Which of the following is a red flag commonly used to detect unusual activity?

• A. Rapid successive transactions
• B. Normal login patterns
• C. Stable device IDs
• D. Small, one-time payments

Answer: (A)

Velocity of activity is a key signal in AML monitoring. Rapid successive transactions stand out because funds are moved in quick bursts, which can obscure the money trail and hint at layering, structuring, or other attempts to evade review. Such high-frequency activity often triggers alerts for investigators to examine whether the activity is legitimate or financial crime-related. In contrast, normal login patterns suggest typical user behavior, stable device IDs imply consistent access from known devices, and small, one-time payments are common and not by themselves a strong indicator of illicit activity. They may warrant further scrutiny if combined with other anomalies, but they don’t carry the same weight as rapid transfers as a standalone red flag.