The Messy Middle: Unusual Activity, Suspicion, and Proportionate Action

I sometimes think that as compliance folk we have done our job too well. We’ve spent years drilling into financial services staff that we operate in a mandatory reporting regime, STRs must be made as soon as practicable and that we must not tip off. I think years of this in annual AML refreshers have left everyone both vigilant and terrified. As a consequence, they’re missing the important middle step. 

Staff tend to leap straight from "nothing to see here" to "this must be suspicious," as soon as something is a bit off or doesn’t add up immediately. There’s quite a bit of distance between not having the full picture and having grounds to report. But in drilling into people that they mustn’t tip off, we have scared them out of asking legitimate questions. 

In practice, the majority of things that give anyone pause turn out to be a miscommunication, a lack of context, or a straightforward mistake.. They are simply unexpected or (as yet) not fully explained activity. Knowing how to work through that properly, without reaching for the panic button, is a key skill we seem to have lost.

Let’s work the problem through. 

What’s the baseline? 

We start with the baseline that needs nothing at all. A client does exactly what you expected, in line with the business you understood them to have. The only task is making sure that the baseline is correct and documented and that the file still reflects reality. Where due diligence is current and nothing material has been left unrecorded there’s no decision to make. 

Something novel happens

Slightly further along is activity that's new for the client, but still makes sense. A client grows, adds a service line, takes on a partner, moves into a market that's a logical next step. None of that needs to trigger concern on its own. It needs to be noticed and, where it changes the picture of the client, reflected in the file. New is not automatically a problem. You just need to expand or reset your baseline. 

Unexpected activity

This is the messy middle and the part people are having difficulty with. 

What happens when there’s unusual activity? Not necessarily activity that alarms you: activity that doesn't quite match what you know of the client or doesn't immediately make commercial sense. At this point there is no suspicion of anything, there’s just a question mark. A question mark deserves a question, not a leap to suspicion because you’re scared to bridge the gaps with questions.

A long standing client whose transactions have never given anyone pause suddenly wants to route a significant sum through a jurisdiction that's never featured in their structure before. There's nothing inherently wrong with that. People restructure, take new advice, expand. But it doesn't yet fit the story you have of this client, and that gap between what you expected and what's happening is exactly what should prompt a conversation.

But is it tipping off? 

Short answer? Absolutely not. In order to tip off, you would need to know or suspect that an STR has been or will be filed, or that an investigation or FIU enquiry in relation to the client is underway or contemplated and then say or do something that’s likely to alert them or otherwise prejudice the investigation.

At this stage, all you are doing is asking for clarification of activity that you don’t have a full understanding of. Any client acting in good faith will understand and be more than happy to provide background and documentation to close the gap. (OK, not all clients. Some of them won’t be happy, but they will have the information and give it to you, however grudgingly.)

Get clarification 

What that conversation looks like, in practice: ask the client directly and see what comes back. Run the checks you'd run on anything new, screening, a look at what's publicly available, a proper read of the documentation already on file. 

Where the Code requires enhanced due diligence, that applies here. Ask a colleague what they make of it. Look again at the agreements and the business plan you're holding. None of this is an investigation in the dramatic sense. It's the ordinary, proportionate version of due diligence, just prompted by something specific rather than done on a schedule.

Most of the time, this closes the loop. The client answers, the explanation is supported by the  documentation and the file is stronger for having asked. You’ve updated your baseline. 

Document your query and investigations; not because anything went wrong, but because a question was raised and properly answered, and the next person to look at the file should be able to see that happened.

When clarification isn’t forthcoming 

Sometimes the answers don’t come, or they do and you’re not satisfied. The explanation doesn't hold up, the client goes quiet, or answers everything except the thing you asked about. 

That's the point where unusual becomes suspicious, and the response changes completely. 

It isn't a moment for more questions. It's a moment for the MLRO, immediately, and an STR. If there's enhanced due diligence still to gather, get it, unless doing so risks tipping the client off that something is wrong, in which case that consideration comes first. The MLRO will be able to guide you as to what you need and what is advisable to ask for. 

Most clients who end up in the “unusual” category are not criminals. They're clients whose behaviour hasn't been explained yet, and the explanation, when it comes, is usually mundane. 

The skill is in not treating every question mark as an emergency. It's knowing which stage you're in, asking the right question at the right moment, and being honest about when an answer hasn't answered anything.