The FATF has published a report on "red flag indicators" relating to 'Virtual Assets".

Pdf here:

http://www.fatf-gafi.org/media/fatf/documents/recommendations/Virtual-Assets-Red-Flag-Indicators.pdf

From the report: Key indicators:

1. Technological features that increase anonymity - such as the use of peer-to-peer exchanges websites, mixing or tumbling services or anonymity-enhanced cryptocurrencies

2. Geographical risks - criminals can exploit countries with weak, or absent, national measures for virtual assets

3. Transaction patterns - that are irregular, unusual or uncommon which can suggest criminal activity

4. Transaction size – if the amount and frequency has no logical business explanation

5. Sender or recipient profiles - unusual behaviour can suggest criminal activity

6. Source of funds or wealth - which can relate to criminal activity

"The mere presence of a red flag indicator is not
necessarily a basis for a suspicion of ML or TF, but could prompt further monitoring and examination.

Ultimately, a client may be able to provide an explanation to justify
the red flag indicator.."

(Page 4)

"Often, it is the presence of multiple indicators in a transaction with no logical business explanation that raises suspicion of potential criminal activity."

(Page 5)

Red Flag Indicators Related to Anonymity includes "Transactions making use of mixing and tumbling services, suggesting an intent to obscure the flow of illicit funds between known wallet addresses and
darknet marketplaces."

(Page 9)

This sounds like they are talking about custodial services rather then CoinJoin tools. Helix is an example they use in Case Study 6 on Page 11.

"VAs transferred to or from wallets that show previous patterns of activity
associated with the use of VASPs that operate mixing or tumbling services or
P2P platforms." (Page 9)

Not clear which VASPs provide mixing or tumbling services? Any ideas?

Also unclear whether P2P platforms here is refering to exchanges as in the 3rd bullet point on Page 9, or whether they intend to refer to CoinJoin implementations. My guess would be the former.

Red Flag Indicators in the Source of Funds or Wealth includes "A customer’s funds which are sourced directly from third-party mixing services or wallet tumblers." (Page 15).

"wallet tumblers" probably refers to CoinJoin implementations.

This is nothing unexpected or new. And as explained above in this thread, having a red flag doesn't mean the VASP can't continue business with you - it just means they need to look carefully.