants priority over one with a single isolated flag, because the co-occurrence of signals in a single account is what distinguishes routine anomalies from genuine laundering risk.

The RBI develops around 450 risk indicators each year to score financial institutions and flag outliers, using a data-driven approach that collects roughly 750 data points from 90 banks every quarter. Building a comparable framework at the account level, scaled to what a compliance team at an NBFC or forensic practice can apply operationally, is both good practice and increasingly what supervisors expect to see.

Category One: Account-Level Structural Patterns

These AML red flags relate to an account’s history and structure rather than individual transactions. They carry weight because they signal that the account itself may have been set up or adapted for the purpose of moving money rather than conducting legitimate financial activity.

Dormant Account Activation

An account with minimal activity over six months or more, suddenly receiving high-value transfers, is one of the clearest structural red flags in bank statement analysis. Dormant accounts are often reactivated specifically for a single laundering cycle, then abandoned once the funds have moved through.

Balance Volatility With a Near-Zero Floor

Accounts used for money rotation characteristically receive large deposits and return to near-zero within days. The account holds no residual balance because its purpose is to pass funds through, not accumulate them. Tracking the ratio between peak balance and typical closing balance across the statement period captures this pattern reliably.

Mismatch Between Account Type and Transaction Profile

A savings account processing dozens of high-value RTGS transfers monthly, or a personal account showing vendor-pattern inflows from multiple GST-registered businesses, warrants scrutiny regardless of the transaction amounts individually. The account structure does not match the transaction behaviour, and that mismatch itself is an account-level flag.

Category Two: Transaction-Level Patterns

These flags emerge from the transaction data itself and are where the highest-risk signals typically concentrate.

FIFO Patterns (First In, First Out)

A large credit followed by a debit of near-identical value on the same day or within 24 to 48 hours is the core signature of the placement and layering stages of money laundering. One occurrence is notable. Multiple FIFO instances across a single statement period, involving different counterparties each time, substantially increase the risk score. 

Round-Figure High-Value Transactions

Genuine business transactions accumulate GST percentages, bank charges, and fractional amounts. Round-figure RTGS or NEFT payments (exactly ₹5,00,000 or ₹10,00,000) at regular intervals, particularly without a corresponding invoice trail in the GST data, are consistent AML red flags. Structuring behaviour specifically involves keeping transaction amounts below reporting thresholds, so a pattern of near-identical transactions just below a key threshold carries more weight than a single large round-figure payment.

Multiple Cash Deposits on the Same Day or Consecutive Days

Cash is the preferred entry point for illicit funds because it breaks the digital paper trail. An account receiving several separate cash deposits across the same day, particularly from different ATM or branch locations, is displaying structuring behaviour regardless of the individual amounts.

Large Debit Immediately Following a Salary-Pattern Credit

When a credit arriving with salary-like regularity is followed within 24 to 48 hours by a large debit to a new or infrequent counterparty, it can indicate the account is being used to pass funds disguised as income rather than to record legitimate employment earnings.

Category Three: Counterparty and Network Patterns

A single account in isolation tells part of the story. The counterparty data reveals the network around it.

Concentration of Inflows From a Very Small Number of Sources

When the majority of an account’s credits come from one or two counterparties, and those counterparties are not named, established businesses visible in GST records, the account’s income structure is difficult to explain through normal commercial activity.

Circular Transactions Across Multiple Accounts

Money flowing from Account A to Account B to Account C and back to Account A within the same period, even across multiple uploaded statements, is a textbook layering method.

Frequent Transactions With no Identifiable Business Counterpart

When counterparty names don’t correspond to any GST-registered entity and the amounts are substantial or recurring, the source or destination of those funds is effectively undisclosed. This is particularly significant when it appears alongside high FIFO activity in the same account.

Building the Score: How to Weight These Flags

The three categories carry different baseline weights in practice. 

How the categories stack:

• Transaction-level flags anchor the score. FIFO patterns and structuring behaviour are the most operationally specific to laundering. 
• Account-level structural patterns are amplifiers. A dormant activation or balance volatility flag meaningfully raises a high transaction-level score; in isolation, they warrant monitoring rather than escalation.
• Counterparty network patterns are the most decisive in multi-account investigations. Circular flows across related accounts confirm what individual account analysis could only suggest.

This is what Precisa’s AML dashboard calculates. The platform automatically tracks FIFO patterns, balance volatility, inter-bank transfers, circular transactions, counterparty concentration, and suspicious transaction types across the entire statement, generating a composite risk score that reflects the combined weight of these signals. Compliance officers and forensic teams get a ranked list of concerns rather than a uniform flat list, which is the practical difference between a scoring framework and a checklist.

Trusted by 1,000+ clients across 25+ countries, Precisa supports 850+ banks and 1,200+ bank formats, processing over 510 million transactions to date.

Precisa’s AML dashboard processes bank statements across formats and flags risk signals automatically, so your team has a ranked priority list rather than a flat checklist to work through. Try your first three analyses free.