KYC Red Flags in Export Transactions and How to Act

Table of Contents

A KYC red flag in an export transaction is a fact about the buyer, the order or the route that does not fit a legitimate commercial story. A customer who refuses to say what the goods are for. A freight forwarder given as the final destination. A small trading company ordering equipment its stated business could not use. Each one obliges you to ask questions before you ship, and to record what you found.

Red flag lists are easy to find. What they usually leave out is the second half: what you actually do when one appears. A flag is not a prohibition. It is a trigger for inquiry, and a resolved flag with a written rationale is a defensible file.

What follows is the flag catalogue grouped by where it shows up, the action for each group, and the escalation procedure that turns the whole thing into evidence.

Where the official red flag list comes from

US exporters work from a published list. It sits in Supplement No. 3 to Part 732 of the Export Administration Regulations, under the heading of Know Your Customer guidance and red flags. The Bureau of Industry and Security first issued it in the 1990s with a core set of transactional warning signs, and it has been expanded several times since, most heavily around advanced semiconductors, advanced computing and artificial intelligence.

Two points about it are often missed. First, the list is not exhaustive. It is guidance, and an indicator absent from it can still put you on notice. Second, the standard it supports is “knowledge”, which in the regulations includes awareness of a high probability that something is the case. You cannot cure a red flag by declining to ask. Deliberately avoiding the answer is treated as an aggravating factor, not a defence.

The EU and UK do not publish an identical numbered list, but their guidance for exporters and for financial institutions covers substantially the same ground: end use uncertainty, illogical routing, ownership opacity and mismatched technical capability. The underlying logic travels.

Flags in the customer profile

These appear before an order exists. They are the cheapest to catch, because catching them costs a registry search.

The customer has little or no business background in the product area, and no trading history you can verify.
The company was incorporated very recently relative to the size of the order it is placing.
The registered address is a residential unit, a mail drop or a serviced office shared by dozens of entities.
The website is thin, has no product depth and uses text lifted from a manufacturer.
Directors or technical staff overlap with a company already on a restricted list.
Ownership cannot be established, or the customer declines to give ownership percentages.
The customer’s own marketing describes capabilities that contradict what it tells you about end use.

The ownership point deserves attention. Several sanctions regimes look through a named entity to its owners, so an entity that returns no direct match can still be blocked by who stands behind it. The mechanics are covered in the explanation of the fifty percent rule in sanctions screening. If a customer will not tell you who owns it, treat that refusal as information.

What to do with a profile flag

Pull the registry filing yourself rather than accepting a scanned certificate. Compare the registered address to the delivery address. Ask for two trade references and call them. Then screen the company, its trading names, its directors and its disclosed owners, and keep the dated output. You can run a denied party screening check on all of those names in one pass.

Flags in the order itself

These are the classic transactional indicators, and they remain the ones that catch real diversion.

The product does not fit the customer’s line of business.
The item’s technical level exceeds anything the destination market plausibly needs or supports.
The customer is indifferent to product specifications, or cannot describe them, but insists on that exact item.
Installation, training, warranty or maintenance is declined on equipment that normally requires it.
Payment is offered in full cash or immediate wire when financing terms are standard for that value.
Quantities make no commercial sense, such as spare parts ordered far in excess of any reasonable service requirement.
The customer cannot say whether the item will stay in country, be exported, or be re-exported onward.
Delivery dates are vague, or the buyer asks you to hold shipment for instructions.

Three of these are strong on their own. A declined installation package on complex equipment usually means the buyer is not the user. An indifference to specification usually means someone else wrote the specification. And an inability to state whether goods will be re-exported usually means the buyer knows the answer and does not want to give it.

Flags in the route and the logistics

Routing flags have become the centre of gravity in current enforcement. Goods rarely move to a restricted destination directly. They move through a third country first.

A freight forwarder’s address is given as the final destination or the end user.
The shipping route is uneconomic, with legs that add cost for no commercial reason.
Packaging is inconsistent with the stated shipping method, the destination climate or the declared value.
The buyer arranges its own collection and will not disclose the onward destination.
The delivery country has no industry that uses the item, but has a sharp recent rise in imports of that product category.
The consignee differs from the buyer and from the party paying, with no explanation.

That last pattern, where buyer, consignee and payer are three different parties in three different countries, is the shape most transshipment schemes take. Screen all three. The same applies to the forwarder itself, which is covered in the guidance on screening freight forwarders.

One tool worth knowing about is the Common High Priority List, a set of goods identified by US and partner authorities as being of particular concern for diversion. It is organised by Harmonized System code, which means you can check your own product codes against it and see whether your catalogue sits in a monitored category. That is a concrete step most exporters have never taken.

Flags in payment and documents

Finance staff see things the sales team does not.

Payment arrives from a third party unconnected to the contract.
The paying bank sits in a jurisdiction with no link to the buyer or the goods.
The buyer asks to split one order into several invoices below a threshold.
Invoice value is obviously out of line with the market price for the goods, in either direction.
Documents contain reused reference numbers, inconsistent dates, or a description of goods that differs between the invoice and the packing list.
The buyer requests an amendment to the end user or destination after the credit is issued.

Price and quantity sanity checks are the cheapest control in this whole article and the least used. If a shipment of common industrial components is invoiced at several times the market rate, the extra value is doing something other than buying components.

Flag, meaning and action

Red flag	What it may indicate	Required action	Escalate if
Customer refuses end use information	Unauthorised end user or prohibited application	Request a signed end user statement naming the site and the use	The statement is refused, unsigned or generic
Forwarder listed as end user	Onward diversion to an undisclosed destination	Require the actual end user name, address and contact	The buyer will not identify the party behind the forwarder
Product mismatched to buyer’s business	Buyer is a front or an intermediary	Verify operations by registry, website, references and site photos	No evidence of real operating capacity
Installation and training declined	Buyer is not the user of the equipment	Ask who will install and operate it, and where	The answer names a party in a different country
Ownership cannot be determined	Restricted party behind a clean named entity	Request an ownership chart with percentages; screen every layer	Any layer traces to a listed party or stays opaque
Third party payment	Concealment of the true counterparty	Hold funds, screen the payer, require an explanation in writing	The payer has no contractual role in the sale
Uneconomic routing	Transshipment through a permissive jurisdiction	Ask for the commercial rationale; screen each transit party	No rationale is offered, or the route changes after order
Post-contract change of destination	Original destination was a cover	Re-run the full check against the new destination and end user	The change moves goods toward a controlled destination

The inquiry step people skip

A red flag creates a duty to inquire. That duty has a shape, and most companies never define it.

Place a hold on the order in the system, so it cannot ship while the question is open. A hold that lives only in someone’s inbox is not a hold.
Write down the specific flag and the specific question it raises. Vague notes are worthless later.
Ask the customer directly and in writing. Email is better than a phone call because it produces a record.
Verify the answer independently where you can. A stated end use site can be checked against a registry, a map and the customer’s own website.
Screen every party the answer introduces, including new consignees, agents and payers.
Decide, and write the reasoning in one paragraph. Name the person who decided.
If the flag is not resolved, decline the order. Depending on the item, the destination and your jurisdiction, you may also have a reporting obligation.

Step six is the one that matters in an audit. Regulators rarely fault a company for having red flags in its order book. They fault it for having no record of what it did about them. The article on building a usable audit trail goes into how to structure that evidence.

Telling a red flag apart from a false positive

These are different things and they get confused constantly. A false positive is a name matching problem. Your screening returned a hit because “Pacific Trading Ltd” resembles a listed entity, and the address, country and registration number do not match. That clears with a comparison of secondary identifiers, and the method is set out in the guide to clearing a false positive.

A red flag is a behavioural or commercial anomaly. No list is involved. Your screening can come back completely clean and the order can still be wrong. Plenty of diversion is carried out by entities that appear on no list at all, which is precisely why the flag catalogue exists alongside list screening rather than instead of it.

Treat them separately in your workflow. Different queues, different resolution criteria, different evidence.

Building the flags into the process

A list pinned to a wall changes nothing. The flags need to sit at the points where the information first appears.

Put the profile flags into the customer onboarding form as required fields, so an unanswered ownership question blocks account creation. Put the order flags into the sales order screen as a short checklist the salesperson completes. Put the routing flags with whoever books the freight. Put the payment flags with finance, on the receipt reconciliation. Nobody sees all of them, which is why a single compliance gate at the end fails.

Train for it too. Sales staff will spot a customer who cannot describe the product they are ordering long before any system does, but only if they have been told that this is a reportable observation rather than an awkward call. Short, role specific sessions work better than an annual slide deck, as covered in the piece on running compliance training that sticks.

Pair the flag checklist with automated list screening at order entry and at shipment release. Destinations and parties change between those two points more often than people expect. Globalior’s free screening tool covers the main consolidated lists, and you can screen a party against restricted party lists before you release a held order.

Key takeaways

The published US red flag guidance sits in Supplement No. 3 to Part 732 of the Export Administration Regulations and has been expanded repeatedly since the 1990s.
The list is guidance and not exhaustive, so an indicator that does not appear on it can still put you on notice.
Knowledge in the export rules includes awareness of a high probability, so declining to ask a question does not remove the obligation.
Routing flags carry the most weight in current enforcement, and the buyer, consignee and payer being three unrelated parties is the classic transshipment shape.
A red flag is a behavioural anomaly and a false positive is a name matching error; they need separate queues and separate resolution criteria.
The Common High Priority List is organised by Harmonized System code, so exporters can check their own product codes against monitored categories.
An unresolved flag means declining the order, and the written record of the decision is what defends the file later.

Frequently asked questions

How many red flags does it take before I should refuse an order?

There is no count. One unresolved flag is enough to stop a shipment, and several resolved flags may leave a perfectly acceptable order. What matters is whether each flag was inquired into and answered satisfactorily. If a customer gives a plain, verifiable explanation, document it and proceed. If the explanation cannot be checked, treat the flag as live.

Does clean screening mean the order is safe to ship?

No. List screening catches named parties. It does not catch an unlisted intermediary buying on behalf of a listed one, which is exactly how diversion usually works. Screening and red flag review are two separate controls, and passing one does not substitute for the other.

Should I tell the customer why their order is on hold?

You can ask the questions the flag raises without describing your internal process or naming a screening result. Requesting an end user statement or an ownership chart is ordinary commercial practice. Where a sanctions match is involved, disclosure rules differ by jurisdiction and by list, so take advice before saying anything about a match.

Who in the business should own red flag review?

Detection belongs to the people who see the data first: sales, logistics and finance. The decision to release or refuse should sit with one named role with authority to stop a shipment, usually trade compliance. Splitting detection widely and decisions narrowly is what makes the control work.

Do red flags apply to existing customers or only new ones?

Both. Long standing customers change ownership, change buying patterns and acquire new end users. A sudden order for an item outside the normal catalogue, or a request to ship to a country the customer has never used, is a flag regardless of how long the relationship has run.

What should an end user statement actually contain?

The end user’s legal name and registered address, the physical site where the item will be used, a description of the specific application, a statement on whether it will be re-exported, and a signature from someone with authority. A one line declaration with no site address and no named application does not resolve anything.

How long should I keep records of a resolved red flag?

Keep them with the export file for the same period as the rest of the transaction record, which is set by the rules of the jurisdiction you export from. Keep the inquiry, the customer’s answer, the screening output with its date and the named decision. A resolution note with no supporting evidence attached is weak in a review.

If you want help turning this catalogue into a checklist your sales and logistics teams will actually use, contact the Globalior team.