Suspicious Transactions Under PMLA: The Complete 2026 IIBF AML KYC Guide

If there is one topic that separates a confident IIBF AML KYC Certification candidate from a nervous one. It is this: suspicious transactions under the Prevention of Money Laundering Act (PMLA). Get this chapter right. A whole cluster of exam questions falls into place.

In this 2026 guide. We break down suspicious transactions exactly the way the IIBF expects you to know them. From the legal definition to the red-flag indicators.

The Suspicious Transaction Report (STR) rules and the FATF risk factors. Everything is preserved. Nothing is diluted.

And it is all written in plain English you can revise the night before your exam.

Why suspicious transactions matter for the IIBF AML KYC exam

The IIBF conducts the Certificate Examination in Anti-Money Laundering &. Know Your Customer (AML KYC) for bankers of its member banks. It runs throughout the year and is considered essential. Because every banker is expected to detect and report money-laundering activity. Especially as seniority increases.

Suspicious transactions sit at the core of this syllabus. They are the practical. Day-to-day skill that the certificate is meant to certify.

That is exactly why examiners return to this topic again and again. Often through scenario-based questions where you must decide whether a given case is suspicious. What the bank should do next.

Because the law is amended from time to time. Candidates are always expected to track the latest revisions. For figures.

Thresholds or rule numbers you are unsure about. Always confirm on the latest official IIBF notification. The current PMLA Rules before your exam.

What are suspicious transactions under PMLA?

Let us start with the meaning. As per PMLA Rule 2(g). A suspicious transaction means a transaction, whether in cash or not, that:

• gives rise to a reasonable suspicion. In a person acting in good faith. That it may involve the proceeds of crime; or
• appears to have been made under circumstances of unusual or unreasonable complexity. Or
• appears to have no economic rationale or bona fide purpose; or
• raises reasonable suspicion that it may involve the financing of terrorist-related activities.

Notice the structure. A transaction does not have to be illegal on its face to be suspicious. It only has to trigger reasonable suspicion in a good-faith observer on any one of these grounds. That single idea answers a large share of exam questions on this chapter.

The four grounds of suspicion in one table

Examiners love to test whether you can map a scenario to the correct ground. Use this comparison table to lock it in.

Indicators of suspicion: the red-flag checklist

Banks must consider indicators of suspicion when deciding whether a transaction is suspicious. The IIBF provides an indicative list of red flags. And these are prime question material. Each one describes an activity that should raise the alarm.

Study them as patterns, not as isolated facts. Almost every red flag below shares a common thread: unusual activity plus no valid explanation from the customer.

• Account used for lottery fraud: Complaints that an account receives money from victims. Deposits at multiple locations followed by instant ATM cash withdrawals. With no valid explanation from the owner.
• False identity: Identification documents found to be forged during verification. And the account owner is not traceable.
• Doubts about the real beneficiary: The customer is unaware of the transactions. And the activity does not match the customer profile.
• Account of persons under investigation: The customer is reported in the media as being under investigation.
• Account used for cybercrime: Cybercrime complaints received against the customer. With no valid explanation of the transactions.
• Incorrect address: The welcome package is returned. The person does not stay at the given address or the address is false. And the owner is not traceable.
• Suspicious activity from a high-risk country: Cash deposited in different cities on the same day. With the account holder a citizen of a high-risk country known for drug trafficking.
• Wanted criminal account: The account holder's name. Other criteria (date of birth. Father's name, nationality) match a person on the crime watch list.
• Questionable IPO investment: A large number of accounts with a joint promoter or authorised signatory. Used for multiple investments in IPOs of different companies.
• Unexplained transfers between multiple accounts: Many related accounts with substantial transactions between them. No economic justification.
• Suspicious use of an ATM card: Frequent cash deposits followed by ATM withdrawals at various locations. With no valid explanation.
• Unexplained dormant account activity: A sudden spike in a dormant account. With no satisfactory explanation.
• Large transactions inconsistent with the customer's finances: High-value transactions in an account that usually sees low-value activity. Unexplained by the owner.
• Questionable source of credit-card payments: A credit card first loaded with significant cash. Then used for expenses, with yearly payments beyond known income.
• Questionable use of the safe deposit locker: The locker is operated in a way inconsistent with the customer's financial situation.
• Questionable withdrawal of foreign transfers: Foreign transfers collected in cash immediately. With no valid explanation.
• Questionable source of cash deposits: Frequent cash just below the reporting threshold. Split between accounts to avoid reporting, with no valid explanation.
• Suspicious cash withdrawals: Large-value cheques deposited, followed by immediate cash withdrawals.
• Activity contrary to declared trade: Transactions that do not fit the declared business. With no satisfactory explanation.
• Questionable foreign transfers in: A series of bills purchased from an exchange house abroad. Or sudden deposits into a dormant account immediately followed by withdrawals.
• Suspicious remitter or recipient: The name. Details of the remitter or the recipient of foreign remittances match a person on the watch list.

Reading the list end to end is good. Testing yourself on it is better. Run through a few mock tests that throw these scenarios at you, and the patterns will start to feel automatic.

Bank's Suspicious Transaction Reporting (STR) guidelines

Once a transaction is flagged, the bank's duty is to report it. In determining suspicious transactions. Banks must follow the definition contained in the PMLA Rules as amended from time to time. This is why staying current matters so much.

There is one rule that catches many candidates off guard. So commit it to memory.

In other words. An incomplete transaction is not an excuse to skip reporting. If the suspicion was raised, the STR is filed. Many multiple-choice questions hinge on exactly this point.

Why is transaction monitoring so important?

Transaction monitoring is not box-ticking. It is the engine that makes a bank's AML. Counter-Terrorism Financing (CTF) framework actually work. Here is why it matters, point by point.

1. It is an important first step in any financial institution's AML. CTF procedures.
2. The ability to detect a suspicious transaction can prevent criminals from laundering huge sums. No institution wants to be caught in a money-laundering scandal.
3. It gives confidence to regulators and banking partners. Showing that the institution takes AML and CTF seriously. That builds trust with new and existing partners.
4. It lets institutions take a risk-based approach. Identifying and managing the risk each client poses. Risk level depends on factors such as the customer's occupation. Country of residence.
5. Once a customer's risk level is set. The institution can adjust the intensity of monitoring for that customer.

Read the chain carefully. Detection feeds reporting. Reporting builds regulatory trust. And the risk-based approach decides how closely each customer is watched. That logical flow is exactly what scenario questions are testing.

FATF factors that shape AML and CTF controls

The Financial Action Task Force (FATF) sets the global standards for AML. CTF procedures. It recognises several factors that determine the appropriate scope of a financial institution's AML. CTF controls:

• The diversity of operations, including the geographies where the institution operates.
• The nature, complexity and scale of the business.
• The extent to which the institution trades through intermediaries. Third parties or without face-to-face access.
• The distribution channel used to deliver products and services.

The theme here is proportionality. A larger. More complex.

More cross-border bank needs deeper controls than a small single-branch operation. Expect FATF to appear in straightforward recall questions. So keep these four factors handy.

Quick-facts revision table

How to study suspicious transactions the smart way

This chapter rewards structured revision over rote reading. Use this simple four-step plan.

1. Anchor the definition first. Memorise the four grounds in PMLA Rule 2(g) before anything else. Everything else hangs off them.
2. Group the red flags. Cluster the indicators into themes — identity. Address, cash, foreign transfers, watch-list matches. Patterns are easier to recall than 21 separate lines.
3. Drill scenarios. Practise application questions where you classify a case and decide the action. Spaced repetition with mock tests beats passive re-reading.
4. Stay current. Skim the latest PMLA amendments and read more free guides so no recent change catches you off guard.

Spend the bulk of your time on steps 2 and 3. That is where the exam marks actually live.

Common mistakes candidates make

A handful of avoidable errors cost candidates easy marks every year. Watch out for these.

• Assuming a transaction must be illegal to be suspicious. Reasonable suspicion on any one ground is enough.
• Thinking attempted transactions are exempt. Abandoned or aborted attempts must still be reported in an STR.
• Linking suspicion only to large amounts. Small amounts split to dodge thresholds are classic red flags.
• Ignoring the customer profile. Activity inconsistent with a customer's known income or trade is a core indicator.
• Memorising red flags without the underlying logic. Learn the why, and unseen scenarios become solvable.

Frequently asked questions

What is a suspicious transaction under PMLA?

Under PMLA Rule 2(g). A suspicious transaction is one. In cash or otherwise.

That gives rise to reasonable suspicion of involving proceeds of crime. Has unusual complexity. Lacks economic rationale or bona fide purpose, or may involve terror financing.

Do banks report attempted transactions that the customer abandoned?

Yes. Banks must report all such attempted. Abandoned or aborted transactions in a Suspicious Transaction Report. Even if the customer did not complete them. Regardless of the amount involved.

What is the difference between a suspicious transaction and a normal high-value transaction?

A high value alone does not make a transaction suspicious. Suspicion arises from the grounds in PMLA Rule 2(g) &mdash. Such as no economic rationale or inconsistency with the customer profile &mdash. Not merely from the size of the amount.

Why is transaction monitoring important in AML and KYC?

It is the first step in AML and CTF. Helps prevent large-scale laundering. Builds regulatory trust. And enables a risk-based approach that tailors how closely each customer is monitored.

What role does FATF play in suspicious transaction controls?

The FATF sets the global standards for AML and CTF. It identifies factors — operational diversity. Business complexity and scale.

Use of intermediaries. And distribution channels &mdash. That determine how extensive a bank's controls should be.

Final word: turn this chapter into guaranteed marks

Suspicious transactions are not a topic to fear. They are a topic to own. Once the PMLA Rule 2(g) definition.

The red-flag patterns. The STR rule on attempts and the FATF factors are second nature. This becomes one of the most scoring chapters in the whole AML KYC syllabus.

Revise the definition. Drill the scenarios. And confirm the latest figures on the official IIBF notification. Do that. And you will walk into the exam ready to clear the AML KYC Certification on your very first attempt.

Related Guides

For more on suspicious transactions. See the official IIBF circulars. Our chapter-wise free notes on iibf.store.

For more on “suspicious transactions”, explore our free mock tests and chapter notes on iibf.store.