Module 6: Red flags, STR/CTR reporting and record keeping - Certificate in Anti-Money Laundering Fundamentals

What you will learn

Recognise red flags in banks and MFIs
Follow the STR steps and avoid tipping off
State the CTR rule for banks and the record-keeping minimum

Red flags

A red flag is a sign that something may be wrong. It is not proof. Examples:

Activity far above the client's known income or business.
Many small cash deposits just under a limit (structuring).
Large loans repaid early in cash from an unexplained source.
The same ID, phone or photograph under different names; one person with loans in several branches.
Missing, generic or copied KYC documents; a third party always pays.
A client, partner or staff member matches a sanctions list or appears in media reports on terrorism.
Transfers to places or people with no clear business reason.
Staff accepting client payments into personal accounts, or living beyond their salary.

Suspicious transaction report (STR/SAR)

Under MLPA section 25(1)(d), a reporting organisation must report suspicious transactions immediately and on its own initiative. Reasonable suspicion is enough: you do not need evidence of a crime. Steps:

Notice activity unusual for the client's profile.
Check KYC, history and linked accounts, without alerting the client.
Escalate in writing to the branch or compliance officer the same day.
The compliance officer decides and files the STR with BFIU through goAML.
Keep the file and keep monitoring.

Do not tip off. Telling a customer that a report is being made, or misusing the information, is an offence under MLPA section 6 (up to 2 years, or a fine up to Tk 50,000, or both).

Cash transaction reports (CTR)

Banks must report cash deposits or withdrawals of Tk 10 lakh or more in an account in one day (in one or more transactions) or the foreign-currency equivalent. CTRs are filed monthly through goAML by the 21st of the following month. Government accounts and inter-bank or inter-branch transfers are exempt. Circular 33 sets no CTR duty for NGO-MFIs, which file STR/SAR only. Other sectors follow their own BFIU circulars on cash transaction reports; check yours.

Record keeping

Keep customer identity records and transaction records for at least 5 years (for transactions of closed accounts, from closure; for NGO-MFI client data, from the end of transactions). Records must be complete enough to reconstruct transactions and be given to BFIU on request.

Bangladesh lens

In its annual report for FY2024-25, BFIU reported receiving 30,199 STRs/SARs and 31,254,426 CTRs (from banks and non-bank financial institutions). STRs are the signal that supports investigations; CTRs are numbers for analysis.

MFI red flags at the branch counter and in the field: loan disbursement to a person other than the borrower; many loans to the same person across branches or duplicate IDs; early cash repayment of a whole loan; savings deposits far above the client's profile; cash collected by a non-member; and staff taking client payments into personal accounts. The field officer is the first to see these and must pass them on.

For an NGO-MFI, the route under Circular 33 is: field officer, then branch AML officer in writing, then the Central Compliance Unit, then BFIU through goAML. If goAML is unavailable, the prescribed annex forms are used.

Key takeaways

A red flag is a prompt to look closer, not proof.
STRs are filed immediately and on the institution's own initiative.
Never tip off: MLPA s.6.
Banks: CTR for cash of Tk 10 lakh or more in a day, by the 21st of the next month. Keep records at least 5 years.

Practice quiz

Five questions, instant feedback. Not graded for the certificate.

Based on the Money Laundering Prevention Act 2012 (as amended 2015), the Anti-Terrorism Act 2009 and BFIU circulars, as understood on 16 October 2026. Laws and circulars change: always check the latest text on bfiu.org.bd. This course is general education, not legal advice. Cases marked "illustrative" are fictional.