TL;DR: Human trafficking financial red flags are largely behavioral and relational rather than transactional, which is why threshold-based monitoring rarely surfaces them. The ILO estimates that forced labour generates $236 billion in annual illegal profits, with forced commercial sexual exploitation producing $27,252 per victim per year against $3,687 for forced labour. That 7.4x gap explains why the two typologies leave completely different financial footprints — and why an institution looking for one will miss the other.
The Crime Is Coercion, Not a Transaction
Human trafficking has no transaction amount, no merchant category code, and no counterparty. What reaches a financial institution is a downstream artifact: a wage that was never paid, a deposit made in a city where the customer does not live, advertising spend on a classifieds platform.
FinCEN's controlling guidance is Advisory FIN-2020-A008, issued October 15, 2020, which added 20 financial and behavioral indicators and four typologies to the 2014 advisory that preceded it. Both remain in force. The current supplement is Notice FIN-2026-NTC1, issued May 11, 2026, covering trafficking risk around the 2026 FIFA World Cup across 16 host cities.
The framing FinCEN insists on is worth leading with: no single red flag is a clear indicator of human trafficking. The 2014 advisory adds a design recommendation most institutions have not implemented — that to evaluate transactional activity effectively, financial institutions should consider reviewing transactions at the relationship level rather than at the account level.
Labor and Sex Trafficking Look Nothing Alike
The most useful thing an institution can do is stop treating this as one typology. FATF's 2018 work established that proceeds from forced labour, sexual exploitation, and organ removal are realized differently and require different laundering mechanisms.
Labour trafficking proceeds come from suppressing a legitimate cost line. Sexual exploitation proceeds are generated as new cash that needs placement. That difference determines where the signal lives.
The Indicators Worth Building Around
FinCEN's behavioral indicators are the highest-signal and hardest to capture, because they arrive through a person at a counter rather than through a data feed. The reason FinCEN emphasizes them is stark: for many victims, the only outside contact they have is when visiting a financial institution.
A third party speaks on behalf of the customer, insists on being present, or insists on translating. A third party fills out paperwork without consulting the customer, or retains possession of all documents and money. A third party claims a relationship but does not know critical details. Someone attempts to open an account using the identification of a person who is not present, or for an unqualified minor. The customer cannot clarify where they are staying, or gives a scripted or inconsistent story.
The financial indicators fall into four groups.
Funnel accounts and geographic dislocation. Cash deposits, often below the CTR threshold, in cities or states where the customer neither resides nor does business, withdrawn the same day somewhere else entirely. Multiple apparently unrelated customers wiring to a common beneficiary using shared addresses or phone numbers, with no apparent relationship to the recipient. Deposits sized only to cover account debits, with no accumulation — in FinCEN's own case study, deposits were made in cash and were just enough to cover the debits.
Payroll absences. This is the labour trafficking signature and the clearest example of a signal that threshold monitoring cannot see. A business customer with no normal payroll expenditure — wages, payroll taxes, and social security contributions non-existent or far too low for the claimed size of the operation. Substantial wage deductions for alleged housing and food. Payroll checks cashed with most of the funds retained by the employer or redeposited into the employer's account. Multiple employees receiving salaries into the same account. Payments to unlicensed or unregistered recruitment agencies.
Front business patterns. Transactional activity largely outside normal operating hours — a daytime establishment with heavy night volume — almost always in cash, with deposits larger than the business and its footprint would support. Frequent cash deposits with no ACH payments at all is a particularly strong composite, because a legitimate operating business almost always has ACH activity. When accounts are closed for suspicious activity, new customers begin transacting on behalf of the closed-account customers with the same patterns and overlapping counterparties.
Platform and payment-rail indicators. An account sharing a phone number, email, social media handle, or address with escort agency websites or commercial sex advertisements — an entity resolution signal rather than a transaction signal. Frequent advertising payments to escort platforms, from small classified posting fees through to website hosting. Third-party payment processors used so that the processor appears as originator or beneficiary, concealing the true party. Heavy prepaid card purchase and use. FinCEN's documented laundering chain in one case ran cash to prepaid Visa cards to bitcoin on a peer-to-peer exchange to purchases of commercial sex advertisements.
There is also an inverse signal, added in the 2026 notice and easy to miss: victims themselves may have minimal or no transactions covering essential needs, because the trafficker controls their money. An account receiving funds with no normal consumption footprint attached is itself the flag.
Forced Criminality Changed the Victim Profile
The fastest-growing typology is one that did not exist in FIN-2020-A008 at all. UNODC's 2024 global report found that trafficking for forced criminality, including into online scam operations, went from 1 percent of detected victims in 2016 to 8 percent in 2022, ranking third among all exploitation types. Detected victims overall rose 25 percent against 2019, and detected forced labour victims surged 47 percent.
The scale is substantial. OHCHR assessed in 2023 that at least 120,000 people in Myanmar and at least 100,000 in Cambodia may be held in conditions of forced online scam work. The victim profile inverts the stereotype — most are men, and many are well-educated, computer-literate, and multilingual, recruited through advertisements for technology jobs.
This creates a specific blind spot. FinCEN's own pig butchering alert notes that a significant number of the scammers contacting victims are likely themselves victims of human and labor trafficking operated by criminal organizations. That means a fraud SAR and a trafficking SAR can describe the same transaction from opposite ends. An institution filing only under the pig butchering key term on an outbound victim payment may be missing the trafficking dimension entirely on the operator side — which is precisely why pig butchering detection and trafficking detection belong in the same case, not in two queues.
The enforcement picture reflects the convergence. In October 2025 Treasury designated Cambodia's Prince Group as a transnational criminal organization, describing profits from the industrial-scale trafficking, torture, and extortion of enslaved workers across at least ten scam compounds. The action named 146 targets including 117 affiliated businesses, most of them offshore shell companies with no apparent commercial activity. Exposure to a designation structured that way arrives through opaque ownership chains rather than a name screening hit — which makes beneficial ownership resolution, not list matching, the control that actually works.
The enforcement picture reflects the convergence. In October 2025 Treasury designated Cambodia's Prince Group as a transnational criminal organization, describing profits from the industrial-scale trafficking, torture, and extortion of enslaved workers across at least ten scam compounds. The action named 146 targets including 117 affiliated businesses, most of them offshore shell companies with no apparent commercial activity. Exposure to a designation structured that way arrives through opaque ownership chains rather than a name screening hit — which makes beneficial ownership resolution, not list matching, the control that actually works.
SAR Filing Rules That Are Specific to This Crime
Trafficking has filing conventions that depart from ordinary practice, and getting them wrong has consequences for real people.
The victim is never the SAR subject. Both the 2014 and 2020 advisories state this directly. All available information on the victim goes in the narrative. Naming a suspected victim as the subject can trigger account closure and strip away the one financial relationship and the one outside contact they have.
Behavioral observations belong in the narrative, with the observing staff member identified, so the information can be searched and used by law enforcement. If a teller does not record what they saw at the time, it does not exist for the investigator later.
File regardless of threshold. This is new in the 2026 notice, which asks institutions to file as soon as possible regardless of threshold and to notify the National Human Trafficking Hotline in parallel.
The key terms and structured fields matter for FinCEN's ability to aggregate. SAR field 38(g) is human smuggling; field 38(h) is human trafficking. Current key terms include HUMAN TRAFFICKING FIN-2020-A008 for the supplemental advisory and FIN-2026-HTWORLDCUP for the World Cup notice, each placed in field 2 and in the narrative. Institutions revising their SAR narrative templates should build these in rather than relying on analysts to remember them.
Human trafficking is a specified unlawful activity under 18 U.S.C. 1956(c)(7), which means the Section 314(b) safe harbor covers sharing on suspected trafficking proceeds. The 2026 notice additionally encourages voluntary cross-border sharing with foreign institutions.
Why Monitoring Misses It
Several reasons, and none of them are solved by tuning a threshold.
Many of the strongest signals are absences. Missing payroll tax remittances. Missing ACH. Missing consumption on an account that is receiving funds. A rules engine fires on thresholds crossed, not on line items that never appeared. Detecting that a business with 40 employees on its licenses has no payroll expense requires reasoning against an expected-activity model, not a transaction filter.
The signal lives across accounts rather than within one. Funnel accounts, shared-identifier clusters, common signers across unrelated entities, multiple employees paid into one account — none of these are visible from inside a single account's history, and most monitoring architectures scope alerts to an account.
Amounts are deliberately small. Structuring below reporting thresholds is baked into the typology in both advisories, and victim-level transactions are simultaneously the most diagnostic and the least likely to trip a monetary rule.
Detectability also collapses as you move up the organization. FATF put it precisely: trafficking may be easiest to identify at the victim level or the lowest level of a criminal organisation, while at higher levels the indicators present may suggest any number of different crimes. The account that most clearly looks like trafficking belongs to the least culpable person.
And institutions see different halves of the problem. FinCEN's August 2026 trend analysis of 67,540 smuggling-related reports found that money services businesses filed roughly 97 percent of reports but only about 10 percent of the dollar value, while depository institutions filed 3 percent of reports covering 61 percent of the value. The institutions closest to the customer see the people. The institutions closest to the money see the scale. That split is the strongest available argument for 314(b) information sharing.
The False Positive Risk Falls on Vulnerable People
This is not a customer experience concern. Read literally, the smuggling indicators flag wires from countries with large migrant populations to beneficiaries who are not nationals of those countries — which describes millions of lawful remittance corridors. FinCEN's own 2026 analysis found that 59 percent of money services business reports were filed on the basis of no verifiable familial connection between originator and beneficiary, a low bar and a strong candidate for over-filing.
Consensual adult sex work shares nearly every payment-rail indicator with sex trafficking: platform advertising, prepaid cards, peer-to-peer apps, cash, frequent travel, hotel spend. What distinguishes trafficking is coercion and third-party financial control, neither of which appears in transaction data. Building rules on adult-platform payments alone profiles an occupation. The differentiating signals are the control patterns — someone else receiving the earnings, identification held by another party, no discretionary consumption.
Cash-intensive immigrant-owned small businesses sit in exactly the sectors FinCEN names as trafficking fronts. Sector-based risk ratings applied bluntly become national-origin proxies.
Two operational consequences follow. Do not attempt intervention at the counter — FinCEN's rationale for the behavioral indicators is that traffickers frequently accompany victims, so escalation means filing and calling the hotline, not confronting someone in front of the person controlling them. And exiting the customer is not a compliance win. Closing a suspected victim's account destroys the evidentiary trail and removes the victim's only touchpoint with a regulated institution.
One number to correct while you are here: the $150 billion trafficking profit figure that circulates widely, including in FinCEN's 2020 advisory, traces to the ILO's 2014 estimate. The current figure is $236 billion. Repeating the old one understates the problem by roughly a third.
Where Sphinx Fits
Almost everything that makes this typology hard is a data assembly problem. The indicators are relational, spread across accounts and entities, dependent on expected-activity baselines, and often stated as absences that require knowing what should have been there. Building that picture manually for every candidate case is why most institutions never get past the obvious ones.
Sphinx's agents work inside the systems where that information already sits and assemble the relationship-level view FinCEN's 2014 advisory asked for — linked accounts, shared identifiers, expected versus actual payroll behavior, counterparty overlaps — with the reasoning documented rather than just the conclusion.
What does not get automated is the part that matters most here. Whether third-party presence reflects coercion, caregiving, or a language barrier. Whether an account holder is a perpetrator, a facilitator, or a victim being forced to operate a scam account. Getting that last one wrong makes the institution's SAR the reason a victim is prosecuted, and it is not a call to delegate to a system.
Frequently Asked Questions
Should a suspected trafficking victim be named as the SAR subject?
No. Both FIN-2014-A008 and FIN-2020-A008 state that a potential victim of human trafficking should not be reported as the subject of a SAR, and that all available information on the victim belongs in the narrative instead. Naming a victim as subject can lead to account closure, which destroys the evidentiary trail law enforcement needs and removes what may be the victim's only contact with the outside world.
What SAR key terms and fields apply to human trafficking?
Use SAR field 38(h) for human trafficking and 38(g) for human smuggling. Include the applicable key term in field 2 and in the narrative — HUMAN TRAFFICKING FIN-2020-A008 for the supplemental advisory, and FIN-2026-HTWORLDCUP for the May 2026 World Cup notice. FinCEN also asks for email addresses, phone numbers, and IP addresses where available.
What is the strongest labor trafficking indicator?
The absence of normal payroll expenditure. A business customer whose wages, payroll taxes, and social security contributions are non-existent or far too low for its claimed size and workforce is FinCEN's clearest labour trafficking signal. Related indicators include substantial wage deductions for alleged housing and food, payroll checks cashed with funds retained by the employer, and multiple employees receiving salaries into a single account.
How do trafficking red flags overlap with investment scam detection?
Directly, through forced criminality. FinCEN's pig butchering alert notes that many of the scammers contacting victims are themselves likely victims of human and labor trafficking. UNODC found trafficking for forced criminality rose from 1 percent of detected victims in 2016 to 8 percent in 2022. An institution filing only a fraud SAR on the outbound victim payment may be missing the trafficking dimension on the operator side of the same scheme.
How do you avoid profiling legitimate customers?
By requiring co-occurrence rather than single indicators, and by focusing on control patterns rather than sector or destination. Migrant remittance senders, adult industry workers, and cash-intensive immigrant-owned small businesses each match individual trafficking indicators while being entirely lawful. What distinguishes trafficking is third-party financial control — earnings received by someone else, identification held by another party, an account receiving funds with no discretionary spending attached.
.png)
