AML red flags checklist for FX/CFD brokers
Eight patterns that compliance teams at retail FX and CFD brokers meet again and again, written as checks against MT5 and back-office data. The checklist is a free PDF in English and Arabic; this page shows the same items.
Reviewed · Educational material, not legal advice.
Download
Print it, use it in a thematic review, or hold it against your own monitoring rules to see what is not covered. No form.
The checklist
Wash trades between linked accounts
- Opposite trades in the same symbol and size between two accounts, opened and closed within seconds of each other.MT5 deals: login, symbol, volume, open and close time. Link the accounts through KYC (passport, address, phone), device and IP from logins, and funding account.
- One account steadily loses what the other gains.Net P&L per account pair over the period, and its direction.
- The linked accounts sit under the same introducing broker or on different spread groups.MT5 group, agent account, commission settings.
IB rebate abuse
- Volume from one introducer's clients rises sharply while their net exposure stays near zero.Rebate ledger against net open position by IB.
- The IB's clients trade against each other, or open and close at once, generating commission and little else.Share of matched volume per IB; average holding time.
- The IB, its clients or their funding sources share identity or payment details.KYC and payment data for the IB and its sub-accounts.
Third-party funding
- Deposit from a card, bank account or wallet not in the client's name.Payer name against account holder; PSP payer reference.
- Several unrelated clients funded from the same source.Funding account or card fingerprint across clients.
- Withdrawal requested to an account other than the one that funded.Withdrawal destination against funding source.
Pass-through: deposit and withdraw with little trading
- Funds withdrawn soon after deposit, with traded volume far below what the deposit would support.Deposits, withdrawals and traded notional per client per period.
- Withdrawal to a different institution, a different country or a self-custody wallet.Withdrawal method and destination.
- The cycle repeats.Number of deposit and withdrawal cycles over 30 and 90 days.
Bonus abuse
- Several accounts claim the same welcome or deposit bonus from shared devices, IPs or payment details.Bonus ledger joined to logins and funding.
- Opposite positions across linked accounts during the bonus period to lock in bonus-funded profit.Offsetting positions across linked logins while a bonus is active.
- Withdrawal as soon as the bonus volume requirement is met.Date the requirement was met against the withdrawal date.
Latency arbitrage
- Very short holding times with a win rate far above the rest of the book.Holding-time distribution and win rate per login.
- Trades cluster on price spikes or stale quotes, often placed by an expert advisor.Deal time against the price feed; EA flag on MT5 deals.
- Profits withdrawn quickly, sometimes to third parties.Withdrawal timing and destination.
Dormant account reactivation
- An account idle for months logs in from a new device or country.Last activity date; login IP, country and device.
- Bank details or e-mail changed shortly before a withdrawal.Change log for payment and contact details.
- Full-balance withdrawal within hours of reactivation.Time between login, change and withdrawal request.
Structuring
- Repeated deposits just below the amount that triggers enhanced checks.Deposit amounts against the firm's EDD or source-of-funds thresholds.
- Deposits split across cards, wallets or days that together exceed it.Aggregated deposits per client over a rolling window.
- Followed by one large withdrawal, often by a different method.Withdrawal method against deposit methods.
How to use it
A red flag is a reason to look, not a finding. Several of these patterns have ordinary explanations: a client funding from a spouse's card, a trader who is simply fast. What an inspector looks for is that the check was made and the explanation recorded.
The CBUAE expects monitoring rules to be designed from a typology assessment and calibrated to the firm's products and customers (Transaction Monitoring guidance, section 2.4). For a broker, that list should include the market-abuse patterns as well as the payment ones.
What Marqib detects today
The pilot build has deterministic rules for wash trading between linked accounts (with the IB rebate earned on the volume), spoofing and layering, third-party funding, pass-through, dormant reactivation and structuring. Bonus abuse and latency arbitrage are on the roadmap: they are on this checklist because brokers ask about them, not because Marqib detects them yet.
See how the rules work on the brokers page, or read the goAML STR filing guide for what happens after a flag becomes a case.
Sources
- CBUAE Rulebook, Guidance on Transaction Monitoring and Sanctions Screening
- CBUAE Rulebook, STR guidance 3.3: Best practices for drafting an STR or SAR
Questions
Is latency arbitrage money laundering?
Usually not. It is a pricing and trading-abuse problem for the broker. It belongs on the list because the same accounts often show other patterns, and because arbitrage profits withdrawn to third parties can become an AML question.
Why is IB rebate abuse an AML issue?
Rebates paid on matched or circular volume move money from the broker to the introducer without economic trading behind it. Where the introducer, the clients and the funding sources are linked, the rebate can be the channel that moves the money.
Do we have to file an STR for every red flag?
No. A red flag starts a review. Whether to file depends on what the review finds and on the reporting standard in your jurisdiction.