How it works
Structuring, also called smurfing, splits a large sum into a series of smaller deposits or transfers that each sit below the reporting threshold. The amounts are chosen to avoid a cash transaction report or an internal review limit, not because of any business need. The deposits may be made by one person over several days, or by several people at different branches on the same day.
Rules that look at each transaction in isolation miss it, because every individual deposit is unremarkable on its face. The pattern only appears when deposits are aggregated per customer, per beneficiary and per linked account over a rolling window. Experienced structurers vary the amounts, rotate branches and ATMs, and spread activity across relatives' accounts to stay under per-account aggregation as well.
In mobile-money markets the same behavior appears as repeated cash-ins at different agents just below the wallet or transaction limit, followed by consolidation into one wallet or bank account. In several jurisdictions, including the US and South Africa, deliberately arranging transactions to avoid a reporting duty is an offense in its own right, whatever the source of the funds.
Red flags
- Repeated cash deposits just below the reporting threshold, often within days of each other
- One customer's deposits split across several branches, ATMs or agents on the same day
- Several third parties depositing into one account in amounts that each stay under the threshold
- Amounts that sit at a consistent margin below the threshold instead of varying naturally
- A customer who asks about reporting limits, or reduces a deposit after learning a report will be filed
- Withdrawal or transfer of the accumulated balance soon after the deposits stop
Signals the engine evaluates
- Cash deposits per customer across rolling daily and weekly windows, against the reporting threshold
- Share of a customer's deposits that fall in a narrow band just below the threshold, compared with their own baseline
- Distinct depositors, branches, ATMs and agents paying into one account within the same window
- Aggregated cash activity across accounts that entity resolution links to the same person, phone or address
- Time between the last deposit and the onward transfer or withdrawal of the consolidated balance
Investigation and response
- 01Aggregate the customer's activity across all linked accounts and channels to establish the full amount and period involved.
- 02Review the KYC file and stated source of funds against the cash volumes, and check whether the activity fits the customer's occupation or business.
- 03Open a case, attach the transaction timeline, and record the analyst's reasoning for or against suspicion.
- 04File a suspicious transaction report with the relevant financial intelligence unit, such as the FIC in South Africa or FinCEN in the US, and avoid any contact with the customer that could tip them off.