Bank Statement Red Flags for Underwriters: 22 Patterns That Should Slow a File Down
A red flag is a question, not a verdict. Almost every pattern below has a mundane explanation, and the analyst's job is to ask rather than assume. What separates a good underwriter is knowing which patterns deserve a question in the file, and which four should stop the file until someone senior looks.
Key facts
- YuSight has supported 10 Mn credit journeys, and the Bank Statement Analyzer surfaces these patterns as flagged, citable line items in the memo rather than as a score the analyst cannot interrogate.
- Statement-borne fraud is not a rare event. US financial institutions filed over 680,000 check fraud-related Suspicious Activity Reports in 2022, nearly double the 350,000-plus filed in 2021 (FinCEN Alert on Nationwide Surge in Mail Theft-Related Check Fraud, 27 February 2023).
- One pattern has a bright-line regulatory definition. A US bank must file a Currency Transaction Report for each currency transaction over $10,000, and multiple cash-in or cash-out transactions in one business day aggregate to a single transaction (FFIEC BSA/AML Examination Manual, Currency Transaction Reporting). Deliberately arranging deposits below it is prohibited outright (31 CFR 1010.314).
- Most of these flags resolve. The cost of asking is one email; the cost of not asking is a file you cannot defend at review.
- Only 4 of the 22 below are stop-the-file patterns. The severity table sets out which, and why the other 18 belong in the memo as questions with recorded answers.
How should you use this list?
Three rules first.
Document the question and the answer, not just the flag. A memo that says "cash deposits elevated" is worse than useless. A memo that says "cash rose from 8.0% to 27.3% of credits over six months; borrower attributes it to two distributor accounts converting to cash-on-delivery; supported by invoice sample and GST filing; accepted" is a defensible credit decision.
One flag is noise. Three that point the same way are a finding. Patterns cluster. Round-tripping, a thin buffer and a utilisation ratchet in the same file describe one story, not three.
Never resolve a flag in the borrower's favour by inference. If you cannot get the document, the flag stays open in the memo. That one discipline separates an audit-ready file from an argument.
Which round-tripping and circular patterns should slow a file down?
1. Same-day in-and-out between the same two accounts
In the statement: a credit from Entity B and a near-identical debit to Entity B on the same value date, repeated monthly.
Might innocently mean: group treasury sweeping, an intercompany current account, a payment routed through an affiliate.
Might indicate: turnover inflation — two accounts passing the same money back and forth manufacture credit turnover from nothing.
Ask: for the intercompany ledger and the commercial basis for each leg. If net movement across six months is near zero, the gross was never revenue.
2. A credit that leaves within 48 hours to a different third party
In the statement: money arrives from A and departs to C within a day or two, leaving no residue. The account is a corridor, not a destination.
Might innocently mean: a pass-through business — freight forwarding, travel consolidation, a commission agent who collects and remits.
Might indicate: declared turnover is other people's money, so cash available for debt service is a fraction of gross credits.
Ask: what proportion of credits the borrower keeps, and reconcile that margin to the P&L.
3. Month-end spikes that unwind on the first working days
In the statement: a large credit lands on the 29th to 31st and exits on the 1st or 2nd. Closing balances look far healthier than daily ones.
Might innocently mean: genuine month-end collections concentration.
Might indicate: window dressing — balances arranged for a balance certificate, a drawing power submission or a stock statement date.
Ask: for daily average balance and compare the two. If your assessment used month-end figures, redo it.
4. The largest payers are also the largest payees
In the statement: build the counterparty graph. The top three sources of credits also sit among the top three destinations of debits.
Might innocently mean: a genuine two-way trading relationship — common in commodities, distribution and job work.
Might indicate: circularity dressed as scale. Netting the flows often shrinks apparent turnover sharply.
Ask: for the net position with each counterparty and the invoices behind both directions.
What cash patterns should you question?
5. Cash rising as a share of credits while total credits fall
In the statement: cash deposits grow in absolute terms while banked non-cash receipts shrink. Worked below.
Might innocently mean: a real channel shift — losing an institutional customer, replacing it with retail counter sales.
Might indicate: revenue reconstructed from undocumented sources to keep the banking record intact.
Ask: for sales mix by channel and a reconciliation to tax filings for the same months.
6. Repeated deposits just under the reporting threshold
In the statement: deposits clustered in a narrow band below the local cash reporting trigger — $10,000 in the United States — often across days or branches, none crossing it.
Might innocently mean: almost nothing. Genuine cash takings do not avoid a threshold this precisely.
Might indicate: structuring, prohibited in its own right under 31 CFR 1010.314 regardless of where the cash came from.
Ask: nothing yet. Escalate to compliance before contacting the borrower — tipping off is its own problem.
7. Cash deposited far from every declared place of business
In the statement: branch or ATM codes mapping to towns the borrower does not operate in.
Might innocently mean: a travelling director, a collection agent, or a second location never mentioned.
Might indicate: deposits made by someone other than the business, or an undisclosed operation.
Ask: who physically makes the deposits, and for every operating address.
8. Cash in and cash out matching within the same week
In the statement: large cash deposits followed by cash withdrawals of similar size, leaving no working balance.
Might innocently mean: a business paying wages, farmers or transporters in cash — agri trading, construction labour, mandi operations.
Might indicate: the account is giving cash a banking history rather than running a business.
Ask: for the cash payment ledger and payee categories. Legitimate cash-out has names attached.
Which related-party flows deserve a question?
9. Remuneration debits that dwarf the declared payroll
In the statement: monthly transfers to two or three named individuals, materially larger than the P&L salary line.
Might innocently mean: promoter drawings classified elsewhere, or remuneration accrued differently from how it is paid.
Might indicate: extraction that continues after your disbursement, reducing the surplus you underwrote.
Ask: to reconcile every recurring personal transfer to a line in the financials.
10. One-way transfers to a connected entity
In the statement: regular debits to a company sharing a director, address or surname, with no inflows on commercial terms.
Might innocently mean: a genuine loan to a group entity, shared premises costs, a service arrangement.
Might indicate: funds leaving the borrower to support a weaker entity your assessment never saw — which is what multi-entity document mapping exists to catch.
Ask: for the related-party schedule and the receiving entity's financials.
11. The borrower services a related party's loan directly
In the statement: an EMI or mandate debit to a lender, on a facility belonging to another entity or an individual.
Might innocently mean: a formal arrangement where the group services a shared asset — a jointly used vehicle or property.
Might indicate: an off-balance-sheet obligation. True debt service is higher than the balance sheet shows and your DSCR is overstated.
Ask: whose facility it is, whether the borrower is a guarantor, and add it to the obligations schedule (DSCR formula variants).
12. A promoter infusion that arrives and leaves inside the window
In the statement: a large unsecured credit from a director or promoter, repaid at similar size weeks later.
Might innocently mean: genuine bridging of a temporary gap.
Might indicate: temporary equity — capital shown for a balance sheet date or a margin requirement, not committed to the business.
Ask: for the loan agreement, the repayment terms, and a subordination undertaking if you are relying on that capital.
What servicing patterns signal stress?
13. An obligation in the bureau that never appears in the statement
In the statement: nothing — that is the point. The bureau shows an active facility; no matching debit exists in any account you hold.
Might innocently mean: it is serviced from an account you were not given.
Might indicate: it is not being serviced at all, or there is an account you have not seen. Either way the file is incomplete — see bureau vs bank statement reconciliation.
Ask: for that account's statement. Not an explanation — the statement.
14. A recurring debit that looks like an EMI and appears nowhere in the bureau
In the statement: a fixed amount on a fixed day each month to a counterparty that is not a utility, landlord or supplier.
Might innocently mean: a lease, an insurance premium, a subscription, an instalment purchase.
Might indicate: undisclosed borrowing — an unregulated lender, a fintech reporting late, a private party. Size it from the instalment and add it to leverage.
Ask: what the debit is, and for the agreement behind it.
15. Servicing that always follows a large receipt by a day or two
In the statement: the EMI debit is never on the same day. It lands one to three days after whichever large credit arrives first.
Might innocently mean: deliberate cash management by a team that keeps balances lean.
Might indicate: servicing is receipt-dependent, not surplus-dependent — one delayed customer payment becomes a missed instalment (repayment track record analysis).
Ask: what happens in a month with no large receipt — then find the month where it already happened.
16. Loan-servicing debits growing faster than credits
In the statement: total monthly servicing rises quarter on quarter while credits are flat or falling. Compute both slopes and set them side by side.
Might innocently mean: planned capex drawn down, with the revenue effect still to arrive.
Might indicate: new borrowing absorbing a rising share of cash flow — the classic pre-default trajectory.
Ask: for the sanction letters behind every facility added in the window, and the revenue those assets were meant to produce.
What does balance behaviour reveal?
17. An average balance below the largest single monthly obligation
In the statement: average balance of 180,000 against a largest recurring obligation of 420,000. The account cannot absorb one bad week.
Might innocently mean: disciplined treasury, with funds swept to a linked deposit.
Might indicate: no buffer at all. Your proposed instalment lands on an account that already has none.
Ask: where the operating buffer is held, and for that account's statement.
18. Utilisation that ratchets upward with no seasonal reversal
In the statement: average utilisation of a cash credit or overdraft climbing quarter on quarter — 79%, 83%, 88%, 94% — without the trough a working capital cycle should produce.
Might innocently mean: genuine growth in the working capital cycle that the limit has not caught up with.
Might indicate: the limit is funding losses rather than the cycle. Continuity matters more than the peak: under India's asset classification norms a cash credit account becomes "out of order" when the outstanding "remains continuously in excess of the sanctioned limit/drawing power for 90 days" (RBI, Master Circular on IRACP norms, 1 April 2023).
Ask: for the drawing power computation and the stock statements behind it.
19. The account bottoms out on the same days every month
In the statement: minimum balance falls to near zero, or utilisation touches the ceiling, on the same two or three dates each month.
Might innocently mean: payroll and statutory dues landing together on a fixed date.
Might indicate: a chronic timing squeeze a monthly average hides completely. Adding an instalment on those dates is the decision you are actually making.
Ask: which obligations fall on those dates, and whether your instalment date can avoid them.
Which statement-integrity flags stop a file?
These are different in kind. The earlier groups ask questions about a business; these ask whether the document is real. Full method in how do you detect a fake or tampered bank statement.
20. A running balance that does not foot
In the statement: opening balance plus credits minus debits does not equal the closing balance, on one line or across a page.
Might innocently mean: a parsing error, a hold or lien shown outside the running total, or a mid-period reissue.
Might indicate: an inserted or deleted transaction. The most reliable tampering test there is.
Ask: for the statement again, direct from the bank or through a consented feed. Do not accept a re-sent copy of the same PDF.
21. Missing pages or a discontinuous period
In the statement: page 4 of 11 absent, a serial gap, or a date range skipping days the bank certainly posted on.
Might innocently mean: a download or print error, or a bank issuing statements per cycle rather than per calendar month.
Might indicate: removal of a period containing returns, an undisclosed facility, or a balance the borrower would rather you not see.
Ask: for the complete set with unbroken page numbering, and check balances chain across every boundary.
22. Charge lines with no underlying transaction
In the statement: a cheque return charge with no returned cheque, penal interest with no excess, a mandate failure fee with no failed mandate.
Might innocently mean: batched charges debited at month end, which is common and legitimate.
Might indicate: the underlying entries were removed and the fee lines missed. Fees are the trace tampering forgets — which is why cheque bounce analysis starts at the charge ledger.
Ask: for the return memos and charge schedule, then rebuild the missing entries from them.
A worked example: reading flag 5 properly
A distribution business, six months, amounts in USD.
Month | Total credits | Cash deposits | Cash as % of credits |
|---|---|---|---|
M1 | 482,000 | 38,500 | 8.0% |
M2 | 441,000 | 45,200 | 10.2% |
M3 | 397,000 | 60,100 | 15.1% |
M4 | 354,000 | 68,800 | 19.4% |
M5 | 318,000 | 74,200 | 23.3% |
M6 | 291,000 | 79,500 | 27.3% |
Step 1 — the headline that misleads. Total credits fell from 482,000 to 291,000: (482,000 − 291,000) ÷ 482,000 = 39.6%. An analyst reporting "turnover down 40%" has told half the story.
Step 2 — strip the cash out. Non-cash credits, M1: 482,000 − 38,500 = 443,500. M6: 291,000 − 79,500 = 211,500.
Step 3 — the real decline. (443,500 − 211,500) ÷ 443,500 = 52.3%. Banked, documented, traceable receipts more than halved.
Step 4 — the cash trend runs the other way. (79,500 − 38,500) ÷ 38,500 = +106.5% while the business shrank.
Step 5 — look inside M6's cash. Nine deposits totalling 79,500. Six of them fall between 9,200 and 9,700, averaging 9,450: 6 × 9,450 = 56,700, or 56,700 ÷ 79,500 = 71.3% of the month's cash. Not one deposit crosses 10,000.
Step 6 — extend it. Across M5 and M6, cash of 74,200 + 79,500 = 153,700, of which eleven deposits in the 9,000–9,999 band account for 11 × 9,450 = 103,950, or 67.6%.
The judgement. Flag 5 on its own is a question about channel mix. Flag 5 plus flag 6 is not a question for the borrower at all — it is a referral to compliance, and the credit file waits. Underwriting the 39.6% decline and missing the 52.3% one would have been the more expensive error even without the structuring pattern.
Severity table
Tier | What it means in practice | Flags |
|---|---|---|
Ask a question | Record the flag, ask the borrower, document the answer and the supporting document in the memo. Proceed once answered. | 3, 5, 9, 10, 13, 15, 16, 17, 19 |
Slow the file | Do not progress to sanction until documentary evidence is on file. Re-run the affected assessment — turnover, DSCR, drawing power — with the corrected figure. | 1, 2, 4, 7, 8, 11, 12, 14, 18 |
Stop the file | Escalate before any further borrower contact or credit work. For flag 6, escalate to compliance and do not tip off. For 20–22, the document's authenticity is in question and nothing built on it is usable. | 6, 20, 21, 22 |
Nothing here is an automatic decline. Flag 6 is a compliance referral, not a credit decision, and the other three stop-the-file flags stop it so you can get a real document — after which the analysis restarts and often completes fine.
For the method these flags sit inside, see bank statement analysis for lenders; for the ratios to re-run after resolving one, see credit analysis ratios.
FAQ
What red flags do underwriters look for in a bank statement?
Six families: circular and round-tripping flows, cash intensity and threshold behaviour, related-party movements, loan-servicing patterns, balance behaviour, and statement integrity. Within those, the highest-yield checks are round-tripping between related accounts, cash rising while banked receipts fall, and any obligation that appears in one source but not the other.
Which red flags are automatic declines?
None of them, on their own. Four should stop the file — a structuring pattern, a running balance that does not foot, missing pages, and charge lines with no underlying transaction — but stopping is not declining. Three of those four exist so you can get a genuine document and start again.
How do you document a red flag in the credit file?
Record four things: what you observed with the dates and amounts, what you asked, what the borrower answered, and which document supports the answer. A flag with no recorded answer stays open in the memo. That is the record a reviewer or examiner will actually test.
Do most bank statement red flags turn out to be innocent?
Yes, most do. That is the reason to ask rather than assume, and the reason a red flag list is worthless without the innocent explanation printed next to each pattern. The value of the list is in the questions it generates, not the conclusions it reaches.
Is a large cash-intensive business automatically higher risk?
No. Retail, food service, transport and agri-trading are legitimately cash-heavy. What matters is whether the cash mix is stable and consistent with the sector, whether it reconciles to tax filings, and whether individual deposits avoid a reporting threshold. A steady 40% cash business is easier to underwrite than one that goes from 8% to 27% in six months.
How many red flags are too many?
There is no count. Three flags that tell the same story — round-tripping, no buffer, and utilisation ratcheting up — are a finding. Six unrelated ones with documented answers are a well-underwritten file. Look for coherence between flags, not volume.
What should you do if the borrower cannot explain a flag?
Leave it open in the memo, state precisely what was requested and not provided, and let the credit committee price or decline it with that in front of them. Do not close a flag because the answer was plausible; close it because a document supported the answer.
Can software find these patterns automatically?
Pattern detection — counterparty loops, threshold clustering, recurring debits absent from the bureau — is exactly what software is good at. Deciding whether the explanation holds is not. Use the tool to make sure nothing was missed, and keep the judgement, and the citation trail, with the analyst.
Key takeaways
- A red flag is a question. Most resolve, and the discipline is asking rather than assuming.
- Group flags by the story they tell. Three pointing the same way beat six unrelated ones.
- Only four of the 22 stop a file, and even those are stops rather than declines.
- Statement-integrity flags are different in kind: they question the document, not the business, so nothing built on that document is usable until it is replaced.
- Document the question, the answer and the supporting document. A flag with no recorded answer is the finding a reviewer will pick up.
Run one borrower through the analyzer — see these patterns surface as flagged, cited line items you can interrogate rather than as a score you have to trust.
