From banking
Activate for: AML alert, transaction monitoring, suspicious activity, money laundering, structuring, smurfing, round-tripping, layering, placement, integration, typology, red flag, velocity alert, geographic anomaly, TBML, trade-based money laundering, network analysis, PEP alert. NOT for: SAR/STR drafting or filing (use aml-sar-drafting), customer onboarding or KYC documentation (use aml-cdd-edd), sanctions list screening (use sanctions-screening).
npx claudepluginhub panaversity/agentfactory-business-plugins --plugin bankingThis skill uses the workspace's default tool permissions.
Placement — Introducing illicit funds into the financial system
Analyzes transaction data for AML compliance, detecting patterns like structuring, layering, velocity anomalies, and prepares Suspicious Activity Reports (SARs) with HITL review.
Guides BSA/AML compliance program design and operation for broker-dealers, banks, and investment advisers. Covers SARs, CTRs, OFAC screening, red flags, customer risk rating, and FinCEN requirements.
Activate for: SAR, STR, suspicious activity report, suspicious transaction report, NCA, FinCEN, AUSTRAC, SAR narrative, SAR drafting, SAR format, MLRO, money laundering reporting officer, tipping-off, consent SAR, defence SAR. NOT for: transaction monitoring alert triage (use aml-typologies), customer due diligence or KYC onboarding (use aml-cdd-edd), sanctions screening (use sanctions-screening).
Share bugs, ideas, or general feedback.
Placement — Introducing illicit funds into the financial system Red flags: Large cash deposits; multiple deposits just below reporting threshold (structuring); money service business transactions; casino chip purchases/redemptions.
Layering — Obscuring the audit trail through multiple transactions Red flags: Rapid movement through multiple accounts; complex wire sequences across multiple jurisdictions; shell company or nominee director use; conversion between asset classes (cash → wire → crypto → real estate).
Integration — Re-introducing laundered funds as apparently legitimate income Red flags: Luxury asset purchases (real estate, vehicles, art); unexplained business investments; loan repayments from obscure sources; complex "business transactions" with no apparent commercial purpose.
STRUCTURING (SMURFING) Indicator: Multiple cash deposits/withdrawals in a single account, each just below the reporting threshold, within a defined period. Detection rule: ≥3 transactions within 7 days each ≥ 80% of the reporting threshold. ML enhancement: Aggregate transactions per customer per rolling 30-day window. Note: The reporting threshold is jurisdiction-specific (USD 10,000 in USA, varies elsewhere).
ROUND-TRIPPING Indicator: Funds sent from Account A to Jurisdiction X, then returned from Jurisdiction X to Account A or a closely connected account within a short period. Detection: Wire-out to jurisdiction X followed by wire-in from same jurisdiction within 30 days, same approximate amount (±10%).
RAPID FUND MOVEMENT / VELOCITY Indicator: Account receives large funds then transfers them out within 24–72 hours with minimal balance remaining. Detection rule: Opening balance < 10% of daily inflow; >80% of incoming funds transferred out within 48 hours.
GEOGRAPHIC ANOMALY Indicator: Transactions to/from high-risk jurisdictions inconsistent with customer profile. Detection: Any transaction above de minimis to FATF grey-listed or black-listed countries. Enhanced scrutiny for: Iran, North Korea, Myanmar (FATF black list); current grey list — check FATF.org for current listing as it changes quarterly.
TRADE-BASED MONEY LAUNDERING (TBML) Indicator: Over/under-invoicing; multiple invoicing; falsely described goods. Red flags: Invoice amounts inconsistent with commodity market price; import/export volumes inconsistent with declared business size; inconsistency between shipping documents and invoices.
PROFESSIONAL MONEY LAUNDERING NETWORKS Indicator: Account connected through transactions to other accounts with known AML suspicion or law enforcement interest. Detection: Graph network analysis — identify high-centrality nodes, clusters of accounts with high internal velocity and cash-out at network periphery.
PEP UNUSUAL TRANSACTION Indicator: Politically Exposed Person receives unexplained large incoming transfer disproportionate to known income/wealth profile. Detection rule: Any PEP account single transaction > 3× average monthly balance. Any PEP incoming transfer from jurisdiction with high corruption index.
SHELL COMPANY LAYERING Indicator: Corporate account with no apparent operational activity — no payroll, no supplier payments, only wire receipts and outflows. Red flags: Beneficial owner structure through Cayman / BVI / Panama / Cyprus; multiple directors with no apparent operational role; no website or publicly verifiable business presence.
LOAN-BACK Indicator: Customer places cash/funds in account, then takes a "loan" collateralised by those funds. Repays loan with laundered funds; withdraws original "collateral" clean. Detection: Secured lending against own deposits; loan repayments from sources inconsistent with declared income.
REAL ESTATE MONEY LAUNDERING Indicator: All-cash property purchase; multiple rapid buy/sell transactions in same property; purchase at significantly above or below market value. Red flags: Payment from a third party with no apparent connection to the buyer; offshore corporate as buyer with opaque beneficial ownership.
CRYPTO-TO-FIAT CONVERSION Indicator: Incoming wires from cryptocurrency exchanges to bank accounts. Red flags: High-frequency conversion from multiple exchanges; exchanges operating in high-risk jurisdictions with weak AML controls; transaction amounts not rounded (characteristic of crypto exchange deposits).
MONEY MULE ACTIVITY Indicator: Account receives funds from multiple unknown sources and immediately transfers to third parties; account holder's profile inconsistent with transaction volumes. Detection: Multiple incoming wires from unknown parties; average transaction ≫ declared income; account holder has changed personal details (address, employment) recently.
INSURANCE PREMIUM FINANCING LAUNDERING Indicator: Purchase large-value life insurance policy with lump sum; cancel early and accept surrender penalty to receive "clean" refund cheque from insurer. Red flags: Large single premium life insurance; early policy surrender; cash source inconsistent with declared income.
INVOICE FRAUD / ADVANCE FEE FRAUD Indicator: Account receives multiple large payments described as "invoices" or "commissions" from offshore entities with no apparent business relationship.
LAYERING VIA SECURITIES Indicator: Purchase securities (equities, bonds) with cash/wire, then rapidly sell and withdraw cash from proceeds. Detection: Same-day or next-day securities purchase and sale with no apparent investment rationale; securities transactions from accounts with no investment history.
CROSS-BORDER CASH SMUGGLING FRONT Indicator: Business with declared import/export activities used to justify cross-border fund movements that are disproportionate to the declared business scale.
HAWALA / INFORMAL VALUE TRANSFER Indicator: Payments to known hawala operators; international transfers with "settlement" description; amounts consistent with remittance fees charged on informal value transfer.
GAMBLING / CASINO LAYERING Indicator: Purchase casino chips with cash; minimal gambling; cash out. Remote gambling: Fund online gambling account; withdraw without significant play.
CORRESPONDENT BANKING NESTED ACCOUNTS Indicator: Respondent bank (foreign) maintains accounts for its own customers within the correspondent relationship — "nested" accounts not directly visible to the correspondent bank. Detection: Wire patterns suggesting multiple underlying account holders using a single correspondent relationship.
TERRORIST FINANCING (SMALL AMOUNTS, UNUSUAL DESTINATIONS) Indicator: Multiple small international transfers to individuals in conflict zones or areas with known terrorist activity. Distinguishing feature: Unlike money laundering (large amounts laundered to appear clean), terrorist financing often involves small amounts from legitimate sources.
Level 1 — Quick Close (< 5 min): Fully explained by known business profile? YES with documentation → Close with documented rationale
Level 2 — Customer/RM Contact (< 1 hr): Plausible explanation but insufficient info? Request clarification → If satisfactory + documented → Close If unsatisfactory → Escalate to Level 3
Level 3 — Enhanced Investigation (< 24 hr): Suspicious despite explanation? Obtain: company filings, adverse media search, transaction history, BO verification If suspicion eliminated + documented → Close If suspicion remains → Escalate to Level 4
Level 4 — MLRO SAR Decision: Apply jurisdiction's SAR standard (see overlay) UK: "reasonable grounds to suspect" (POCA 2002) USA: "reason to suspect" involving $5,000+ and a legal violation (BSA) File SAR/STR if standard met → Account continuation decision
Peer group analysis: Flag customers whose transaction patterns deviate >2 standard deviations from statistically similar peers (same product, geography, business type). Network/graph analysis: Flag customers who are highly connected through transactions to other flagged/suspicious customers — even if their own transactions appear benign. Autoencoder anomaly detection: Train on "normal" transactions; flag those with high reconstruction error as novel — effective for detecting new typologies. Reported outcomes: Featurespace/Visa and NICE Actimize report 50–70% false positive reduction in production deployments while maintaining or improving detection rates.
TYPOLOGY ASSESSMENT
Alert ID: [System-generated alert ID]
Customer: [Name / ID]
Assessment Date: [YYYY-MM-DD]
ALERT TRIGGER:
Rule/Model: [Rule name or ML model that generated the alert]
Transaction(s): [Date, amount, type, counterparty for each flagged transaction]
TYPOLOGY IDENTIFIED:
Primary: [Typology name from list above — e.g., STRUCTURING, ROUND-TRIPPING]
Secondary: [Additional typology if applicable]
ML Stage: [Placement / Layering / Integration]
ASSESSMENT:
Customer Profile: [Summary of expected activity vs. observed activity]
Innocent Explanation:[Considered and why insufficient, OR why activity is legitimate]
Risk Indicators: [List specific red flags observed]
DISPOSITION:
Level: [1 — Quick Close / 2 — RM Contact / 3 — Enhanced Investigation / 4 — MLRO SAR Decision]
Decision: [Close with rationale / Escalate / File SAR]
Rationale: [Documented reasoning for disposition]
ALL OUTPUTS REQUIRE REVIEW BY A QUALIFIED PROFESSIONAL BEFORE USE IN REGULATORY FILINGS OR BUSINESS DECISIONS.