Smurfing & Structuring: Detection Patterns for Compliance
Structuring is the oldest pattern in money laundering — and one of the most consistently inspected controls in any AML programme. The terminology is often conflated with smurfing, the detection rules are often calibrated only to the headline reporting threshold, and the resulting programme often misses the behavioural patterns that distinguish structuring from legitimate cash activity. This guide covers the difference, the six recurring patterns, and the rule design that actually works.
Structuring is the canonical placement-stage typology and one of the few money-laundering controls with an explicit criminal offence attached in most jurisdictions. The US Bank Secrecy Act criminalises structuring directly under 31 USC §5324; equivalent statutes exist in MAS-, FCA-, AUSTRAC- and FinCEN-regulated jurisdictions. The legal foundation makes structuring detection both inspection-critical and prosecution-relevant: a clean structuring case typically supports both a Suspicious Activity Report filing and a referral for potential criminal investigation.
The detection problem is conceptually simple but operationally subtle. Identifying cash deposits just below USD 10,000 is straightforward — any transaction monitoring system can run that rule. Identifying the broader pattern of intent to evade reporting requires looking at sequences of transactions, customer behaviour over time, and the relationship between cash activity and the customer's declared business model. That second layer is where most programmes have gaps.
Structuring vs Smurfing: The Definitional Difference
The two terms are sometimes used interchangeably in industry literature but they refer to materially different operational patterns.
Structuring involves a single party breaking what would otherwise be a reportable transaction into multiple smaller transactions. A customer with $40,000 in cash to deposit makes five deposits of $7,500–$9,500 across several days, specifically to avoid triggering the $10,000 CTR threshold. The customer is identifiable; the structuring intent is the legal element that distinguishes it from incidental same-day cash activity.
Smurfing involves multiple individuals — the "smurfs" — each making sub-threshold deposits on behalf of the underlying party. A drug-trafficking organisation may use ten couriers each making $9,000 deposits at branches across a metropolitan area on the same day, producing $90,000 in aggregate without any single individual triggering reporting. Smurfing always involves structuring; structuring does not always involve smurfing.
The detection distinction matters because the signals are different. Single-customer structuring produces a recognisable sequence on one customer's account; smurfing produces independently-low-volume activity across many accounts that needs aggregation by underlying purpose to be visible. Single-customer monitoring catches the first; counterparty-graph or geography-based aggregation is needed for the second.
Six Recurring Structuring Patterns
The patterns below cover the substantial majority of structuring activity seen in production transaction monitoring. They are mutually overlapping — most real cases combine two or three — and they should each have dedicated detection rules.
Sub-Threshold Cash Deposits Over Time
Repeated cash deposits in the $8,000–$9,800 range over a short period (typically days to weeks). The amount stays consistently below the CTR threshold but the aggregate exceeds it. Detection rule: cumulative cash deposits within rolling time windows (7 days, 14 days, 30 days) exceeding configurable thresholds, with sub-threshold individual amounts.
Same-Day Multi-Branch Deposits
Cash deposits made on the same day across multiple branches of the institution, each sub-threshold, aggregating to a reportable amount. The geographic spread is designed to avoid same-branch aggregation rules. Detection rule: aggregate cash deposit across branches by customer per day, flagging where any aggregate exceeds threshold with individual deposits below.
Round-Number Sub-Threshold Patterns
Cash deposits in clean round numbers immediately below threshold — $9,000, $9,500, $9,900 — repeated across multiple instances. The pattern is structurally clear because legitimate cash deposits do not concentrate in narrow bands just below regulatory thresholds. Detection rule: density of deposits in the immediate-sub-threshold band relative to the customer's broader deposit distribution.
Smurfing Across Multiple Accounts
Sub-threshold cash deposits made into multiple accounts that share common characteristics — same registered address, common signatories, related beneficial ownership, or repeated transfer activity post-deposit. Each individual account looks unremarkable; the network of accounts shows the underlying pattern. Detection rule: counterparty-graph aggregation of cash deposits across accounts linked by ownership or behavioural connection.
Cash-to-Instrument Conversion Patterns
Cash deposits followed quickly by purchases of monetary instruments (cashier's cheques, bank cheques, money orders) — often in amounts just below reporting thresholds for the instrument purchase itself. The pattern converts cash to negotiable instruments without the audit trail that a single large cash deposit and instrument purchase would create. Detection rule: pairing of sub-threshold cash deposits with sub-threshold instrument purchases within short time windows.
Cash Activity Inconsistent With Customer Profile
The customer's declared business does not generate the volume or type of cash being deposited. A consulting firm depositing $50,000 weekly in cash is structurally inconsistent with the declared model; a retail business depositing only round-number sub-threshold amounts when peer businesses deposit irregular amounts at varying levels is similarly inconsistent. Detection rule: cash activity exceeding profile-derived expected ranges, particularly where the deviation involves structured amounts.
Behavioural Indicators Beyond Threshold Proximity
Threshold-proximity rules detect the most obvious structuring but miss the more sophisticated patterns. Behavioural indicators — drawn from customer-profile baselines and counterparty graph context — extend the detection signal.
- Sudden change in cash-deposit pattern. A customer with a stable cash-deposit history suddenly shifting to higher-frequency, sub-threshold deposits is a behavioural anomaly regardless of whether any individual deposit looks unusual.
- Cash activity inconsistent with declared occupation or business. A salaried employee depositing cash beyond reasonable tip-income levels; a service business depositing cash in product-business volumes; a charity with no documented fundraising activity receiving cash donations. All are structural indicators that warrant scrutiny independent of threshold proximity.
- Cash deposits followed by rapid outflow. The deposit is not retained for business purposes; the proceeds are quickly transferred onward. The deposit-and-transfer pattern is characteristic of placement-into-layering, with structuring used to avoid the placement-stage reporting trigger.
- Customer requests to avoid receipts or reporting. Explicit customer behaviour — asking the teller not to file paperwork, breaking a planned single deposit into multiple smaller ones at the customer's request — is direct evidence of structuring intent. Branch staff training to flag such requests is the basic operational control.
- Activity timing aligned to reporting deadlines. Deposits clustering around month-end, quarter-end, or year-end may reflect legitimate accounting patterns or may reflect timing-of-reporting awareness. The distinction emerges from the customer profile.
What CTR / Threshold Reporting Misses
Threshold-based reporting (CTR in the US, equivalent regimes elsewhere) is the regulatory baseline, not the detection ceiling. The reports identify transactions that did hit the threshold; the structuring control is about identifying transactions that were designed not to hit the threshold.
Several structural limitations of threshold reporting:
- It captures successful activity, not evaded activity. A customer who structures $50,000 across six $9,000 deposits triggers no CTR filings. The legitimate cash activity of a peer customer triggers a CTR filing. The reporting actively inverts the desired detection priority unless paired with structuring monitoring.
- Aggregation rules vary by regulator and across institutions. Some regimes require aggregation across branches by customer per day; some do not. Where the aggregation rule is narrow, sub-threshold same-day multi-branch activity escapes both CTR filing and basic structuring detection.
- No automatic visibility across institutions. Structuring across two institutions — $9,500 deposited at Bank A, $9,500 at Bank B, same day — produces no single-institution alert. Detection requires industry-level patterns that no single firm can see directly.
- Threshold proximity is not the only signal. Structuring may use thresholds well below the CTR limit if the customer's normal pattern is very low cash activity. A customer who normally deposits $200 in cash and starts depositing $4,500 weekly is structuring relative to their own baseline, not relative to the CTR threshold.
Mature programmes use threshold reporting as one input among several, with behavioural monitoring and counterparty-graph analysis closing the structural gaps.
Detection Approach in Production
A production-grade structuring detection programme combines several rule types running in parallel, with disposition tracked centrally:
- Threshold-proximity rules. Cumulative cash deposits within rolling windows; density of deposits in the immediate-sub-threshold band; same-day multi-branch aggregation.
- Customer-baseline rules. Cash activity deviating from the customer's established pattern; cash velocity changes; new cash sources.
- Counterparty-graph rules. Aggregated cash activity across customer cohorts linked by ownership, address or behavioural connection. Particularly important for smurfing detection.
- Profile-consistency rules. Cash activity inconsistent with declared occupation, business model or geographic location.
Each rule type generates alerts that flow into a single case-management workflow with the customer's combined risk picture available to the analyst. A customer hitting threshold-proximity, baseline-deviation and profile-inconsistency rules simultaneously is a different proposition from a customer with a single threshold-proximity trip — the case is escalated proportionately. For broader transaction monitoring architecture see our AML / CFT platform overview, and for placement-vs-layering rule library design see our layering techniques guide.
Common Failure Modes
Six failure patterns recur in structuring inspection findings:
- Rules calibrated only to the headline threshold. Detection looks for deposits in the $9,000–$9,999 band and misses any pattern below it. Sophisticated structuring uses lower amounts (often $4,500–$7,500) specifically to defeat this rule.
- No aggregation across branches. Each branch sees its own deposits; the customer's same-day multi-branch activity is invisible to single-branch monitoring. Modern systems aggregate across the institution by customer; legacy systems often do not.
- No customer-baseline awareness. Rules apply absolute thresholds across the customer base. The customer whose own pattern shifts dramatically does not trip rules calibrated to absolute amounts.
- Branch staff under-trained on behavioural cues. Customer-initiated structuring requests (asking teller to break deposit into multiple smaller ones) are direct evidence but only get flagged where staff are trained to recognise and report them.
- Smurfing detection absent. The detection works at the single-customer level but does not aggregate by counterparty-graph connection. Coordinated smurfing across multiple accounts escapes detection entirely.
- No SAR follow-through. Structuring detected, alert generated, case opened, but no SAR filed because the case did not meet the firm's internal threshold for filing. Regulators inspect filing decisions; under-filing relative to detected activity is itself a finding.
Structuring Detection Beyond Threshold Rules
One Constellation's transaction monitoring combines threshold-proximity rules with customer-baseline behavioural detection, counterparty-graph aggregation, and full audit trail to SAR — closing the gaps that threshold-only monitoring leaves open.
