U.S. banks detect possible corporate fraud by comparing a company’s real transactions with the business purpose, ownership, source of funds and expected account activity established during onboarding. Automated surveillance and employee reports identify anomalies; investigators then review the entire relationship, request context, test transaction details and decide whether to close the alert, update the customer’s risk profile, restrict services or file a Suspicious Activity Report (SAR).
A flagged transaction is an investigative lead, not a finding that fraud occurred. The process described below is based on U.S. Financial Crimes Enforcement Network (FinCEN) and Federal Financial Institutions Examination Council (FFIEC) guidance. Requirements and practices can differ in other countries.
As an Amazon Associate I earn from qualifying purchases.
What “corporate fraud detection” means at a bank
Banks generally do not begin with a legal conclusion that a company committed fraud. Their compliance teams look for activity that is inconsistent with the bank’s understanding of the customer or that may involve money laundering, payment-instruction compromise, misuse of an account or another financial crime. The bank identifies unusual activity, investigates the facts and determines what regulatory or account-management action is appropriate.
The central comparison is between an expected profile and observed behavior. That profile is built from customer due diligence, beneficial-ownership information, the stated purpose of each account, products and services used, expected transaction types and volumes, business locations, and the source and intended use of funds. FFIEC’s BSA/AML Manual: Business Entities (Domestic and Foreign) emphasizes that risk assessment should consider how and where an entity was formed, its account types, actual versus expected transactions, products used and whether the entity was created internally or through an outside formation provider.
#1 Best Overall
1. Banks establish a baseline for the company
Before monitoring can identify an anomaly, the bank needs a workable picture of what normal activity should look like. During onboarding and later reviews, the institution may examine:
- Legal and ownership structure: subsidiaries, parent companies, trusts, beneficial owners, controlling persons and the reason for a complicated structure.
- Business purpose and operations: the industry, locations, customers, suppliers, payroll pattern and countries in which the company actually operates.
- Account purpose and products: operating accounts, escrow, treasury services, international wires, cash services, private banking, trust services and monetary instruments.
- Sources and uses of funds: how money is expected to enter the account and what payments the company is expected to make.
- Anticipated activity: transaction types, approximate volume, counterparties, currencies and seasonality.
FinCEN guidance on obtaining and retaining beneficial-ownership information treats ownership, entity structure, source and use of funds, and anticipated activity as inputs to ongoing due diligence. A complex formation is not proof of wrongdoing, but it can make the bank’s risk assessment and monitoring more important.
2. Banks monitor activity throughout the relationship
Monitoring continues after an account opens. The bank compares new transactions with the customer profile and looks for combinations of facts that do not make sense for the stated business. FFIEC examination procedures describe both employee-generated transaction reports and automated account-surveillance systems.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches| Method | How it works | Strengths and limits | What happens next |
|---|---|---|---|
| Manual transaction reports | Employees in branches, operations, wire rooms or relationship teams escalate transactions or behavior they notice. | Can capture context that a rule misses, such as a customer’s explanation or a sudden change discussed with a banker. Coverage depends on training, staffing and escalation practices. | Compliance staff identify the customer and activity, research the facts, and decide whether the concern has a reasonable explanation. |
| Automated account surveillance | Rules, filters and risk models scan transactions for patterns such as unusual amounts, destinations, velocity or counterparties. | Can review large volumes consistently. Effectiveness depends on appropriate thresholds, data quality, coverage of higher-risk products and periodic tuning; excessive alerts can consume investigative resources. | An alert is triaged, researched and documented. It may be closed, escalated for deeper review or used in a SAR decision. |
FFIEC does not prescribe one universally superior method. Examiners assess whether a bank’s controls are reasonable for its risk profile, transaction volume, products, customers, geographies and staffing, and whether the controls work when tested against real transactions.
Transactions and changes that can trigger a review
A single indicator normally does not establish fraud. Investigators assess the business context, the customer’s history and the combination of signals.
Rank #2
Activity with no apparent business or lawful purpose
Payments that do not fit the company’s industry, stated account purpose or known counterparties may prompt questions. For example, a manufacturer whose account suddenly receives unrelated third-party payments and sends funds to unknown beneficiaries would require context, not an automatic fraud finding.
Circular or layered transfers
Funds that move through several related accounts and return to the origin, or that pass through entities without an evident commercial reason, can be a risk indicator. The bank may map the chain, identify the beneficial owners and compare each transfer with invoices, contracts or other expected business activity.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Higher-risk jurisdictions or unusual cross-border activity
Transfers to or from jurisdictions the bank considers higher risk, especially when they are inconsistent with the customer’s operations, can lead to enhanced review. Geography alone is not proof of misconduct; legitimate international businesses may routinely transact in those locations.
Substantial or unexplained currency activity
Large cash deposits, withdrawals or rapid movement of currency can be inconsistent with a company that normally operates by invoice and electronic payment. Investigators may compare cash behavior with the industry, locations, sales model and declared source of funds.
Unexplained ownership or control changes
Frequent changes in directors, beneficial owners, signatories or control can require the bank to refresh customer information and reassess risk. A change may be legitimate, but unexplained changes can obscure who controls the account or who benefits from transactions.
Rank #3
Business-email-compromise and payment-instruction anomalies
When an employee requests a wire to a new account, changes a supplier’s bank details or urges unusual urgency, banks may verify the instructions through an independent channel. FinCEN’s Advisory to Financial Institutions on E-mail Compromise Fraud Schemes tells institutions to consider customer history and surrounding facts. It states: “In applying the red flags below, financial institutions are advised that no single transactional red flag necessarily indicates suspicious activity.”
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchHow an investigation typically unfolds
- Alert or referral: An automated rule, employee report, law-enforcement contact or customer complaint identifies activity for review.
- Customer identification: Investigators confirm the legal entity, related accounts, beneficial owners, signers, affiliates and relevant products.
- Profile comparison: They compare the transaction with the stated business, account purpose, expected activity, historical behavior and known counterparties.
- Transaction reconstruction: The bank reviews dates, amounts, payment messages, originators, beneficiaries, channels, currencies, linked accounts and the movement of funds before and after the event.
- Document and relationship review: Depending on the issue, staff examine due-diligence records, account statements, wire and check details, ownership information, contracts, invoices or communications available to the bank. FFIEC business-entity procedures call for reviewing the full relationship rather than an isolated payment.
- Context and explanation: The bank may contact management or the relationship team to understand a new supplier, acquisition, seasonal spike, ownership change or unusual payment. A reasonable, documented explanation can resolve an alert; an implausible or unsupported explanation can lead to escalation.
- Disposition: Compliance staff document the analysis, close the alert, continue monitoring, request updated information, change the risk rating, impose account controls, exit the relationship or consider a SAR filing.
What investigators examine in the wider relationship
Investigators may look beyond the transaction that generated the alert. Relevant questions include:
- Does the company’s actual revenue and payment pattern match the business description?
- Are funds moving between entities that share owners, addresses, signers or service providers?
- Do counterparties make commercial sense, and can the customer explain them?
- Are incoming funds quickly withdrawn, converted, transferred abroad or sent to unrelated beneficiaries?
- Have account activity, operations, ownership or control changed since the last due-diligence review?
- Does a law-enforcement inquiry or other new information require the bank to update the relationship profile?
FFIEC’s customer-due-diligence guidance identifies unexplained changes in account activity, business operations or ownership, monitoring red flags and law-enforcement inquiries as events that may justify reviewing customer information and updating the risk profile.
How the bank decides whether activity is suspicious
The decision is risk-based and fact-specific. Investigators weigh the customer’s explanation against independent records, prior behavior, the transaction’s economic purpose and the combined indicators. A legitimate explanation may be supported by an acquisition agreement, a new customer contract, payroll records, shipping documents or evidence that a seasonal business is entering its busy period. The bank may still monitor the account more closely if the activity remains higher risk.
Conversely, an unexplained pattern can remain concerning even when each individual payment appears ordinary. The relevant question is whether the relationship, ownership and flow of funds make sense together. FFIEC procedures describe following an alert through identification, research and reporting, discussing unusual transactions with management and considering whether there is a reasonable explanation.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #4
SARs, law-enforcement requests and confidentiality
A Suspicious Activity Report is a regulatory filing, not a criminal verdict. The bank’s internal investigation and any SAR decision are separate from a prosecutor’s decision to charge a person or company. The existence of a SAR is generally confidential; interagency guidance says a filer may not disclose it to a person involved in the reported transaction except in authorized disclosure contexts. A customer therefore should not assume that the bank will confirm whether a SAR was filed or provide a copy.
FinCEN guidance also explains that when law enforcement asks a financial institution to keep an account open, the bank still has applicable Bank Secrecy Act reporting and recordkeeping responsibilities. Maintaining the account at law enforcement’s request does not eliminate those duties. The bank may continue monitoring, document transactions and file reports while the account remains open.
What may happen to the company’s account
Possible outcomes depend on the facts, the bank’s policies and legal requirements. The institution may:
- close the alert with no further action;
- ask for updated ownership, business or transaction information;
- increase monitoring or change the customer’s risk classification;
- delay, reject or verify a payment under applicable controls;
- restrict products or services;
- file a SAR or provide information through an authorized law-enforcement process; or
- exit the relationship, sometimes with limited explanation because of confidentiality and security obligations.
None of these actions, by itself, proves that corporate fraud occurred. Banks may act to manage regulatory and financial-crime risk before a court or law-enforcement agency reaches a conclusion.
Recommended Free Tools
Common misunderstandings about bank fraud investigations
“Any alert means the bank has accused us of fraud.”
No. Alerts are leads generated by rules, employees or external information. The bank must investigate context, test the information and document a disposition.
Best Value
- Used Book in Good Condition
“A legitimate business should never be flagged.”
Legitimate companies can trigger reviews when they expand internationally, acquire another business, change owners, add a new supplier, experience seasonal volume or deviate from an old profile. Prompt, specific documentation helps the bank understand the change.
“A SAR proves guilt.”
No. A SAR communicates potentially suspicious activity to FinCEN; it is not a finding of civil or criminal liability and is generally confidential.
“Keeping the account open means the bank found nothing.”
Not necessarily. An account may remain open while monitoring continues, while a law-enforcement request is active or while the bank fulfills reporting and recordkeeping duties.
How a company can reduce avoidable escalation
- Keep beneficial-ownership, control-person and signatory information current.
- Tell the bank before major changes in ownership, business model, geography, products or expected transaction volume.
- Use clear payment references and maintain invoices, contracts and other records that explain unusual transfers.
- Establish internal callback procedures for supplier-bank-detail changes and urgent wire requests.
- Respond promptly and consistently when the bank requests transaction or ownership information.
- Reconcile accounts and investigate unexplained incoming or outgoing payments before they become recurring patterns.
These practices do not guarantee that an account will never be reviewed. They make it easier for the bank to distinguish an explainable business change from activity that lacks a credible commercial purpose.
Scope and limits of this explanation
The process described here reflects U.S. FFIEC and FinCEN guidance focused on Bank Secrecy Act, anti-money-laundering, customer-due-diligence and fraud-related transaction controls. It is not a universal description of every bank’s internal procedures, and it does not establish that every suspicious-activity review is a corporate-fraud investigation. Other countries may use different regulators, reporting thresholds, privacy rules and investigative practices.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
