FIA Guidance Note - Suspicious Transaction Reports

accountable persons understand the nature of a suspicious transaction; c) to provide indicators that may be taken into consideration when determining whether a transaction should give rise to a suspicion; d) to provide information on the implications of making a STR under section 10 (1) of the Act; and e) to provide a step-by-step guide to the use of the internet-based reporting mechanism for submissions of STRs.

2.0 REGISTRATION OF ACCOUNTABLE PERSONS.

Reporting Institutions are required under the Anti-Money Laundering Act to register with the Financial Intelligence Authority among other obligations. The registration process is done electronically using this link: https://goaml.fia.go.ug/PRD/Home

3.0 SUSPICIOUS TRANSACTIONS A suspicious transaction is defined in section 1 of the Anti-Money Laundering Act, Cap 118, as a transaction which is inconsistent with a customer's known legitimate business or personal activities or with the normal business for that type of account or business relationship, or a complex and unusual transaction or complex and unusual pattern of transaction

Throughout these guidelines, any mention of a "transaction" includes one that is either completed or attempted as explained

below.

i) Completed transactions: A completed transaction is one that has occurred. For example, if you process a deposit from a client towards the purchase of an asset such as a life insurance policy or a house, a financial transaction has occurred. This is true even if the final sale associated to the deposit does not go through. In this example, the refund of the deposit shall also be a financial transaction.

ii) Attempted transactions: An attempted transaction is one that a client intended to conduct and took some form of action to do so. An attempted transaction is different from a simple request for information, such as an enquiry as to the fee applicable to EFT transfer. An attempted transaction includes entering into negotiations or discussions to conduct the transaction and involves concrete measures to be taken by either Financial Institution or the client.

3.1 Reasons for Submitting STRs.

Accountable persons play a vital role in combating illicit financial flows by submitting Suspicious Transaction Reports (STRs). By developing a thorough understanding of their customers and the nature of their transactions, these entities can effectively identify suspicious activities. Submitting STRs is crucial as it enables the Financial Intelligence Authority to perform a thorough analysis to identify patterns and trends of Money laundering, Terrorism Financing, and Proliferation Financing.

4.0 FORMATION OF SUSPICION There are several key steps to conducting an effective financial investigation into potential suspicious activity by an accountable person, including but not limited to; reviewing internal transactions, information obtained from the customer, and other relevant internal documentation; identifying and reviewing external

information to understand the customer, related entities and relevant media; contacting business line employees responsible for the account relationship and generating a written report documenting relevant findings.

Accountable persons must develop their operating definition for suspicion. The definition of suspicion should incorporate elements of unresolved and unsubstantiated but persistent feelings of doubt about an objective set of facts and circumstances relating to a behavior, to a single transaction, to a series of transactions, attempted transactions, or to any combination thereof. It can be a feeling that something is not as it was expected to be, or as it was explained to be, given the totality of knowledge of the circumstances in which that something exists. The feeling of doubt cannot be relieved by proof, one way or another since no proof is available.

The definition should allow the formation of a belief that is not firmly grounded or perfectly clear. At the same time, the definition should not allow these beliefs to be imaginary or brief. Certainly, the definition should count as suspicious behaviors and activities that are unusual for the circumstances and not adequately or believably explained.

The operating definition for suspicion must pass a test of reasonableness. If the definition is too narrow or rigid, it may exclude generation of reports that concern unknown or unanticipated unlawful circumstances (i.e. "false negatives") and may also result in avoidance behavior by criminals. On the other hand, a definition that is too broad or flexible might result in large number reports that are insufficiently analyzed and that do not reflect unlawful circumstances (i.e. "false positives" or "over compliance").

5.0 REPORTING OF STRS

Under regulation 7 of the AML regulations 2015, the MLCO has the function to receive and review reports of suspicious transactions made by the staff of accountable persons and determine if sufficient basis exists. Accordingly, the MLCO of an entity shall be the reporter for Suspicious Transaction Reporting for Regulation 7.

It should be noted that upon submission of the STR, the Authority may request more information relating to the transaction and the financial institution is required to avail it to the Authority as per section 10 (4) of AMLA Cap 118. amended.

5.1 Timelines for Filing Suspicious Transaction Reports All accountable persons should have transaction monitoring systems (automated or manual) to identify potentially suspicious transactions or activities and raise alerts.

a) All accountable persons should institute ML/TF risk management internal controls which ensure that generated alerts are opened within three (3) working days after the alert is generated. a) If the alert requires further investigation, the accountable person should conduct and complete the investigation, within ten (10) working days, from the date the alert was generated, and whether the transactions or activities are suspicious b) If after the investigation the transactions/activity are deemed suspicious, the accountable person must file a suspicious transaction/activity report with the Financial Intelligence Authority without delay, but not later than two working days from the time suspicion was formed. c) The exception in the timelines above is in respect of Terrorism Financing and Proliferation Financing which must be prioritized and reported to the Financial Intelligence Authority without delay. d) If, after filing a suspicious transaction/activity report with the Authority, an Accountable Person discovers additional facts and circumstances to either support or refute the Accountable Person's initial suspicion, the accountable person should inform the Authority as seen as possible but not later than two (2) working days from the time of discovery of additional information by filing another STR/SAR with specific reference to the initial one.

6.0 HOW TO IDENTIFY SUSPICIOUS TRANSACTION/ACTIVITY

Accountable persons must develop their understanding of reasonable suspicion which may be related to risk indicators and incorporate established views of doubt about circumstances relating to the behavior, to a transaction, to a series of transactions, an attempted transaction, or to any combination thereof. Several indicators, as listed in Sections 7 , 8 and 9 can assist in identifying or recognizing a suspicious transaction or activity. However, indicators alone do not confirm an ML/TF offense or criminal conduct. An assessment of the suspicion should be based on a reasonable evaluation of other relevant factors, including the knowledge of the customer's business, financial history, background, and behavior.

7.0 INDICATORS OF SUSPICIOUS TRANSACTIONS The following are examples of common indicators that may point to suspicious or unusual transactions:

7.1 General a) Client admits or makes statements about involvement in criminal activities; b) Client does not want correspondence sent to home address; c) Client appears to have accounts with several financial institutions in one area for no apparent reason; d) Client conducts transactions at different physical locations in an apparent attempt to avoid detection; e) Client repeatedly uses an address but frequently changes the names involved. f) Client is accompanied and watched at all relevant times; g) Client shows uncommon curiosity about internal systems, controls and policies; h) Client has only vague knowledge of the amount of a deposit; i) Client presents confusing details about the transaction or knows few details about its purpose; j) Client appears to informally record large volume transactions, using unconventional bookkeeping methods or "off-the-record" books; k) Client over justifies or explains the transaction; l) Client is secretive and reluctant to meet in person; m) Client is nervous, not in touch with the transaction; n) Client is involved in transactions that are suspicious but seems blind to being involved in money laundering or terrorism financing activities;

o) Client's home or business telephone number has been disconnected or there is no such number when an attempt is made to contact client shortly after opening account; p) Normal attempts to verify the background of a new or prospective client are difficult; q) Client appears to be acting on behalf of a third party, but does not tell you; r) Client is involved in activity out-of-keeping for that individual or business; s) Client insists that a transaction be done quickly; t) Inconsistencies appear in the client's presentation of the transaction; u) The transaction does not appear to make sense or is out of keeping with usual or expected activity for the client; v) Client appears to have recently established a series of new relationships with different financial entities; w) Client attempts to develop close rapport with staff; x) Client uses aliases and a variety of similar but different addresses; y) Client spells his or her name differently from one transaction to another; z) Client provides false information or information that you believe is unreliable; aa) Client offers you money, gratuities or unusual favours for the provision of services that may appear unusual or suspicious; bb) Client pays for services or products using financial instruments, such as money orders or traveller's cheques, without relevant entries on the face of the instrument or with unusual symbols, stamps or notes; cc) You are aware that a client is the subject of a money laundering or terrorism financing investigation; dd) You are aware or you become aware, from a reliable source (that can include media or other open sources), that a client is suspected of being involved in illegal activity; ee) A new or prospective client is known to you as having a questionable legal reputation or criminal background; and ff) Transaction involves a suspected shell entity (that is, a corporation that has no assets, operations or other reason to exist).

7.2 Knowledge of Reporting or Record Keeping Requirements a) Client attempts to convince an employee not to complete any documentation required for the transaction; b) Client makes inquiries that would indicate a desire to avoid reporting; c) Client has unusual knowledge of the law in relation to suspicious transaction reporting;

d) Client seems very conversant with money laundering or terrorist financing activity issues; e) Client is quick to volunteer that funds are "clean" or "not being laundered"; f) Client appears to be structuring amounts to avoid record keeping, client identification or reporting thresholds; g) Client appears to be collaborating with others to avoid record keeping, client identification or reporting thresholds.

7.3 Identity Documents a) Client provides doubtful or vague information; b) Client produces seemingly false identification or identification that appears to be counterfeited, altered or inaccurate; c) Client refuses to produce personal identification documents; d) Client only submits copies of personal identification documents; e) Client wants to establish identity using something other than his or her personal identification documents; f) Client's supporting documentation lacks important details such as a phone number; g) Client inordinately delays presenting corporate documents; h) All identification presented is foreign or cannot be checked for some reason; i) All identification documents presented appear new or have recent issue dates; j) Client presents different identification documents at different times; k) Client alters the transaction after being asked for identity documents; l) Client presents different identification documents each time a transaction is conducted.

7.4 Cash Transactions a) Client frequently exchanges small notes for large ones. b) Client starts conducting frequent cash transactions in large amounts when this has not been a normal activity for the client in the past c) Client uses notes in denominations that are unusual for the client, when the norm in that business is different; d) Client presents notes that are packed or wrapped in a way that is uncommon for the client; e) Client deposits musty or extremely dirty bills; f) Client makes cash transactions of consistently rounded-off large amounts (e.g., UGX 4,900,000, UGX 13,900,000 etc.);

g) Client consistently makes cash transactions that are just under the reporting threshold amount in an apparent attempt to avoid the reporting threshold; h) Client consistently makes cash transactions that are significantly below the reporting threshold amount in an apparent attempt to avoid triggering the identification and reporting requirements; i) Client presents uncounted funds for a transaction. Upon counting, the client reduces the transaction to an amount just below that which could trigger reporting requirements; j) Client conducts a transaction for an amount that is unusual compared to amounts of past transactions; k) Client frequently purchases traveller's cheques, or other bearer negotiable instruments with cash when this appears to be outside of normal activity for the client; l) Client asks you to hold or transmit large sums of money or other assets when this type of activity is unusual for the client; m) Shared address for individuals involved in cash transactions, particularly when the address is also for a business location, or does not seem to correspond to the stated occupation (for example, student, unemployed, self-employed, etc.); n) Stated occupation of the client is not in keeping with the level or type of activity (for example a student or an unemployed individual makes daily maximum cash withdrawal at multiple locations over a wide geographic area); o) Cash is transported by a cash courier; p) Large transactions using a variety of denominations.

7.5 Economic Purposes a) Transaction seems to be inconsistent with the client's apparent financial standing or usual pattern of activities; b) Transaction appears to be out of the normal course for industry practice or does not appear to be economically viable for the client c) Transaction is unnecessarily complex for its stated purpose; d) Activity is inconsistent with what would be expected from declared business; e) A business client refuses to provide information to qualify for a business discount; f) No business explanation for size of transactions or cash volumes; g) Transactions of financial connections between businesses that are not usually connected (for example, a food importer dealing with an automobile parts exporter);

h) Transaction involves non-profit or charitable organization for which there appears to be no logical economic purpose or where there appears to be no link between the stated activity of the organization and the other parties in the transaction.

7.6 Transactions Involving Accounts a) Opening accounts when the client's address is outside the local service area; b) Opening accounts in other people's names; c) Opening accounts with names very close to other established business entities; Attempting to open or operating accounts under a false name; d) Account with a large number of small cash deposits and a small number of large cash withdrawals; e) Funds are being deposited into several accounts, consolidated into one and transferred outside the country; f) Client frequently uses many deposit locations outside of the home branch location; g) Multiple transactions are carried out on the same day at the same branch but with apparent attempt to use different tellers; h) Activity far exceeds activity projected at the time of opening of the account; i) Establishment of multiple accounts, some of which appear to remain dormant for extended periods; j) Account that was reactivated from inactive or dormant status suddenly sees significant activity; k) Reactivated dormant account containing a minimal sum suddenly receives a deposit or series of deposits followed by frequent cash withdrawals until the transferred sum has been removed; l) Unexplained transfers between the client's products and accounts; m) Large transfers from one account to other accounts that appear to be pooling money from different sources; n) Multiple deposits are made to a client's account by third parties; o) Deposits or withdrawals of multiple monetary instruments, particularly if the instruments are sequentially numbered; p) Frequent deposits of bearer instruments (for example, cheques, money orders) in amounts just below a determined threshold; q) Unusually large cash deposits by a client with personal or business links to an area associated with drug trafficking; r) Regular return of cheques for insufficient funds; s) Correspondent accounts being used as "pass-through" points from foreign jurisdictions with subsequent outgoing funds to another foreign jurisdiction;

t) Multiple personal and business accounts are used to collect and then funnel funds to a small number of foreign beneficiaries, particularly when they are in locations of concern, such as countries known or suspected to facilitate money laundering activities.

7.7 Transactions Involving Areas Outside Uganda a) High-volume international transfers to third-party accounts in countries not typically associated with remittance activity. b) The transaction involves a country known for its highly confidential banking and corporate laws. c) Excessive demand for remittances from migrants, based on the migrant worker population. d) The transaction involves a country where illicit drug production or exportation might be prevalent, or where anti-money laundering measures are ineffective. e) Deposits quickly followed by wire or electronic transfers to or through high-risk locations, such as countries suspected of money laundering. f) Foreign currency exchanges linked to subsequent wire or electronic transfers to high-risk locations, such as countries suspected of facilitating money laundering. g) The client and other transaction parties have no evident connections to Uganda. h) Transactions with countries identified by the Financial Action Task Force as needing enhanced scrutiny. i) Cash volumes and international remittances significantly exceeding the average income of migrant worker clients. j) The use of a credit card issued by a foreign bank, not operating in Uganda, by a client who does not reside or work in the card's country of issuance.

7.8 Transactions Related to Offshore Business Activity a) Accumulation of large balances, inconsistent with the known turnover of the client's business, and subsequent transfers to overseas account(s); b) Any individual or entity that conducts transactions internationally should consider the following indicators c) Frequent requests for traveller's cheques or other negotiable instruments; d) Loans secured by obligations from offshore banks; e) Loans to or from offshore companies; f) Offers of multimillion-dollar deposits from a confidential source to be sent from an offshore bank or somehow guaranteed by an offshore bank;

g) Transactions involving an offshore "shell" bank whose name may be very similar to the name of a major legitimate institution; h) Unexplained electronic funds transfers by client on an in and out basis; i) Use of letter-of-credit and other method of trade financing to move money between countries when such trade is inconsistent with the client's business j) Use of a credit card issued by an offshore bank

8.0 INDUSTRY-SPECIFIC INDICATORS In addition to the general indicators mentioned earlier, the following industryspecific indicators may also suggest a suspicious transaction, whether it has been completed, attempted, or proposed. For example, in the financial sector, unusually large cash deposits or frequent transactions that do not align with a customer's known business activities could be considered suspicious. Depending on the services provided by the entity, it might need to review indicators from multiple sections listed below.

8.1 Financial Institutions

8.1.1 Personal Transactions a) Client appears to have accounts with several financial institutions in one geographical area; b) Client has no employment history but makes frequent large transactions or maintains a large account balance; c) The flow of income through the account does not match what was expected based on stated occupation of the account holder or intended use of the account; d) Client makes one or more cash deposits to general account of foreign correspondent bank (i.e., pass-through account); e) Client makes frequent or large payments to online payment services; f) Client runs large positive credit card balances; g) Client uses cash advances from a credit card account to purchase money orders or to wire/electronically transfer funds to foreign destinations; h) Client takes cash advance to deposit into savings or cheque account; i) Large cash payments for outstanding credit card balances; j) Client makes credit card overpayment and then requests a cash advance; k) Client visits the safety deposit box area immediately before making cash deposits; l) Client wishes to have credit and debit cards sent to international or domestic destinations other than his or her address;

m) Client has numerous accounts and deposits cash into each of them with the total credits being a large amount; n) Client deposits large endorsed cheques in the name of a third-party; o) Client frequently makes deposits to the account of another individual who is not an employer or family member; p) Client frequently exchanges currencies; q) Client frequently makes automatic banking machine deposits just below the reporting threshold; r) Client's access to the safety deposit facilities increases substantially or is unusual in light of their past usage; s) Many unrelated individuals make payments to one account without rational explanation; t) Third parties make cash payments or deposit cheques to a client's credit card; u) Client gives power of attorney to a non-relative to conduct large transactions; v) Client has frequent deposits identified as proceeds of asset sales but assets cannot be substantiated; w) Client acquires significant assets and liquidates them quickly with no explanation; x) Client acquires significant assets and encumbers them with security interests that do not make economic sense; y) Client requests movement of funds that are uneconomical; z) High volume of wire/electronic transfers are made or received through the account.

8.1.2 Corporate and Business Transactions Certain businesses are particularly vulnerable to the commingling of illicit funds with legitimate income, a common method of money laundering. Such businesses often operate with a substantial amount of cash, including restaurants, bars, parking lots, supermarkets, and vending machine companies. When opening accounts for various businesses in your area, you are likely to identify those with a predominantly cash-based operation. Unusual or unexplained increases in cash deposits by these entities may signal suspicious activity. Here are some examples:

a) Accounts with significant deposits in bank drafts, cashier's cheques, or money orders that are inconsistent with normal business operations. b) Accounts used to receive or disburse large sums without typical business- related transactions, such as salary payments or invoice settlements. c) Use of money orders or electronic funds transfers that do not align with the client's business activities. d) Deposits consisting of unusual combinations of monetary instruments, such as a mix of business, payroll, and social security cheques.

e) Deposits of cash and monetary instruments not typically associated with business activities. f) Business unwilling to provide complete information regarding its activities. g) Financial statements that significantly differ from those of similar businesses. h) Representatives of the business avoiding contact with the bank branch, even when it would be more convenient. i) Deposits or withdrawals in cash rather than the expected debit and credit transactions for commercial operations. j) Maintenance of trustee or client accounts that do not align with industry norms or the business type. k) A retail business offering cheque-cashing services without making large withdrawals of cash against deposited cheques. l) Payments or deposits of cash to cover bank drafts, money transfers, or other negotiable instruments. m) Purchases of cashier's cheques or money orders with large amounts of cash. n) Large amounts of currency deposited in wrapped straps. o) Large volume of unrelated deposits to multiple accounts, with frequent transfers of balances to a single account. p) Large cash deposits or withdrawals from accounts not typically associated with cash transactions. q) Large immediate withdrawals following a significant and unexpected credit from abroad. r) Single substantial cash deposit made up of many large bills. s) Deposits made on the same day at different branches across a broad geographic area, which may not be practical for the business. t) Substantial increase in cash or negotiable instrument deposits by a professional advisory business, especially if promptly transferred. u) A sudden change in cash transactions or account patterns. v) Requests for credit and debit cards to be sent to international or domestic addresses other than the business location. w) Significant increases in transaction volume or changes in account balance inconsistent with normal business practices. x) Asset acquisitions accompanied by security arrangements that deviate from normal practices. y) Repeated unexplained transactions between personal and commercial accounts. z) Activity that does not align with the stated business operations. aa) Close connections with other business accounts without a clear reason for the connection. bb) Activity suggesting transactions may violate securities regulations or business prospectus requirements.

cc) Large number of incoming and outgoing wire or electronic transfers with no logical business or economic purpose, especially involving high-risk jurisdictions.

8.1.3 Non-Profit Organizations (Including Registered Charities) a) Discrepancies between the financial transaction patterns or amounts and the organization's stated purpose and activities. b) Differences between the organization's modest sources of funds (e.g., from communities with low standards of living) and the large amounts of funds it raises. c) Sudden changes in the frequency or amount of financial transactions, or, alternatively, the organization holding funds in its account for unusually long periods. d) Large and unexplained cash transactions conducted by the organization. e) The organization's directors being located outside the local jurisdiction, particularly if there are significant outgoing transactions to their country of origin, especially if that country is considered high-risk. f) A high number of non-profit organizations with unexplained connections to each other. g) The organization having minimal staff, inadequate office facilities, or no telephone number, which seems inconsistent with its stated objectives and financial activities. h) The organization conducting operations or transactions involving high-risk jurisdictions.

8.1.4 Electronic Funds Transfers (EFTs) If you are involved in the business of electronic funds transfers (EFTs) or the remittance or transmission of funds, consider the following indicators.

a) The client is hesitant to provide details about the remittance. b) The client initiates wire or electronic transfers in small amounts to avoid meeting identification or reporting requirements. c) The client sends large amounts of money to foreign locations with instructions for the foreign entity to pay in cash. d) The client receives substantial sums of money from abroad with instructions for cash payments. e) The client frequently or significantly transfers funds for individuals or entities without any account relationship with the institution. f) The client regularly receives fund transfers from individuals or entities lacking an account relationship with the institution.

g) The client receives funds and immediately buys monetary instruments intended for payment to a third party, which is inconsistent with their normal business practices. h) The client requests immediate cash payment upon receiving a large fund transfer. i) The client instructs you to transfer funds abroad and expects an equivalent incoming transfer. j) As soon as transferred funds are cleared, the client moves them to another account or individual/entity. k) The client exhibits unusual interest in fund transfer systems and inquires about the transfer limits. l) The client transfers funds to another country without converting the currency. m) Large incoming wire or electronic transfers from foreign jurisdictions are quickly withdrawn by company principals. n) The client frequently sends wire or electronic transfers to foreign countries without a clear connection to those countries. o) Wire or electronic transfers are received from entities with no apparent business relationship with the client. p) The size of fund transfers is inconsistent with the client's typical business transactions. q) The increasing volume of remittances surpasses what was anticipated when the client relationship was established. r) Several clients request transfers either on the same day or within two to three days to the same recipient. s) Multiple clients request transfers funded by a single client. t) Several clients requesting transfers share common identifiers such as family name, address, or telephone number. u) Multiple different clients send transfers that are similar in amounts, sender names, test questions, free message text, and destination countries. v) A client sends or receives multiple transfers to or from the same individual. w) The client's stated occupation or financial standing does not align with the level or type of activity (e.g., a student or unemployed individual receiving or sending numerous wire/electronic transfers). x) Migrant remittances are made outside the usual remittance corridors. y) Personal funds are sent at times unrelated to salary payments. z) The country of destination for a wire/electronic transfer does not match the client's nationality. aa) The client requests transfers to numerous recipients outside Uganda who do not appear to be family members. bb) The client does not seem to know the recipient of the transfer. cc) The client does not appear to be familiar with the sender of the transfer they received.

dd) Beneficiaries of wire/electronic transfers include a large number of nationals from countries associated with terrorist activities. ee) The client makes fund transfers to free trade zones that are not related to their business. ff) The client conducts transactions involving countries known as narcotic source countries, transshipment points for narcotics, or countries with highly secretive banking and corporate law practices.

8.1.5 Loans If you are involved in the business of providing loans (including mortgages) or extending credit to individuals or corporations, consider the following indicators.

a) The client unexpectedly repays a problematic loan. b) The client makes a large, unexpected loan payment with funds of unknown origin or from a source that doesn't match their known background. c) The client repays a long-term loan, such as a mortgage, in a significantly shorter period than expected. d) The source of the down payment is inconsistent with the borrower's background and income. e) The down payment appears to come from an unrelated third party. f) The down payment is made using a series of money orders or bank drafts from various financial institutions. g) The client lists income from "foreign sources" on the loan application without providing additional details. h) The client's employment documentation lacks key details, making it difficult to contact or verify the employer. i) The client's identification, income support, or employment documentation is provided by an intermediary with no clear reason for involvement. j) The client has loans with offshore institutions or companies that are unusual for their business. k) The client offers large deposits or other incentives in exchange for favorable loan treatment. l) The client requests a loan against assets held by another financial institution or third party, with an unknown origin of these assets. m) The loan transaction lacks economic rationale (e.g., the client has significant assets but no clear business reason for the transaction). n) The customer appears indifferent to the terms or costs associated with the loan transaction. o) The client applies for loans based on a financial statement showing significant investments or income from businesses in countries known for highly secretive banking and corporate laws, which is unusual for their business.

p) The down payment or other loan payments are made by a party who is not a relative of the client.

8.2 Life Insurance Companies, Brokers and Agents If you provide life insurance or annuities as your main occupation or as one of the many services that you offer, consider the following indicators. For insurance companies that provide loans.

a) The client wants to use cash for a large transaction. b) The client suggests purchasing an insurance product using a check drawn from an account other than their personal one. c) The client requests an insurance product with no clear purpose and is unwilling to provide a reason for the investment. d) A client with small, regular policies suddenly requests a substantial policy with a lump sum payment. e) The client performs a transaction that results in a noticeable increase in investment contributions. f) The scale of investment in insurance products does not align with the client's financial profile. g) There are unexpected and inconsistent changes to the client's contractual conditions, including significant or regular premium top-ups. h) There is an unforeseen deposit or abrupt withdrawal of funds. i) One or more third parties are involved in paying premiums or handling other policy matters. j) The client overpays a policy premium and then requests a refund of the surplus to a third party. k) Funds used for policy premiums or deposits come from various sources. l) The client uses a life insurance product similarly to a bank account, such as making additional premium payments and frequent partial redemptions. m) The client cancels an investment or insurance policy soon after purchasing it. n) The client requests early redemption without a reasonable explanation or in a notably uneconomical way. o) The client shows more interest in canceling or surrendering an insurance contract than in the long-term benefits of the investment or the costs of terminating the contract. p) The client makes payments using small denomination notes, unusually wrapped, postal money orders, or similar payment methods. q) The initial (or only) premium is paid from a bank account located outside the country. r) The client accepts very unfavorable terms that are unrelated to their health or age.

s) The transaction involves using and paying a performance bond, resulting in a cross-border payment. t) There are repeated and unexplained changes in beneficiaries. u) The relationship between the policyholder and the beneficiary is not clearly defined.

8.3 Securities Dealers If you are involved in the business of dealing in securities, segregated fund products or any other financial instruments, including portfolio managers and investment counsellors, consider the following indicators.

a) The customer's activity constitutes a significant portion of the daily trades for a thinly traded or low-priced security. b) A customer buys and sells securities without a clear purpose or in unusual circumstances. c) Industry-known individuals who promote stocks sell securities through the broker-dealer. d) A customer gradually accumulates stock in small amounts throughout the trading day to manipulate the price. e) A customer engages in pre-planned or non-competitive trading of securities, such as wash or cross trades, without a clear business reason. f) A customer tries to influence a stock's closing price by placing buy or sell orders near the market's close. g) A customer's transactions appear linked to cyber breaches, possibly involving unauthorized fund disbursements or trades. h) Unrelated customer accounts at the firm suddenly and simultaneously trade an illiquid or low-priced security. i) A customer makes a large purchase or sale of a security before news or a major announcement that affects the security's price is released. j) The firm receives regulatory inquiries or subpoenas regarding the trading activities of its customers. k) A customer's pattern of securities transactions suggests they are using securities to convert currencies, such as buying in one currency and selling Depository Receipts (DRs) for another currency. l) The customer attempts or makes frequent or large deposits of currency, insists on dealing only in cash equivalents, or seeks exemptions from the firm's policies on cash and cash equivalents. m) The customer structures deposits, withdrawals, or purchases of monetary instruments below a certain amount to avoid reporting or recordkeeping requirements.

n) The customer deposits funds and immediately requests that the money be wired out or transferred to a third party or another firm without a clear business purpose. o) Wire transfers are made in small amounts to avoid triggering identification or reporting requirements. p) Wire transfers are made to or from financial secrecy havens, tax havens, high-risk geographic locations, or conflict zones, including those with established terrorism threats. q) The parties to the transaction are from countries known to support terrorist activities and organizations. r) The securities account is used for payments or outgoing wire transfers with minimal securities activities, resembling a depository account or conduit for transfers. s) Upon request, the customer is unable or unwilling to produce appropriate documentation to support a transaction, or the documentation appears doctored or fake. t) Nonprofit or charitable organizations engage in financial transactions with no logical economic purpose or with no clear link between the stated activity of the organization and the other parties involved. u) The customer provides suspicious or doubtful identification papers that are difficult to verify, or the details do not match previously provided or known information. v) The customer is unwilling or unable to identify the legitimate source of funds, or the information provided is false, misleading, or substantially incorrect. w) The customer has difficulty explaining the nature of their business or lacks general knowledge of their industry. x) The customer has faced rejection or had their relationship ended by other financial firms in the past. y) The customer seems to be representing someone else without disclosing the identity of the principal. z) The customer is a trust, shell company, or private investment company reluctant to provide information on controlling parties and underlying beneficiaries. aa) The customer is known to have legal issues or associations with individuals involved in crimes, corruption, or misuse of public funds. bb) An account is opened by a politically exposed person (PEP), especially when combined with other risk factors like the account being opened through a company owned by the PEP or being from a country flagged for AML issues. cc) An account is opened by a non-profit organization providing services in high- risk geographic locations. dd) An account is opened in the name of a legal entity involved with an organization whose aims are related to a known terrorist entity.

ee) An SCD account is opened for a purported stock loan company that may hold restricted securities used as collateral for defaulted loans, with subsequent sales through across-books transactions on an exchange. ff) An account is opened in the name of a foreign financial institution not licensed in the primary jurisdiction. gg) The customer uses a securities or futures brokerage firm to hold funds not used for trading over an extended period, inconsistent with their normal practices or financial capacity. hh) Shares are purchased by third parties in the names of other individuals (i.e., nominee accounts). ii) The customer attempts to influence a stock's closing price by placing buy or sell orders near the market's close. jj) The customer deposits large amounts of physical share certificates, immediately sells them, and then transfers out the proceeds. kk) The customer's explanation or documents regarding the acquisition of shares do not make sense or change upon questioning.

8.4 Money Services Businesses If you are involved in the money services business, including foreign exchange dealers, money remitters, agents of international money transfer services consider the following indicators.

a) Client requests a foreign exchange transaction at a rate higher than the posted rate. b) Client wishes to pay transaction fees that exceed the posted fees. c) Client exchanges currency and asks for the highest possible denomination bills in the foreign currency. d) Client has limited knowledge about the payee's address and contact details, is hesitant to provide this information, or requests a bearer instrument. e) Client requests a cheque in the same currency to replace one that is being cashed. f) Client asks to convert cash into a cheque, and issuing cheques is not a service you usually provide. g) Client seeks to exchange cash for numerous small postal money orders intended for various parties. h) Client engages in transactions with counterparties in locations that are atypical for them. i) Client directs that funds be collected by a third party on behalf of the payee. j) Client makes large purchases of traveller's cheques that do not align with their known travel plans. k) Client buys money orders in large quantities.

l) Client requests numerous cheques in small amounts and different names, totaling the amount of the exchange. m) Client asks for a cheque or money order to be made payable to the bearer. n) Client requests to exchange a significant amount of foreign currency for another foreign currency. o) Client deposits a significant amount of cash without a clear source of funds. p) Client frequently deposits cash just below reporting thresholds. q) Client conducts multiple transactions just below the reporting requirements within a short period. r) Client makes a large cash deposit and immediately requests a wire transfer to a high-risk jurisdiction. s) Client's transaction patterns suddenly change without explanation. t) Client avoids direct contact and conducts transactions through intermediaries. u) Client insists on conducting transactions in a manner that avoids documentation or identification. v) Client requests to open multiple accounts under different names or with multiple banks. w) Client is unusually interested in the bank's anti-money laundering policies or attempts to avoid questions related to the purpose of the transaction. x) Client deposits funds in a suspiciously structured manner, such as splitting a large sum into smaller deposits across multiple accounts. y) Client's transactions involve offshore entities or tax haven jurisdictions without a clear business purpose. z) Client is unwilling or unable to provide information on the source of funds for a large transaction. aa) Client provides inconsistent or contradictory information regarding their financial background or business activities. bb) Client requests to transfer funds through multiple accounts or countries without a clear business rationale. cc) Client conducts frequent transactions involving high-risk commodities, such as precious metals or cryptocurrencies.

8.5 National Payment System Players

8.5.1 For Payment Service Providers (PSPs) a) Unusually large transaction volumes that are inconsistent with the customer's known profile or business activities. b) Numerous small transactions that aggregate to a large amount, potentially to evade detection thresholds. c) Rapid transfers of large sums of money between accounts or across borders.

d) Discrepancies between the customer's profile and their transaction patterns, such as high-value transactions by low-income individuals. e) Transactions occurring at odd hours or on weekends when the business is not normally operational. f) Transactions involving countries known for high ML/TF risks, especially if there is no clear business rationale for these connections. g) High frequency of cross-border transactions without a clear commercial reason. h) A single customer operating multiple accounts with different payment service providers, especially if these accounts show suspicious activity. i) Frequent use of various payment methods (e.g., cards, electronic transfers) to conduct transactions. j) Large cash deposits or withdrawals that are inconsistent with the customer's known profile or business activities. k) Significant cash transactions occurring in geographic areas known for high levels of ML/TF activity or economic instability. l) High volumes of cash transactions conducted through entities that typically deal in low cash volume, such as online businesses or digital platforms. m) Use of cash for significant purchases or transactions where alternative payment methods are more common or expected. n) Cash deposits made in smaller amounts to avoid reporting thresholds, especially when the total amount is substantial. o) Large cash deposits made across different branches or locations, potentially to avoid detection or reporting requirements. p) Cash deposits or transactions with no clear or legitimate source, such as cash generated from unreported business activities. q) Use of cash to fund wire transfers or other financial instruments, especially if the amounts are large or frequent.

8.5.2 For Payment System Operators (PSOs) a) Unusual spikes in system activity or processing volumes that do not align with normal business operations. b) Transactions that follow atypical routes or use unconventional methods that do not fit the expected payment system use. c) Instances where system operators do not comply with AML/CFT regulations or fail to report suspicious activities. d) Weaknesses in the risk management framework that could allow for misuse of the payment system. e) Evidence of system breaches or unauthorized access that may facilitate illicit transactions. f) Detection of fraudulent transactions that exploit vulnerabilities in the payment system.

8.5.3 For Electronic Money Issuers (EMIs) a) Large or frequent transactions using e-money, especially if they are inconsistent with the customer's known activities. b) Unusual use of e-money for high-value purchases or transfers. c) Use of e-money accounts with minimal or no identification, increasing the risk of anonymity in transactions. d) Frequent small e-money transactions that aggregate to significant amounts. e) Large or frequent international e-money transfers to or from high-risk jurisdictions.

8.5.4 For Agents a) Transactions through agents that are inconsistent with the typical business volume of the agent or their known client base. b) Transactions that involve high-risk activities, such as large cash deposits or withdrawals with no clear purpose. c) Poor or inconsistent record-keeping by agents, making it difficult to track transactions or detect suspicious activities. d) Agents engaging in unusual behavior, such as working outside of regular hours or frequently handling large sums of money. e) Customers making requests for transactions that are unusual or inconsistent with their usual activities. f) Transactions involving agents that are conducted with minimal or no identification, increasing the risk of anonymity.

8.6 General ML/TF Indicators for All Entities a) Discrepancies between documents provided and known information about the customer or transaction. b) Customers engaged in high-risk professions or industries, such as those known for higher ML/TF risks. c) Sudden and unexplained changes in transaction volumes or patterns, especially if they deviate significantly from historical norms.

8.7 Accountants If you are an accountant, consider the following indicators when you are carrying out certain activities on behalf of your client.

a) Client appears to be living beyond their means or has unexplained sources of income.

b) Client's cheques and payments are inconsistent with their sales, such as receiving unusual payments from unlikely sources. c) Client frequently changes bookkeepers or accountants, often on an annual basis, or submits financial statements that are consistently late or contain numerous errors. d) Client is uncertain about the location of company records or is unwilling to disclose information about business operations or financial transactions during routine audits. e) The company reports non-existent or settled debt as current on financial statements or consistently overstates asset values while understating liabilities. f) The company has no employees, which is unusual for its type of business, and makes large cash transactions that are atypical for its industry. g) The company pays unusual consulting fees to offshore companies or issues large payments to subsidiaries or similarly controlled entities outside of normal business operations. h) Company records consistently reflect sales below cost, resulting in ongoing losses without a reasonable explanation for the sustained losses, or show unexplained fluctuations in revenue or expenses. i) Shareholder loans or loans to related parties are inconsistent with business activity, lacking proper documentation or clear business rationale. j) A review of source documents reveals misstatements of business activity that cannot be readily traced through the company's books. k) The company acquires significant personal and consumer assets, such as luxury cars or real estate, which are inconsistent with typical business practices or industry norms. l) The company engages in frequent transactions with shell companies, entities in jurisdictions known for secrecy, or countries with inadequate money laundering regulations. m) The client has complex corporate structures that obscure the true ownership of the company, or the company frequently changes its banking relationships without a clear business reason. n) The client requests adjustments to accounting practices that may be considered unethical or illegal, or the company engages in transactions that lack a clear business purpose.

8.8 Real Estate Agents, and Property Developers If you are in the real estate industry, consider the following indicators when you act as an agent in the purchase or sale of real estate.

a) Client arrives at a real estate closing with a substantial amount of cash, which is common in a cash-based economy but still raises concerns due to the large sum involved. b) Client purchases property in the name of a nominee, such as an associate or relative (other than a spouse), which may be an attempt to conceal the true ownership despite the cash-based nature of the transaction. c) Client avoids putting their name on any documents that would link them to the property or uses different names on purchase offers, closing documents, and deposit receipts, which can be suspicious even in a cash-driven environment. d) Client provides vague or inadequate explanations for last-minute changes in the purchasing party's name, potentially obscuring the transaction's true nature. e) Client negotiates a purchase at or above market value but records a lower value on official documents, with the difference paid "under the table," a practice that may be more common in cash-based economies but still problematic. f) Client sells property below market value with an additional payment made "under the table," a tactic that can be easier to conceal in cash transactions. g) Client makes the initial deposit with cash provided by a third party who is not a spouse or parent, raising questions about the source of funds even in a cash-based system. h) Client makes a large down payment in cash, with the remainder financed by an unusual source, potentially an informal lender or an offshore entity, which can be more challenging to trace in a cash economy. i) Client purchases personal-use property under a corporate name, which is inconsistent with typical business practices and may be an effort to obscure ownership in a cash-centric market. j) Client buys property without conducting an inspection, possibly indicating a lack of concern for the property's condition, which could signal ulterior motives in a cash transaction. k) Client acquires multiple properties in a short period, displaying little concern for the location, condition, or repair costs of each, which can be a red flag even in a cash-based market. l) Client pays rent or a lease amount upfront using a large sum of cash, which, while more common in cash economies, still warrants scrutiny due to the significant amount. m) Client is known to have paid large remodeling or home improvement invoices in cash, which, despite being normal in a cash economy, could still be a sign of trying to avoid traceable payments. n) Client insists on signing documents via fax only, which may suggest an attempt to avoid direct interaction or leave a minimal paper trail, a concern even in cash-based transactions.

o) Client repurchases a property they had recently sold, which could indicate potential layering of funds or other suspicious activities, even within the context of a cash economy.

8.9 Dealers in Precious Metals and Stones a) Large cash transactions or frequent high-value purchases and sales that do not align with the customer's known business profile. Rapid inventory turnover and high-value transactions that deviate from normal business operations. b) Purchases made with funds from unverifiable or unusual sources. Transactions involving intermediaries or structures designed to obscure the origin of the funds. c) Missing or incomplete documentation for transactions, such as invoices, receipts, or proof of purchase. Discrepancies between the reported value of items and the documentation provided. d) Hesitation or refusal to provide standard identification or business details. Transactions that do not match the customer's known business activities or financial status. e) Transactions involving high-value items that are inconsistent with the customer's stated financial capacity. Frequent transactions with items like gold, diamonds, or other high-liquidity goods that have low traceability. f) Shipping patterns that do not match the customer's business needs, or use of multiple addresses, especially in high-risk jurisdictions. g) Use of unconventional or non-traceable payment methods, such as prepaid cards or virtual currencies, for transactions involving high-value items. h) Transactions involving countries or regions known for money laundering or terrorism financing, or areas with weak regulatory oversight. i) Transactions involving entities that appear to be shell companies or front organizations with minimal legitimate business operations.

8.10 Casinos If you are engaged in the casino business, consider the following indicators. a) A client receives casino cheques made out to third parties or without a designated payee. b) A client requests that a winnings cheque be issued in the name of a third party. c) Acquaintances engage in even-money games, where it appears they are deliberately losing to one of the participants. d) A client attempts to avoid triggering a cash transaction report by breaking down the transaction into smaller amounts. e) A client requests cheque unrelated to gaming winnings.

f) A client inquiries about opening a casino account and transferring funds to other locations, even though they are not known as a regular, frequent, or high-volume player. g) A client buys a large number of chips with cash, engages in minimal gambling to give the impression of significant activity, and then cashes in the chips for a casino cheque. h) A client deposits money into slot machines and claims accumulated credits as a jackpot win. i) A client exchanges small denomination banknote for larger ones, chip purchase vouchers, or cheques. j) A client is known to use multiple names or aliases. k) A client requests that winnings be transferred to a third party's bank account, a known drug-source country, or a country with weak anti-money laundering regulations. l) A client frequently buys in and cashes out without engaging in substantial gambling activity, which could indicate money laundering. m) A client insists on paying large amounts in cash despite other available payment methods. n) A client frequently exchanges large sums of foreign currency for chips without corresponding gambling activity. o) A client exhibits unusual behavior, such as nervousness or reluctance, when asked for identification or during large transactions that require reporting. p) A client engages in consecutive transactions, such as cashing out chips immediately after purchasing them, without participating in any gaming. q) A client uses multiple casino accounts or player cards under different names to carry out transactions. r) A client refuses to provide personal information or gives inconsistent details when opening an account or conducting large transactions. s) A client regularly transfers funds between multiple casino locations or across borders, which is inconsistent with their usual gambling patterns. t) A client arranges for large deposits into a casino account from unknown or offshore sources. u) A client frequently requests the transfer of funds from their casino account to unrelated third parties or foreign accounts without clear justification. v) A client uses intermediaries, such as friends or family members, to conduct large transactions on their behalf. w) A client shows an unusual interest in the casino's reporting thresholds and anti-money laundering procedures. x) A client makes large cash purchases of gift cards, vouchers, or other non- gaming products, which could be a means of laundering money. y) A client requests to exchange chips for multiple small denomination cheques instead of one large cheque, possibly to avoid detection.

z) A client engages in patterns of activity suggesting collusion with other players, such as consistently winning or losing to specific individuals.

Please also consult the AML/CFT guidelines for the gambling sector issued by the Lotteries and Gaming Regulatory Board Uganda on its website.

8.11 Legal Professionals

8.11.1 The client a) is involved in transactions which do not correspond to his normal professional or business activities b) shows he does not have a suitable knowledge of the nature, object or the purpose of the professional performance requested c) wishes to establish or take over a legal person or entity with a dubious description of the aim, or a description of the aim which is not related to his normal professional or commercial activities or his other activities, or with a description of the aim for which a license is required, while the customer does not have the intention to obtain such a licence d) frequently changes legal structures and/or managers of legal persons e) asks for short-cuts or unexplained speed in completing a transaction f) appears very disinterested in the outcome of the retainer g) requires introduction to financial institutions to help secure banking facilities h) Creation of complicated ownership structures when there is no legitimate or economic reason. i) Involvement of structures with multiple countries where there is no apparent link to the client or transaction, or no other legitimate or economic reason. j) Incorporation and/or purchase of stock or securities of several companies, enterprises or legal entities within a short period of time with elements in common (one or several partners or shareholders, director, registered company office, corporate purpose etc.) with no logical explanation. k) There is an absence of documentation to support the client's story, previous transactions, or company activities. l) There are several elements in common between a number of transactions in a short period of time without logical explanations. m) Back to back property transactions, with rapidly increasing value or purchase price. n) Abandoned transactions with no concern for the fee level or after receipt of funds. o) There are unexplained changes in instructions, especially at the last minute.

p) The retainer exclusively relates to keeping documents or other goods, holding large deposits of money or otherwise using the client account without the provision of legal services. q) There is a lack of sensible commercial/financial/tax or legal reason for the transaction. r) There is increased complexity in the transaction or the structures used for the transaction which results in higher taxes and fees than apparently necessary. s) A power of attorney is sought for the administration or disposal of assets under conditions which are unusual, where there is no logical explanation. t) Investment in immovable property, in the absence of any links with the place where the property is located and/ or of any financial advantage from the investment. u) Litigation is settled too easily or quickly, with little/no involvement by the legal professional retained. v) Requests for payments to third parties without substantiating reason or corresponding transaction.

8.11.2 The Parties a) The parties or their representatives (and, where applicable, the real owners or intermediary companies in the chain of ownership of legal entities), are native to, resident in or incorporated in a high-risk country b) The parties to the transaction are connected without an apparent business reason. c) The ties between the parties of a family, employment, corporate or any other nature generate doubts as to the real nature or reason for the transaction. d) There are multiple appearances of the same parties in transactions over a short period of time. e) The age of the executing parties is unusual for the transaction, especially if they are under legal age, or the executing parties are incapacitated, and there is no logical explanation for their involvement. f) There are attempts to disguise the real owner or parties to the transaction. g) The person actually directing the operation is not one of the formal parties to the transaction or their representative. h) The natural person acting as a director or representative does not appear a suitable representative. i) The transaction involves a disproportional amount of private funding, bearer cheques or cash, especially if it is inconsistent with the socio-economic profile of the individual or the company's economic profile. j) The client or third party is contributing a significant sum in cash as collateral provided by the borrower/debtor rather than simply using those funds directly, without logical explanation. The source of funds is unusual:

k) Third party funding either for the transaction or for fees/taxes involved with no apparent connection or legitimate explanation l) funds received from or sent to a foreign country when there is no apparent connection between the country and the client m) funds received from or sent to high-risk countries. n) The client is using multiple bank accounts or foreign accounts without good reason. o) Private expenditure is funded by a company, business or government. p) Selecting the method of payment has been deferred to a date very close to the time of notarization, in a jurisdiction where the method of payment is usually included in the contract, particularly if no guarantee securing the payment is established, without a logical explanation. q) An unusually short repayment period has been set without logical explanation. r) Mortgages are repeatedly repaid significantly prior to the initially agreed maturity date, with no logical explanation. s) The asset is purchased with cash and then rapidly used as collateral for a loan. t) There is a request to change the payment procedures previously agreed upon without logical explanation, especially when payment instruments are suggested which are not appropriate for the common practice used for the ordered transaction. u) Finance is provided by a lender, either a natural or legal person, other than a credit institution, with no logical explanation or economic justification. v) The collateral being provided for the transaction is currently located in a high-risk country. w) There has been a significant increase in capital for a recently incorporated company or successive contributions over a short period of time to the same company, with no logical explanation. x) There has been an increase in capital from a foreign country, which either has no relationship to the company or is high risk. y) The company receives an injection of capital or assets in kind which is notably high in comparison with the business, size or market value of the company performing, with no logical explanation. z) There is an excessively high or low price attached to the securities transferred, with regard to any circumstance indicating such an excess (e.g. volume of revenue, trade or business, premises, size, knowledge of declaration of systematic losses or gains) or with regard to the sum declared in another operation. aa) Large financial transactions, especially if requested by recently created companies, where these transactions are not justified by the corporate

purpose, the activity of the client or the possible group of companies to which it belongs or other justifiable reasons.

8.11.3 The Choice of Lawyer a) Instruction of a legal professional at a distance from the client or transaction without legitimate or economic reason. b) Instruction of a legal professional without experience in a particular specialty or without experience in providing services in complicated or especially large transactions. c) The client is prepared to pay substantially higher fees than usual, without legitimate reason. d) The client has changed advisor a number of times in a short space of time or engaged multiple legal advisers without legitimate reason. e) The type of operation being notarized is clearly inconsistent with the size, age, or activity of the legal entity or natural person acting. f) The required service was refused by another professional or the relationship with another professional was terminated.

8.11.4 Nature of the Retainer a) the transactions are unusual because of their size, nature, frequency, or manner of execution b) there are remarkable and highly significant differences between the declared price and the approximate actual values in accordance with any reference which could give an approximate idea of this value or in the judgement of the legal professional c) a non-profit organisation requests services for purposes or transactions not compatible with those declared or not typical for that body.

8.12 Virtual Assets Service Providers (VASPs) a) Customers willing to pay extra transaction fees for VAs with enhanced anonymity features. b) Customers accessing digital platforms of Virtual Asset Service Providers (VASPs) and Initial Token Offerings (ITOs) using anonymous Internet protocol (IP) addresses, such as those provided by the Onion router, I2P, or dark web IP addresses. c) Receiving or sending funds to VASPs and ITOs with inadequate or absent Customer Due Diligence (CDD) or Know Your Customer (KYC) requirements. d) Utilizing decentralized/un-hosted, hardware, or paper wallets for cross- border VA transfers. Decentralized VA systems pose higher anonymity risks compared to centralized systems, where some risks are mitigated.

e) Engaging in transactions that use mixing and tumbling services, suggesting an attempt to conceal the flow of illicit funds between known wallet addresses and darknet marketplaces. f) Unusual volumes of VAs cashed out at exchanges from peer-to-peer (P2P) platform-associated wallets without a plausible business rationale. g) VA vendors that facilitate VA transactions via terminals pose a higher risk, especially if the machine or kiosk is situated in a high-risk area and used for frequent small transactions. h) Structuring VA transactions (e.g., exchanges or transfers) in small amounts or below record-keeping/reporting thresholds, similar to cash transaction structuring. i) Performing multiple high-value transactions in rapid succession, such as within 24 hours, in a staggered and regular pattern, with no further transactions recorded for a long period thereafter. This pattern is often seen in ransomware cases related to VAs or in newly created or previously inactive accounts. j) Making a substantial initial deposit to start a new relationship with a VASP that is inconsistent with the customer profile. k) Making a large initial deposit to open a new relationship with a VASP and using the entire deposit for trading on the same day or the day after, or withdrawing the full amount the day after. l) A new user attempting to trade or withdraw the entire balance of VAs from the platform. m) Making frequent large transfers within a specified period (e.g., a day, week, month) to the same VA account by multiple individuals or from the same IP address. n) Conducting VA-to-fiat currency exchanges at a potential loss. o) Creating separate accounts under different names to bypass trading or withdrawal limits imposed by VASPs. p) Providing incomplete or insufficient KYC information or refusing to provide KYC documents or respond to inquiries about the source of funds. q) The sender or recipient being unaware of or providing inaccurate information regarding the transaction, source of funds, or relationship with the counterparty. r) Providing identification or account credentials that are shared with another account. s) Discrepancies between the IP addresses associated with the customer's profile and those used to initiate transactions. t) Transacting with VA addresses linked to known fraud, extortion, ransomware schemes, sanctioned addresses, darknet marketplaces, or other illicit websites. u) VA transactions originating from or directed to online gambling services.

v) Using one or more credit/debit cards linked to a VA wallet to withdraw large amounts of fiat currency (crypto-to-plastic), or funding VA purchases with cash deposits into credit cards. w) Deposits into a VA address significantly higher than usual, with an unknown source of funds, followed by conversion to fiat currency, potentially indicating theft. x) Lack of transparency or insufficient information about the origin and ownership of funds, such as using shell companies or funds deposited into an ITO where investor personal data may be unavailable, or transactions involving online payment systems with credit/pre-paid cards followed by instant withdrawals. y) Funds sourced directly from third-party mixing services or wallet tumblers. z) The majority of a customer's wealth originating from investments in fraudulent VAs or ITOs. aa) A disproportionate portion of a customer's wealth coming from VAs or Virtual Tokens from other VASPs or ITOs with weak AML/CFT controls. bb) Criminals might exploit gaps in AML/CFT regulations applicable to the VA sector by moving illicit funds to VASPs or ITOs in jurisdictions with minimal or non-existent AML/CFT regulations. cc) These jurisdictions may lack licensing/registration requirements, have not extended Suspicious Transaction Reporting (STR) obligations to VA activities, or have not implemented comprehensive preventive measures.

Note: These red flag indicators are subject to change and should be considered within the appropriate context.

9.0 INDICATORS RELATED TO PREDICATE OFFENCES

9.1 Cyber Crimes a) Use of sophisticated technology or methods to conceal transaction origins. b) Unusual patterns of behavior, such as rapid shifts in transaction types or volumes. c) Transactions involving cryptocurrencies or other digital assets. d) Transactions with high-risk jurisdictions or anonymous entities. e) Frequent changes to account details or contact information. f) Sudden and unexplained increases in account activity. g) Transactions involving high-value goods or services with no clear economic purpose. h) Use of shell companies or entities to facilitate transactions. i) Transactions involving large volumes of data or information exchange. j) Use of anonymizing tools or services to hide transaction details. k) Transaction volume deviates from the client's typical profile.

l) The explanation for funds received is illogical or economically unreasonable. m) Frequent cross-border transactions. n) No connection between the client and the transaction counterparties. o) Counterparty requests funds to be recalled shortly after receipt. p) Extensive use of mobile banking applications. q) Large fund transfers followed by immediate ATM withdrawals. r) Client is mentioned in adverse media reports related to cybercrime. s) Recently opened account receives large deposits, followed by immediate withdrawals. t) Multiple methods of transferring funds-bank to mobile money wallet, agency banking, credit and debit cards-within the same timeframe. u) Cash withdrawals from various ATMs. v) Unspecified relationship between sender and receiver. w) Transfer purpose does not align with the account's intended use. x) Unknown relationship between counterparty and client. y) Transactions from the counterparty lack economic rationale and do not match the account's stated purpose. z) Involvement in online fraud schemes, such as phishing or identity theft. aa) Transactions with frequent or unusual changes in account beneficiaries. bb) Use of complex financial structures or transactions to obscure the source of funds.

9.2 Tax Crime Indicators a) Significant discrepancies between reported income and actual financial activity. b) Discrepancies or inconsistencies between financial records and tax filings. c) Discrepancies between financial statements, tax filings, and other financial documents. d) Turnover on the account not matching expected levels based on the stated occupation or intended use of the account. e) Transactions involving large amounts of cash or assets that do not align with the declared income. f) Large cash transactions or deposits inconsistent with the individual's known business or financial activities. g) Frequent, large withdrawals or deposits in personal or business accounts inconsistent with reported income. h) Sudden large deposits in accounts with no clear justification. i) Transactions for amounts significantly different from previous transaction patterns. j) Frequent large transfers between personal and business accounts or between different banks.

k) Commercial/business transactions conducted through a personal or individual account. l) Use of complex corporate structures, offshore entities, or layered transactions to obscure the source of funds or facilitate tax evasion. m) Involvement in high-risk financial instruments or investments prone to misuse for laundering purposes. n) Investments in or transfers to offshore accounts or entities, particularly in jurisdictions known for banking secrecy or lax regulations. o) Use of various channels to conduct transactions on the account to create complex transaction patterns. p) Accumulation of significant wealth or assets without a clear, legal source of income. q) Purchasing high-value assets such as real estate, vehicles, or luxury items that do not align with reported income. r) Unexplained loans or debts with no clear business purpose or repayment plan, especially when linked to tax evasion. s) Transactions or business practices that are atypical for the industry or sector. t) Sudden and unexplained changes in the scale or scope of business operations. u) Use of shell companies to funnel funds or disguise ownership of assets. v) Documentation that does not make economic sense. w) Excessive or suspicious claims for deductions or credits that are inconsistent with the taxpayer's profile. x) Patterns such as a sudden increase in deductions or credits that do not correspond with the taxpayer's known activities or business growth. y) Adverse media reports related to the account holder or the business. z) Patterns of financial behavior, such as unusual frequency or size of transactions, that do not align with the business's profile. aa) Using multiple bank accounts or financial institutions to conduct transactions in a way that complicates tracking and reporting. bb) Misclassifying transactions or income to evade taxes or disguise the nature of financial activities. cc) Using business funds for personal expenses or vice versa, indicating possible tax evasion.

9.3 Ponzi and Illegal Pyramid Schemes a) Promises of unusually high or guaranteed returns on investment, which are often unrealistic and not aligned with market norms. b) Use of complex or opaque investment structures to obscure the flow of funds and the actual business activities.

c) Large or frequent deposits of cash or checks into accounts with no clear source of income or business purpose. d) Sudden and unexplained growth in the volume of transactions or the balance of accounts associated with the scheme. e) High volumes of transactions, especially involving large sums of money or frequent transfers between accounts. f) Use of multiple bank accounts or financial institutions to deposit or withdraw funds, making it difficult to trace the money flow. g) Large cash transactions or deposits that are inconsistent with the account holder's known business activities or income levels. h) Frequent withdrawals or transfers of large amounts of money shortly after deposits, often to different accounts or individuals. i) Use of unconventional payment methods or financial instruments, such as prepaid cards, money orders, or digital currencies, to move funds. j) Absence or inadequacy of documentation supporting the legitimacy of transactions or investments. k) Failure to disclose or provide clear information about the risks associated with the investment. l) Reluctance or refusal of the scheme operators to provide information or details about the business operations or financial status. m) Frequent changes in the pool of investors, with new investors continually being recruited to pay returns to earlier investors. n) Transactions involving individuals or entities with no clear connection to the scheme's purported business activities. o) Negative media coverage or reports indicating potential fraud or financial misconduct associated with the scheme. p) Use of high-pressure sales tactics to recruit new investors or encourage existing investors to reinvest. q) Discrepancies between the financial reports or statements provided by the scheme and the actual financial transactions. r) Use of unregistered or unregulated investment vehicles or entities that are not subject to regulatory oversight. s) Patterns of payments that do not align with typical business transactions or investment practices, such as large, irregular payments. t) Claims made by investors or operators that cannot be independently verified or validated. u) High rates of recruitment of new participants or investors, often incentivized by commissions or bonuses. v) Use of nominees or intermediaries to hide the true identity of the scheme's operators or investors. w) Frequent changes in the terms or conditions of investments or payouts, often to maintain the appearance of legitimacy.

x) Difficulty or delays in redeeming investments or withdrawing funds, often used to delay the detection of fraudulent activities.

9.4 Corruption a) Transactions involving public officials or their close associates, especially those with unexplained wealth or assets. b) Unexplained payments or transfers to or from entities associated with known corruption scandals. c) Use of intermediaries or third parties to conduct transactions on behalf of the customer, especially when these intermediaries have no clear business connection. d) Frequent use of consultants or agents whose services are not clearly justified. e) Payments made to entities or individuals in jurisdictions known for lax anti- corruption measures. f) Transactions that appear to be bribes or kickbacks disguised as legitimate business expenses. g) Transactions related to government contracts or tenders where the payment amounts are unusually high or where there are discrepancies in contract details. h) Large payments to contractors or suppliers with no clear business connection to the services rendered. i) Use of off-shore accounts or jurisdictions with strong banking secrecy laws to funnel proceeds of corruption. j) Transactions involving cryptocurrencies or other digital assets that are used to obscure the source of funds. k) Individuals whose lifestyle (e.g., expensive cars, luxury properties) is inconsistent with their known income and source of wealth. l) Rapid accumulation of assets or property without a clear explanation or source of income. m) Frequent, large transfers to foreign accounts or entities with no apparent business relationship or justification. n) Transactions with jurisdictions that are known for high levels of money laundering or financial secrecy. o) Financial transactions involving PEPs where there is a lack of transparency or legitimacy regarding the source of funds. p) Transactions involving the transfer of large sums of money by PEPs to or from accounts that do not match their known business or personal profile. q) Regular large cash transactions that do not correspond with the business's revenue or personal financial activity. r) Cash deposits that are structured to avoid detection or reporting thresholds. s) Transactions where documentation is missing, incomplete, or appears to be falsified.

t) Payments for services or goods that lack proper invoices or documentation. u) Large cash deposits or withdrawals that are inconsistent with the customer's known business or personal profile. v) Frequent, large cash transactions that are just below reporting thresholds. w) Transactions that do not align with the nature of the customer's business or source of funds. x) Businesses that primarily deal in cash but show large, unexplained deposits in bank accounts. y) Use of multiple layers of shell companies, trusts, or nominee shareholders to obscure the true ownership of funds. z) Frequent changes in the ownership structure of entities without a clear business rationale. aa) Transactions involving high-value assets or investments that are inconsistent with the customer's financial profile. bb) Transactions with no clear economic purpose or business rationale.

9.5 Trafficking in Persons (TiP)

A. Generic Business Patterns a) Cash-based businesses potentially used to exploit victims and funnel unexplained funds, such as cleaning services, car washes, nail bars, restaurants, and agriculture. b) Patterns of connected businesses deliberately set up to exploit individuals. c) Business output that is disproportionate to the size and staffing levels. d) Businesses at risk of insolvency, which are vulnerable to manipulation by criminals. e) Adverse media coverage on the client or linked individuals. f) Abuse of client account terms and conditions. g) The presence of multiple accounts or corporate structures. h) The use of shell companies with unclear purposes. i) Involvement of legal professionals in transactions that typically do not require them.

B. Unusual Business Activity a) Clients with a diverse portfolio in high-risk industries such as construction, takeaways, and care agencies. b) Unusually complex business structures. c) Unclear or opaque beneficial ownership. d) Unclear sources of funds or wealth. e) Falsification of documents on behalf of clients. f) Evasiveness or reluctance to provide necessary documentation.

C. Unusual Payment Systems and Financial Flows a) Extended family involvement in businesses or transactions, with large portions of funds paid to family members. b) Multiple payments from various companies to the same account, overlapping with wage receipts from different employers during the same period. c) Payments diverted through various countries to reach the final destination. d) Evidence of cash transfers to high-risk countries, particularly through Informal Value Transfer Systems (IVTS) and money service businesses (MSBs).