KYC/AML for Institutional Clients and Regulatory Scrutiny

Curious how firms are navigating the increasing scrutiny on institutional client onboarding. Specifically, beyond the basic KYC, what are the most common AML red flags you're seeing in the corporate/institutional space that lead to enhanced due diligence, and how are you adapting your risk frameworks to pre-emptively address these? The regulatory landscape isn't getting any simpler, particularly with cross-border operations. Just want to hear practical insights, not legal counsel, on how people are operationalizing this.