There is wide experience internationally of producing risk indicators or indices for money laundering or illicit financial flows. FATF has sought to develop “red-flag” indicators in a number of their reports to help both the financial and government sectors identify instances of money laundering (ML) or TF activity. However, identifying specific terrorist financing indicators presents a different (and more difficult) challenge, for several reasons. The concept of risk is both broad and complex. This report will not use the term “red-flag” and will limit itself to the use of one general term, risk indicator, which can be used to help identify instances of terrorist or TF activity. A risk indicator demonstrates or suggests the likelihood of the occurrence of suspicious activity. While a number of the factors identified may not appear to have any direct connection with terrorism or terrorist financing, they are nonetheless relevant when trying to identify this type of activity. One indicator, or a group of indicators, can provide a lead which requires more analysis. The indicators identified are just one aspect of a larger overall picture of potential terrorist or TF risk.

By extension it's also used by anyone investigating any sort of problem (eg, a computer specialist trying to work out why a computer's broken down) to mean an 'initial indication' as to what caused the problem.

Example:
'Detectives investigating the murder are pursuing a number of leads'.