Zero STRs does not mean zero risk
No STRs filed. Does that mean your AML controls are working? Not necessarily. A low number of Suspicious Transaction Reports (STRs) is not, on its own, evidence of effective AML compliance. The real question is whether you are identifying suspicious activity, investigating red flags and reporting when required.
At a glance
- Risk may be going undetected. Low or no STRs should prompt a review of how suspicious activity is identified.
- Monitoring matters. Effective controls rely on sound judgement and meaningful transaction monitoring.
- Measure effectiveness. Check whether your framework identifies and escalates suspicious activity appropriately.
- A red flag is not proof of money laundering, but failing to investigate it is a compliance risk.
Effective AML means identifying, assessing and reporting suspicious activity appropriately.
The detail, step by step
Ask why the number is low
A low count can be right for a lower-risk business. It can also mean staff are not spotting red flags, are not escalating them, or that monitoring is not set up to find them. Find out which.
Know the red flags
Red flags that should be spotted and escalated include:
- Unusual investment funding.
- Suspicious trading patterns.
- Unusual cash transactions.
- Unusual transaction structuring.
- Unexplained source of funds.
- Unusual property transactions.
- Unexplained client funds.
- Opaque ownership structures.
- Inconsistent financial records.
- Unusual related-party transactions.
Check the monitoring
Look at whether your monitoring rules or manual reviews fit the business's risks, whether alerts are reviewed, and whether the reviews show real judgement.
Check the escalation route
Staff should know how to raise a concern with the MLRO and feel able to do so. Count internal escalations as well as external reports: few of both is a warning sign.
Investigate and report where necessary
Spot the red flag, escalate it to the MLRO, investigate, and report where there are grounds to suspect. Record each decision, including decisions not to report.
Measure effectiveness
Test the framework periodically, for example through an independent review, sample checks of closed alerts and staff interviews.
Mistakes to avoid
- Reading a low STR count as proof that controls are effective.
- Treating a red flag as proof of laundering, or ignoring it because it is not.
- Having no record of decisions not to report.
- Never testing whether staff recognise the red flags for their role.
Evidence to keep
- The internal escalation log, including cases not reported and why.
- Alert reviews and their outcomes.
- STRs filed and the supporting analysis.
- Results of effectiveness testing or independent reviews.
Where Adventant can help
General information only, not legal or compliance advice. The examples and figures are invented for illustration. Your obligations depend on your activities and your regulator, so check the current rules that apply to you or speak to Adventant about your situation.