This safeguard is directed primarily at Money-mule transfers rather than Cash-deposit structuring, because money mules help move proceeds while separating the originator from subsequent recipients. Unlike the control for Money-mule transfers, the more direct design for Cash-deposit structuring is to monitor connected cash activity rather than relying on each transaction separately; a different safeguard cannot substitute for it.

This safeguard is directed primarily at Terrorist-financing source distinction rather than Cash-deposit structuring, because terrorist financing can involve legitimately sourced money; destination and intended use are central concerns. Unlike the control for Terrorist-financing source distinction, the more direct design for Cash-deposit structuring is to monitor connected cash activity rather than relying on each transaction separately; a different safeguard cannot substitute for it.

This safeguard is directed primarily at Suspicious-activity reporting decision rather than Cash-deposit structuring, because a SAR or STR is a suspicion-based regulatory tool; examiners need not prove criminal guilt before considering it. Unlike the control for Suspicious-activity reporting decision, the more direct design for Cash-deposit structuring is to monitor connected cash activity rather than relying on each transaction separately; a different safeguard cannot substitute for it.

The proposed observation fits Authorized-maker self-payment, where authority to sign does not confer permission to take company funds for personal use, rather than the particular mechanism in ACH beneficiary substitution. Unlike the clue for Authorized-maker self-payment, the more directly related indicator for ACH beneficiary substitution is this: Recent bank-account changes precede transfers while invoices remain otherwise valid.

The proposed observation fits Concealed check diversion, where the cash leaves via an unauthorized payment camouflaged by accounting classification, rather than the particular mechanism in ACH beneficiary substitution. Unlike the clue for Concealed check diversion, the more directly related indicator for ACH beneficiary substitution is this: Recent bank-account changes precede transfers while invoices remain otherwise valid.

The proposed observation fits Shell-company invoice billing, where a nonoperating entity receives organizational money against false billing support, rather than the particular mechanism in ACH beneficiary substitution. Unlike the clue for Shell-company invoice billing, the more directly related indicator for ACH beneficiary substitution is this: Recent bank-account changes precede transfers while invoices remain otherwise valid.

The evidence test relates to Fictitious travel reimbursement, whereas the proposed safeguard protects against Payroll direct-deposit diversion; neither directly resolves Terminated worker retained on payroll. Unlike the Fictitious travel reimbursement test and Payroll direct-deposit diversion safeguard, the investigation of Terminated worker retained on payroll requires reviewers to compare termination events and exit records to pay runs and account beneficiaries, followed by assessment of the matching control point.

The proposed safeguard is relevant to Terminated worker retained on payroll, but the diagnostic tests Unauthorized bonus disbursement rather than the identified anomaly. That test is aimed at records involving bonus payouts lack approved evaluation and authorization records; the specified case instead calls for reviewers to compare termination events and exit records to pay runs and account beneficiaries.

The diagnostic correctly examines Terminated worker retained on payroll by having reviewers compare termination events and exit records to pay runs and account beneficiaries, but the safeguard is for Fictitious travel reimbursement. That prevention step responds to a different mechanism: The claimant seeks payment for an expense that was never incurred.

The proposed observation fits Privileged bulk data export, where excess technical privilege can permit insider misappropriation of valuable information, rather than the particular mechanism in Supplier-access data theft. Unlike the clue for Privileged bulk data export, the more directly related indicator for Supplier-access data theft is this: Third-party login activity reaches repositories outside contracted support scope.

The proposed observation fits Spear-phishing product drawings, where deceptive credential collection enables unauthorized access to proprietary engineering data, rather than the particular mechanism in Supplier-access data theft. Unlike the clue for Spear-phishing product drawings, the more directly related indicator for Supplier-access data theft is this: Third-party login activity reaches repositories outside contracted support scope.

The proposed observation fits Printed blueprint removal, where optical capture can remove trade secrets without any network download event, rather than the particular mechanism in Supplier-access data theft. Unlike the clue for Printed blueprint removal, the more directly related indicator for Supplier-access data theft is this: Third-party login activity reaches repositories outside contracted support scope.

Fictitious register refund would involve a different sequence from Fictitious travel reimbursement: the false disbursement is disguised as money returned to a customer. Unlike the rejected Fictitious register refund label, the evidence concerns Fictitious travel reimbursement, since travel bookings and attendance logs do not support the submitted expenses; reviewers should verify lodging invoices with approved travel itineraries and actual attendance.

Unauthorized bonus disbursement would involve a different sequence from Fictitious travel reimbursement: improper one-off payments exploit weak controls over discretionary compensation. Unlike the rejected Unauthorized bonus disbursement label, the evidence concerns Fictitious travel reimbursement, since travel bookings and attendance logs do not support the submitted expenses; reviewers should verify lodging invoices with approved travel itineraries and actual attendance.

Duplicate expense reimbursement would involve a different sequence from Fictitious travel reimbursement: one real expense is reimbursed more than once, inflating the employee's recovery. Unlike the rejected Duplicate expense reimbursement label, the evidence concerns Fictitious travel reimbursement, since travel bookings and attendance logs do not support the submitted expenses; reviewers should verify lodging invoices with approved travel itineraries and actual attendance.

The proposed observation fits Staged vehicle collision claim, where a staged loss creates the insured event rather than merely exaggerating a genuine accident, rather than the particular mechanism in Inflated auto repair estimate. Unlike the clue for Staged vehicle collision claim, the more directly related indicator for Inflated auto repair estimate is this: Photographs and parts invoices do not support the paid repair estimate.

The proposed observation fits Intentional property fire claim, where deliberate creation of a loss may defeat coverage and constitutes a different risk from accidental damage, rather than the particular mechanism in Inflated auto repair estimate. Unlike the clue for Intentional property fire claim, the more directly related indicator for Inflated auto repair estimate is this: Photographs and parts invoices do not support the paid repair estimate.

The proposed observation fits Fictitious beneficiary change, where the scheme tampers with policy entitlement rather than misrepresenting the insured event, rather than the particular mechanism in Inflated auto repair estimate. Unlike the clue for Fictitious beneficiary change, the more directly related indicator for Inflated auto repair estimate is this: Photographs and parts invoices do not support the paid repair estimate.

The proposed observation fits Insurance premium diversion, where the intermediary misappropriates premium cash without necessarily creating a false claim, rather than the particular mechanism in Inflated auto repair estimate. Unlike the clue for Insurance premium diversion, the more directly related indicator for Inflated auto repair estimate is this: Photographs and parts invoices do not support the paid repair estimate.

The proposed observation fits Equity reconciliation, where equity is the residual interest in assets after deducting liabilities, not a bank balance or revenue figure, rather than the particular mechanism in Accounting-framework selection. Unlike the clue for Equity reconciliation, the more directly related indicator for Accounting-framework selection is this: The same transaction receives conflicting treatment because preparers use incompatible rulebooks.

The proposed observation fits Gross-profit calculation, where gross profit isolates direct goods margin rather than the final earnings after all operating and other costs, rather than the particular mechanism in Accounting-framework selection. Unlike the clue for Gross-profit calculation, the more directly related indicator for Accounting-framework selection is this: The same transaction receives conflicting treatment because preparers use incompatible rulebooks.

The proposed observation fits Accrued service revenue, where under accrual accounting, revenue relates to the period when the service was performed, not simply the invoice or cash date, rather than the particular mechanism in Accounting-framework selection. Unlike the clue for Accrued service revenue, the more directly related indicator for Accounting-framework selection is this: The same transaction receives conflicting treatment because preparers use incompatible rulebooks.

This comparison primarily addresses Unsuitable securities recommendation, in which a sale can be improper because the recommendation does not match the customer's circumstances, not because the product itself is inherently unlawful; because the present question instead concerns Excessive-account churning, reviewers should analyze account turnover, costs, broker control and trading justifications rather than apply a check designed for Unsuitable securities recommendation.

This comparison primarily addresses False sustainability disclosures, in which nonfinancial representations can deceive securities investors when inaccurate or unsupported; because the present question instead concerns Excessive-account churning, reviewers should analyze account turnover, costs, broker control and trading justifications rather than apply a check designed for False sustainability disclosures.

This comparison primarily addresses Unregistered brokerage solicitation, in which securities-related compensation and solicitation can trigger registration obligations under relevant laws; because the present question instead concerns Excessive-account churning, reviewers should analyze account turnover, costs, broker control and trading justifications rather than apply a check designed for Unregistered brokerage solicitation.

This comparison primarily addresses Invented procurement need, in which procurement fraud can begin before bids when a false organizational need is created; because the present question instead concerns Post-award change-order inflation, reviewers should compare original scope, approved modifications and actual field measurements rather than apply a check designed for Invented procurement need.

This comparison primarily addresses Nonconforming material substitution, in which the vendor obtains full payment while supplying inferior goods; because the present question instead concerns Post-award change-order inflation, reviewers should compare original scope, approved modifications and actual field measurements rather than apply a check designed for Nonconforming material substitution.

This comparison primarily addresses Contractor cost mischarging, in which miscoding expenses shifts ineligible work costs onto the purchasing agency; because the present question instead concerns Post-award change-order inflation, reviewers should compare original scope, approved modifications and actual field measurements rather than apply a check designed for Contractor cost mischarging.

The proposed observation fits Economic extortion demand, where extortion relies on coercive leverage over a decision or entitlement rather than a voluntary gratuity, rather than the particular mechanism in Lavish hospitality influence. Unlike the clue for Economic extortion demand, the more directly related indicator for Lavish hospitality influence is this: Benefits rise immediately before procurement decisions involving the sponsor.

The proposed observation fits Inflated charitable donation conduit, where an apparent donation may disguise a benefit routed to someone able to influence business, rather than the particular mechanism in Lavish hospitality influence. Unlike the clue for Inflated charitable donation conduit, the more directly related indicator for Lavish hospitality influence is this: Benefits rise immediately before procurement decisions involving the sponsor.

The proposed observation fits Undisclosed supplier ownership, where a personal interest compromises objectivity even before a direct bribe is proven, rather than the particular mechanism in Lavish hospitality influence. Unlike the clue for Undisclosed supplier ownership, the more directly related indicator for Lavish hospitality influence is this: Benefits rise immediately before procurement decisions involving the sponsor.

File A is misidentified as Synthetic identity borrowing instead of Identity-based tax refund diversion; File B is misidentified as Identity-based tax refund diversion instead of Synthetic identity borrowing. With the proposed pairing Synthetic identity borrowing / Identity-based tax refund diversion, the distinction is substantive: File A shows that competing returns share a taxpayer identity but have inconsistent filing devices and bank details, whereas File B shows that identity attributes do not reliably resolve to one genuine person across independent sources. For these Identity-based tax refund diversion and Synthetic identity borrowing files, choosing the pair Synthetic identity borrowing / Identity-based tax refund diversion would misdirect the review away from at least one of these mechanisms.

File B is misidentified as Phishing identity-document collection instead of Synthetic identity borrowing. With the proposed pairing Identity-based tax refund diversion / Phishing identity-document collection, the distinction is substantive: File A shows that competing returns share a taxpayer identity but have inconsistent filing devices and bank details, whereas File B shows that identity attributes do not reliably resolve to one genuine person across independent sources. For these Identity-based tax refund diversion and Synthetic identity borrowing files, choosing the pair Identity-based tax refund diversion / Phishing identity-document collection would misdirect the review away from at least one of these mechanisms.

File A is misidentified as Stolen-personal-data loan instead of Identity-based tax refund diversion. With the proposed pairing Stolen-personal-data loan / Synthetic identity borrowing, the distinction is substantive: File A shows that competing returns share a taxpayer identity but have inconsistent filing devices and bank details, whereas File B shows that identity attributes do not reliably resolve to one genuine person across independent sources. For these Identity-based tax refund diversion and Synthetic identity borrowing files, choosing the pair Stolen-personal-data loan / Synthetic identity borrowing would misdirect the review away from at least one of these mechanisms.