CRF ¦ Update of the goAML Indicators

A clearer route from red flags to predicate offences in Luxembourg AML reporting

A stronger connection between suspicious activity reporting and financial crime analysis is taking shape in Luxembourg. The Financial Intelligence Unit’s revised indicator framework gives reporting entities a structured way to describe why a transaction or relationship appears suspicious, how suspected criminal proceeds may have moved, and which underlying offence may be involved.

The approach is important because money laundering rarely presents itself as an isolated transaction. It is more often visible through a combination of unexplained wealth, concealed ownership, unusual payment flows, inconsistent documentation, and links to sectors or jurisdictions carrying heightened risk. A reporting framework that captures these elements in a consistent manner can improve both the quality of individual reports and the FIU’s ability to identify broader typologies.

The indicators are available in goAML and cover triggers of suspicion, money laundering and terrorist financing typologies, affected sectors, products, suspected persons or entities, predicate offences, suspicious amounts, timing, relationship status, and specific risks involving crypto-assets and e-commerce. Several indicators may be selected when they are supported by the facts.

The predicate offence should remain central

The central analytical question in many reports is not only how funds were moved, but what criminal conduct may have generated or enabled them. The framework therefore includes a dedicated category for suspected predicate offences.

This category covers corruption and bribery, embezzlement of public funds, fraud, drug trafficking, tax crime, organised crime, sanctions evasion, trafficking in human beings, environmental crime, theft, weapon trafficking, terrorism and terrorist financing, and other offences. Money laundering itself is also included where the facts support that suspicion.

Reporting entities are encouraged to identify one or more suspected predicate offences whenever possible. The offence should relate directly to the suspicion described in the report. It is not necessary for the suspected offence to have been committed through the reporting entity’s own product. For example, a bank may report funds suspected to derive from corruption committed through public procurement, even if the proceeds enter the bank through an unrelated investment account. Likewise, a payment institution may identify fraud against individuals as the suspected predicate offence when its customer appears to be receiving and dispersing scam proceeds.

The reporting obligation does not require the reporting entity to establish the offence conclusively or assign a definitive legal qualification. Suspicion, knowledge, or reasonable grounds for suspicion are sufficient within the applicable legal framework. The role of the reporting entity is to present the relevant facts, explain the connection between those facts and the suspected criminal conduct, and provide supporting information and documents.

Bastian Schwind-Wagner _Follow

"Effective suspicious activity reporting depends on more than identifying unusual transactions. Reporting entities should connect red flags such as concealed ownership, unexplained wealth, complex transfers, suspicious loans, or rapid movement of funds to the suspected money laundering method and, where possible, the underlying predicate offence.

A structured indicator framework can improve the clarity and consistency of reports while helping financial intelligence authorities identify patterns across sectors and products. Its value depends on factual accuracy, careful calculation of suspicious amounts, and a clear distinction between established facts, reasonable grounds for suspicion, and unverified allegations."

Money laundering indicators should be read as a chain

A single red flag rarely proves money laundering. Its value often lies in how it connects with other facts.

Beneficial ownership concerns, for example, may become more significant when combined with offshore companies, nominee directors, unexplained intercompany loans, and property purchases that do not correspond to the customer’s stated business. Similarly, frequent low-value transfers may appear harmless individually but become significant when they are received from multiple unrelated individuals, followed by immediate cash withdrawals or purchases of easily transferable goods.

The framework distinguishes between the initial trigger and the broader pattern identified during review. Relevant indicators should not be limited to the event that first generated the alert. If subsequent analysis identifies inconsistencies in the source of funds, the use of a transit account, third-party control, or a suspected money mule arrangement, those elements should also be reflected in the report.

This distinction supports a more complete account of the suspected laundering process. It helps the FIU assess whether the activity resembles placement, layering, or integration, while avoiding the assumption that every case will fit neatly into one stage.

Concealed ownership and complex structures

Concealment of beneficial ownership remains a recurring feature of laundering schemes. The use of companies, trusts, holding structures, intermediaries, and accounts in several jurisdictions may make it difficult to identify the person who ultimately owns or controls the assets.

A complex money laundering scheme is not defined solely by the number of entities or transactions involved. Complexity arises when structures and transfers are deliberately arranged to obscure the origin, ownership, or destination of funds. Layering may involve transfers between related companies, intercompany loans without a credible commercial purpose, investments through offshore entities, and purchases of assets in the name of third parties.

Real estate is particularly relevant in this context. Property can absorb substantial amounts of value, provide an appearance of legitimacy, and enable the conversion of suspicious funds into an asset that may later be sold or used as collateral. Purchases at prices significantly above market value, funding from opaque jurisdictions, or a mismatch between the customer’s wealth and the value of the property should be considered alongside ownership and source-of-funds concerns.

The affected sector may extend beyond the reporting entity’s own industry. A bank reporting suspicious financing of a property acquisition may need to identify both banking and real estate as affected sectors. This distinction helps authorities understand where the suspected laundering activity occurs rather than merely where it was detected.

Fraud as a predicate offence and laundering mechanism

Fraud is both a major source of criminal proceeds and a method used to obtain access to accounts, payment instruments, and personal information.

The indicators cover scams involving individuals and legal entities, breach of trust, exploitation of vulnerability, subsidy and benefit fraud, fraudulent bankruptcy, misuse of company assets, and cyber-enabled fraud. Phishing, pharming, impersonation, account takeover, and online investment scams may appear as triggers, typologies, or evidence of a specific predicate offence depending on the circumstances.

A common pattern involves a newly opened payment or e-money account receiving funds from several individuals within a short period. The funds may be described with vague references, withdrawn rapidly, transferred onward, or converted into gift cards and high-value goods. If the account holder has no credible business explanation and the senders appear to be fraud victims, the facts may indicate both fraud against individuals and the use of a money mule.

The distinction between customer behaviour and transaction behaviour is useful. Evasive conduct, repeated changes to personal information, or refusal to provide documents may point to unusual customer behaviour. Structured deposits, rapid transfers, or movements to high-risk jurisdictions point instead to a suspicious transaction pattern. Both can be relevant in the same case.

Suspicious loans and misuse of legal entities

Loans can be used to create a legitimate-looking explanation for the movement of funds while transferring value between connected parties. Warning signs include loans with no evident economic purpose, unrealistic repayment terms, no collateral where collateral would normally be expected, zero or below-market interest, and lending to a beneficial owner or related party without proper authority.

The risk increases where the borrower has no real commercial activity, shares directors or owners with the lender, or receives funds that are quickly transferred into real estate, luxury assets, or another jurisdiction. Backdated agreements and counterparties with no apparent business operations may further undermine the stated explanation.

Legal entities and legal arrangements can support legitimate commercial activity, but they may also conceal ownership, separate funds from their criminal source, and complicate the tracing of assets. The existence of an offshore company is not, by itself, evidence of criminality. Its significance depends on the wider facts, including the rationale for its use, the transparency of its ownership, the nature of its transactions, and the customer’s ability to substantiate the source of funds and wealth.

Crypto-assets add specific laundering risks

Crypto-assets introduce additional routes for moving and obscuring value. Relevant indicators include transactions involving darknet markets, mixers, privacy-enhancing services, CoinJoin arrangements, fraudulent wallet addresses, malicious smart contracts, and the immediate withdrawal of newly deposited assets.

Rapid movement from a crypto deposit to an external wallet can be significant when combined with links to fraud, sanctions evasion, stolen assets, or darknet activity. Transactions involving gambling, gaming, and non-fungible token platforms may also require closer analysis where the activity is inconsistent with the customer’s profile or appears designed to convert or disperse value.

The use of crypto-assets should not automatically be treated as a predicate offence. It is generally better analysed through the product, affected sector, typology, and specific crypto indicators, while the suspected predicate offence is selected according to the underlying conduct. For example, stolen crypto-assets may point to theft, while funds linked to a darknet drug market may support drug trafficking. The relevant laundering concern should then be described separately.

Reporting suspicious amounts accurately

The suspicious amount should represent the value of the transactions or activities giving rise to suspicion, not the customer’s entire transaction volume. Incoming and outgoing movements linked to the same activity should not be counted twice.

If a money mule receives EUR 10,000 and transfers the same funds onward, the suspicious amount is EUR 10,000 rather than EUR 20,000. Similarly, if suspicious proceeds are later used to purchase property, vehicles, or jewellery, the calculation should normally focus on the initial suspicious amount rather than adding every subsequent movement of the same funds.

The same principle applies to attempted transactions. Where a suspicious transfer was attempted but not completed, the intended amount may still be relevant. Accurate calculation matters because the amount helps authorities prioritise cases and compare activity across reports.

Better reporting requires factual precision

Structured indicators do not replace a clear narrative. They work best when the report explains who was involved, what happened, when it happened, how funds moved, why the activity is inconsistent with the customer profile, and which criminal conduct may be connected to the funds.

Descriptions should distinguish confirmed facts from assumptions. A report can state that ownership information was incomplete, that documents appeared inconsistent, that a loan lacked commercial terms, or that open-source information linked a person to corruption allegations. It should avoid presenting unverified allegations as established facts.

The report should also identify the relevant roles of the persons and entities involved. These may include the account holder, investor, shareholder, transaction counterparty, third-party individual, underlying client, or ultimate beneficial owner. Correctly describing those roles can clarify the relationship between the customer, the suspected offender, and the assets or transactions under review.

A collaborative reporting model

The value of the framework lies in its shared language. Reporting entities can use it to organise their analysis and communicate suspicion more consistently, while the FIU can process reports more efficiently, compare cases, identify emerging patterns, and focus resources on higher-risk activity.

The approach also reinforces an important legal principle: all suspicious transactions, including attempted transactions, should be reported without regard to a minimum amount where the relevant reporting threshold is met through knowledge, suspicion, or reasonable grounds for suspicion. A reporting entity does not need to prove the predicate offence before filing.

Effective reporting is therefore not a matter of selecting the largest number of indicators. It is a matter of selecting the indicators that are supported by the facts and linking them to a coherent explanation of the suspected money laundering, predicate offence, or related financial crime. When that connection is clear, structured data becomes more than an administrative tool – it becomes a practical bridge between frontline detection and financial crime intelligence.

Dive deeper

• Celulle de renseignement financier (CRF) ¦ Update of the goAML Indicators ¦ Link