TBML Red Flags: FATF Indicators and FinCEN FIN-2025-A003

Trade-based money laundering (TBML) hides the movement of illicit funds inside what looks like ordinary trade. Two primary documents give practical red flags: the March 2021 risk indicators from the Financial Action Task Force (FATF) and the Egmont Group of Financial Intelligence Units, and the August 2025 advisory from the US Financial Crimes Enforcement Network (FinCEN) on Chinese money laundering networks. This guide walks through both and shows how to use them without over-reading a single flag. For the wider course topic, see our overview of trade-based money laundering.

The FATF and Egmont risk indicators

According to the FATF, the document Trade-Based Money Laundering: Risk Indicators was published on 11 March 2021 and prepared by the FATF and the Egmont Group. It supplements their December 2020 report Trade-Based Money Laundering: Trends and Developments and is meant to help public and private bodies spot possible TBML. In substance, it treats TBML as criminals using trade transactions to move money rather than goods, so the trade is the vehicle for moving illicit funds.

The indicators are grouped into four areas: the structure of the business, trade activity, trade documents and commodities, and account and transaction activity. By our count of the PDF there are 12, 7, 8 and 8 indicators in those groups respectively, and the document itself says the list is not exhaustive.

Structural indicators

These look at who is behind the trade. Examples in the document include an ownership structure that is unusually complicated or makes little sense, a registration at a mass-registration-style address such as a post office box or dense residential building with no unit given, very few staff or no routine operating costs such as payroll and tax relative to claimed trade volume, owners or managers who appear to be figureheads, and an address tied to a service provider that manages many shell companies. It also lists a trade entity whose name closely imitates a well-known corporation.

Trade activity indicators

These test whether the trade makes commercial sense. Examples include trade that does not match the stated line of business, such as a car dealer exporting clothing, consistently unreasonably low margins, purchases that exceed the entity's apparent financial capacity and are funded by sudden cash deposits or third-party transfers, and a newly formed or recently revived company suddenly conducting high-value trade in sectors with high barriers to entry. Shipping routes or transport methods that depart from standard practice in the sector are also listed.

Trade document and commodity indicators

These focus on the paperwork. Examples include invoices, contracts and payment details that conflict, prices or fees out of line with market value or earlier comparable transactions, missing or apparently counterfeit documents, documents altered repeatedly or resubmitted after rejection, shipments that pass through several jurisdictions without a commercial reason, contracts that look like generic templates despite a complex trade, and declared import or export values that do not match the volume of the related foreign bank transfers.

Account and transaction indicators

These cover what happens to the money. Examples include last-minute changes to payment arrangements, such as redirecting funds to a previously unknown party, an account that behaves like a pass-through with fast high-volume movement and a small end-of-day balance, payment by a party other than the consignee with no clear economic reason, cash deposits or transactions consistently just below reporting thresholds, large round-figure payments in a sector where they are unusual, and funds that leave a country, pass through other jurisdictions and return to the original country.

How the document says to use them

The document says a single indicator does not by itself justify suspicion. It may prompt further monitoring, and several indicators together may warrant closer examination. Relevance depends on the institution's business lines, products, customer interactions and resources. Private-sector entities often cannot see every indicator because some need external data such as customs records or market prices. It adds that users should consider the customer's full profile, including due diligence information, trade finance methods and other risk factors.

FinCEN advisory FIN-2025-A003

FinCEN issued advisory FIN-2025-A003 on 28 August 2025, on the use of Chinese money laundering networks (CMLNs) by Mexico-based transnational criminal organisations to launder illicit proceeds. It names the CJNG, Sinaloa Cartel and Gulf Cartel. FinCEN describes CMLNs as professional money launderers and, quoting Treasury's 2024 National Money Laundering Risk Assessment, as one of the most significant money laundering threat actors facing the US financial system.

On TBML specifically, FinCEN describes money mules and complicit recruits buying electronics and luxury goods across the US, then reselling them through online marketplaces, front companies or complicit businesses, or exporting them to Mexico, China, Hong Kong and the UAE. Exports to cartel-owned companies can substitute for a mirror transfer. The advisory also describes two patterns:

• Daigou: literally buying on behalf of someone. Straw buyers, who may be witting or unwitting, buy US goods for people in China, funded by cash or peer-to-peer transfers, and the goods are shipped to China or to a US-based operator who often exports them further.
• Mirror transactions: a US-based network receives dollars from a cartel while a Mexico-based counterpart sends an equivalent amount in pesos to the cartel's Mexican accounts, less a fee, which avoids moving cash across the border.

Trade-related red flags in the advisory

Examples include a business owned by a Chinese national that receives online marketplace deposits but almost never buys inventory, a small electronics or real estate business receiving wires from Mexico, China, Hong Kong or the UAE with no known connection to them, a Chinese national who regularly receives peer-to-peer or wire transfers from unknown senders and then pays a large credit card balance, an electronics or luxury goods business whose income is out of proportion to its size, and Hong Kong trading companies with shell-like features sending funds to Chinese nationals in the US or to real estate escrow or title companies with no apparent business purpose.

Reporting

FinCEN asks filers to include the key term CMLN-2025-A003 in SAR field 2 and in the narrative. It also directs filers to select SAR field 38(n) for suspicious use of informal value transfer systems, field 38(s) for unlicensed or unregistered money services businesses, and field 36(l) for TBML or the Black Market Peso Exchange, along with any other applicable boxes.

Our suggestions for using the two together

These are Learnsignal's suggestions, not regulator requirements. Group your own alert rules under the four FATF headings so reviewers know which kind of evidence they are looking for. Record which indicators your firm can see and which need outside data, since the FATF document accepts that some cannot be seen. Require reviewers to note combinations of flags rather than single hits. For firms with exposure to trade finance, link this work with your sanctions screening for payments and trade finance. Training on these typologies is available through Learnsignal CPD.

What we could not confirm

We did not review the December 2020 FATF and Egmont trends report, UK guidance on TBML, or the full text of the FinCEN advisory beyond the points above. The indicator counts per group are our own count of the FATF PDF. The FATF document does not use terms such as phantom shipping or over- and under-invoicing, so we have not attributed those terms to it. We have not checked whether FinCEN or the FATF have issued updates since the dates above.

Frequently asked questions

Does one red flag mean a firm must file a report?

The FATF and Egmont document says a single indicator does not by itself justify suspicion, but may prompt further monitoring, and several together may warrant closer examination.

What SAR key term does FinCEN ask for in advisory FIN-2025-A003?

FinCEN asks filers to use CMLN-2025-A003 in SAR field 2 and in the narrative.

Who published the FATF trade-based money laundering indicators?

The FATF and the Egmont Group of Financial Intelligence Units published them on 11 March 2021.