Money laundering rarely begins with an obvious red flag. More often, it reveals itself through patterns of behaviour, inconsistencies, evasiveness, unusual urgency or unexplained complexity.

One of the most common challenges we see when supporting regulated firms is defining what actually constitutes suspicious behaviour in practice. For financial services firms, recognising behavioural indicators is critical. Suspicion does not require proof; it requires reasonable grounds to suspect.

One simple and memorable way to assess potential money laundering risk is to apply a behavioural lens using the acronym RECUR:

Reluctance
Evasiveness
Confusing
Unclear
Risky

Let’s explore how this framework can support frontline staff, compliance teams and senior management in identifying suspicious activity.

R: Reluctance

Reluctance often surfaces early in a client relationship.

Warning signs include:

  • Hesitation to provide standard CDD documentation.
  • Resistance to source of funds or source of wealth questions.
  • Reluctance to meet face-to-face (where expected).
  • Delayed responses to compliance queries.
  • Pressure to “skip” due diligence steps.

While some clients may be privacy conscious, persistent reluctance around routine regulatory checks should prompt enhanced scrutiny. Reluctance becomes particularly concerning when paired with urgency – for example, a client eager to transact quickly but unwilling to provide supporting evidence.

E: Evasiveness

Evasive clients provide answers, but not complete ones.

Indicators include:

  • Indirect responses to straightforward questions.
  • Changing explanations about ownership structures.
  • Avoiding discussion of beneficial owners.
  • Overly defensive reactions to routine compliance enquiries.
  • Providing excessive documentation that fails to answer the question asked.

Evasiveness is often a behavioural indicator of underlying concealment. Staff should be trained not only to collect documentation, but to apply judgement and assess whether responses genuinely address the risk being queried.

C: Confusing transactions or structures

Complexity is not automatically suspicious, but unnecessary complexity can be.

Red flags include:

  • Multi-layered offshore structures without commercial rationale.
  • Frequent movement of funds between connected accounts.
  • Use of third parties with no obvious relationship to the client.
  • Circular transactions.
  • Sudden changes in transaction size or frequency.

Money launderers often rely on confusion to obscure audit trails. If a structure or transaction pattern cannot be clearly explained in plain language, it warrants further investigation.

Frontline staff should feel empowered to challenge complexity. Where a structure or transaction cannot be clearly explained in plain language, this should trigger further scrutiny.

U: Unclear source of funds or wealth

A core pillar of anti-money laundering compliance is understanding where money comes from.

Warning signs include:

  • Vague explanations such as “investments” or “consulting”.
  • Inability to evidence business income.
  • Large cash deposits inconsistent with profile.
  • Funds originating from high-risk jurisdictions.
  • Discrepancies between declared occupation and asset level.

An unclear economic rationale is one of the most common weaknesses identified in enforcement action. If a client’s wealth story changes over time or does not align with documentation, that is a material red flag.

R: Risky behaviour or jurisdictional exposure

The final “R” captures broader contextual risk and the client’s overall risk profile. A willingness to take unusually high levels of risk, including an apparent acceptance of losses, can be a red flag and may indicate an attempt to normalise suspicious activity.

This category also captures wider risk factors that increase the overall risk exposure of the client. Where a high‑risk client is also exhibiting other indicators of suspicion, firms should take a holistic view when assessing potential money laundering risk.

Examples include:

  • Politically exposed persons (PEPs).
  • Sanctions exposure.
  • Links to high-risk industries.
  • Connections to jurisdictions with weak AML controls.
  • Adverse media suggesting fraud, corruption or criminal investigation.

Risk does not automatically equate to suspicion, but it does raise the level of scrutiny and judgement required.

Why RECUR matters

The purpose of RECUR is not to replace formal AML frameworks. It is to provide a practical behavioural lens for identifying when something “doesn’t feel right.”

Financial services firms must ensure:

  • Staff are trained to recognise behavioural red flags.
  • Concerns are escalated promptly to the MLRO.
  • Suspicious Activity Reports (SARs) are filed where appropriate.
  • Documentation supports decision-making.
  • Tipping-off risks are avoided.

Regulators expect firms to apply judgement, not simply follow a tick‑box approach.

Final thought

Money laundering risk often hides behind normality. Clients may appear professional, articulate and credible, until behaviour patterns reveal otherwise. Where these factors recur, firms should pause and reassess the risk position.

In regulated financial services, vigilance is not optional. It is a core responsibility.

How fscom can help

fscom supports firms to embed practical frameworks such as RECUR, helping teams recognise, assess and respond to suspicious behaviour in a proportionate, regulator‑ready way.

 We deliver bespoke training, strengthen AML frameworks, support MLROs with complex decision-making and help firms evidence clear, proportionate and defensible approaches to financial crime risk. If you need any help with reviewing or enhancing your financial crime framework, training your teams or managing complex suspicious activity, please get in touch.

This post contains a general summary of advice and is not a complete or definitive statement of the law. Specific advice should be obtained where appropriate.