Structuring

The core mechanism of structuring involves breaking a large cash sum into multiple transactions, each falling below the $10,000 Currency Transaction Report (CTR) threshold. Criminals manipulate deposit amounts to stay just under the limit—often using amounts like $9,900—to avoid triggering automated regulatory filings. This is distinct from legitimate business practices where transaction sizes naturally vary.

Structuring is not random; it follows detectable temporal sequences. Key patterns include:

• Rapid-fire deposits: Multiple transactions at the same branch within minutes
• Multi-branch routing: Visiting different branches on the same day to avoid teller recognition
• Calendar cycling: Structuring activity clustered around specific days to exploit perceived gaps in monitoring
• Velocity spikes: Sudden bursts of sub-threshold activity after a period of dormancy

Structuring manifests in two primary operational modes:

Solo Structuring: A single individual personally conducts all sub-threshold transactions, often using multiple accounts at the same institution.

Smurfing: A coordinated network of individuals—smurfs—each conducting small transactions to distribute the structuring activity across many people and geographies, making detection significantly harder. Smurfing is a subset of structuring that introduces collusive network topology into the pattern.

Structuring is often the entry point to the layering phase of money laundering. Once cash is successfully deposited without triggering a CTR, criminals initiate complex transfers between accounts, institutions, and jurisdictions to obscure the audit trail. Detection systems must correlate structuring indicators at deposit with subsequent wire transfer velocity and inter-account topology to reconstruct the full laundering sequence.

Machine learning models identify structuring through engineered features:

• Proximity-to-threshold ratio: How close transaction amounts cluster to the $10,000 boundary
• Aggregate daily velocity: Sum of all sub-threshold cash activity within a 24-hour window
• Branch dispersion index: Number of distinct physical locations visited within a short timeframe
• Beneficiary convergence: Multiple structured deposits flowing to a single destination account
• Temporal entropy: Deviation from normal transaction timing distributions

A specialized variant of structuring that distributes cash deposits across multiple individuals (smurfs) rather than a single actor. Each smurf executes transactions just below the $10,000 CTR threshold, often at different branches or institutions within a short time window. Machine learning detection relies on spatial-temporal clustering and relational network analysis to link seemingly independent smurfs to a common controller.

A mandatory filing triggered when a financial institution processes a cash transaction exceeding $10,000 in a single business day. Structuring is explicitly designed to evade CTR generation. Modern AML systems use aggregation logic to detect when multiple sub-threshold transactions from a single entity would have triggered a CTR if consolidated, flagging the pattern as potential structuring.

The second stage of money laundering that often follows structuring. Once cash is deposited in small increments, layering separates the funds from their criminal origin through complex sequences of wire transfers, shell company accounts, and financial instrument purchases. Sequence-to-sequence models and temporal graph traversal are employed to trace funds through these deliberately convoluted paths.

The confidential filing submitted to FinCEN when a financial institution detects potential structuring or other illicit activity. Unlike CTRs, SARs are judgment-based rather than threshold-based. Machine learning models assist by generating risk-ranked alerts with supporting evidence packages, enabling investigators to efficiently determine whether detected structuring patterns warrant a SAR filing.

The final laundering stage where structured and layered funds re-enter the legitimate economy. Integration methods include purchasing real estate, luxury assets, or investing in cash-intensive businesses. Detection at this stage requires cross-domain analytics linking transactional data with public records, property registries, and corporate ownership databases to identify anomalous wealth accumulation inconsistent with declared income.

The foundational AML principle requiring institutions to allocate monitoring resources proportionally to identified risk. Structuring detection models operationalize this by applying dynamic risk scoring that adjusts monitoring intensity based on customer profiles, geographic exposure, and product usage patterns. High-risk segments receive more sensitive anomaly thresholds, reducing false positives in low-risk populations.