Bank Structuring Red Flags and Suspicious Activity Examples

1. What is structuring?

Structuring, also called "smurfing", is the practice of breaking a large cash transaction into multiple smaller transactions specifically to avoid triggering the $10,000 Currency Transaction Report (CTR) threshold or other Bank Secrecy Act recordkeeping requirements. Under 31 U.S.C. § 5324, structuring is illegal even when the underlying funds come from a completely legitimate source.

In a bank setting, structuring often looks like a customer depositing or withdrawing $9,500 on several days, or splitting a single large amount across multiple branches, tellers, or accounts so that no single transaction crosses the reporting threshold. What makes the behavior reportable is the intent to evade, not the amount itself.

2. Structuring vs. legitimate transaction patterns

Not every series of sub-$10,000 cash transactions is structuring. Many businesses, convenience stores, restaurants, laundromats, legitimately deposit cash daily in amounts that naturally fall below the threshold. The distinction is whether the pattern matches the customer's known business and profile.

A cash-intensive business depositing $4,000 to $6,000 each day is normal. A software consulting firm depositing $9,500 in cash every few days is not. Compliance teams should evaluate the transaction pattern in context, against the customer's expected activity, stated purpose, and documented source of funds, before concluding that structuring has occurred.

3. Cash structuring red flags

Cash is the most common vector for structuring because it is anonymous and easily split into smaller denominations. Bank staff and automated monitoring systems should watch for repeated cash activity that hovers just below the reporting threshold.

• Deposits or withdrawals of cash just below $10,000 repeated across multiple days
• Consistent use of round amounts like $9,000 or $9,500 that suggest deliberate threshold avoidance
• Exchanging large volumes of small bills for larger denominations, or vice versa, without a stated business reason
• Sudden changes in a customer's normal cash deposit behavior that have no apparent explanation

4. Multiple branch activity

One of the oldest structuring techniques is dispersing transactions across multiple branches or locations on the same day so that no single branch's staff observes the full amount. The CTR aggregation rule at 31 CFR § 1010.313 directly addresses this: when a bank knows multiple transactions are by or on behalf of the same person and total more than $10,000 in one business day, they must be aggregated.

• The same customer conducting cash transactions at two or more branches on the same day
• Transactions timed to avoid a single teller or branch seeing the aggregate
• Deposits split across multiple accounts held by the same individual or related parties
• Use of different branches in quick succession with amounts that, combined, exceed the threshold

5. Use of third parties

Structuring networks frequently use "smurfs", multiple individuals who each conduct a sub-threshold transaction on behalf of a single organizer. This distances the organizer from the reporting system and spreads activity across unrelated-looking accounts.

• Multiple individuals conducting related cash transactions that, in aggregate, exceed the threshold
• Shared addresses, phone numbers, or employers among customers making similar deposits
• Third parties depositing into an account they do not appear to own or control
• Depositors who cannot independently explain the source or purpose of the funds

6. Business account structuring

Business accounts are frequently used to disguise structuring because recurring cash deposits look more plausible on a commercial account. The key test is whether the cash volume is consistent with the nature and scale of the business.

• Cash deposits far exceeding what the stated industry or business size would generate
• A business with no storefront, employees, or operations receiving regular large cash deposits
• Cash deposited by a business that primarily bills through invoices, cards, or wire transfers
• Multiple related businesses or shell entities sharing the same signer and splitting deposits

7. CTR aggregation considerations

Banks must aggregate currency transactions when they know, or have reason to know, that multiple transactions are by or on behalf of the same person and total more than $10,000 in a single business day. This aggregation obligation is what makes multi-branch and multi-account structuring detectable, and what makes failing to aggregate a compliance finding.

Aggregation should consider all cash channels: teller deposits, ATM activity, night deposits, and currency exchanged for monetary instruments. A robust monitoring program looks across the enterprise, not just within a single branch.

• Aggregate across branches, accounts, and channels for the same person in a business day
• Include transactions the customer attempts to split below the threshold
• Document the aggregation decision and any supporting evidence

8. SAR escalation considerations

Structuring is a mandatory Suspicious Activity Report trigger. Under 31 CFR § 1020.320, banks must file a SAR for transactions of $5,000 or more when they know, suspect, or have reason to suspect the activity is designed to evade the BSA, which is the definition of structuring.

Escalation should follow a documented process: identify the pattern, attempt to understand the legitimate explanation, and if the facts support a suspicion of evasion, escalate to the BSA officer for a SAR decision. The confidentiality of the SAR filing must be maintained throughout.

• File for both completed and attempted structuring, even if no reportable transaction cleared
• Select the "Structuring" SAR checkbox and describe the supporting indicators in the narrative
• Do not disclose the SAR or the filing to the customer

9. Customer due diligence

Strong customer due diligence (CDD) is the first line of defense against structuring. When a bank understands what a customer legitimately does, deviations from that profile are easier to spot. The CDD rule at 31 CFR § 1010.230 requires banks to understand the nature and purpose of the customer relationship.

For business customers, this means understanding ownership, operations, and expected cash flow. For individuals, it means knowing the source of income and the purpose of the account. A documented customer risk profile is the baseline against which structuring indicators are evaluated.

10. Documentation expectations

Banks should document structuring investigations under their own risk-based procedures. FinCEN's October 2025 FAQs say a transaction near $10,000 does not by itself require a SAR, and that there is no requirement to document a decision not to file, though FinCEN has encouraged it. A short, concise note will usually do.

• Capture the aggregated transactions, dates, branches, and amounts involved
• Record any customer explanation and the staff assessment of its credibility
• Document the SAR filing, the decision not to file and the rationale, or the escalation to law enforcement
• Retain supporting records consistent with BSA recordkeeping requirements

11. Employee training considerations

Front-line tellers and branch staff are the first to observe structuring, so training should focus on recognizing patterns, not just the $10,000 threshold. Employees should understand that structuring is illegal regardless of the source of funds, and that a single sub-threshold transaction is not, by itself, suspicious.

Training should cover aggregation, the signs of smurfing networks, and the internal escalation path. Refresh training on a regular cycle (commonly at least annually) and when new FinCEN advisories or typologies are issued.

12. Common mistakes financial institutions make

Several recurring mistakes weaken a bank's ability to detect and report structuring. Awareness of these pitfalls helps compliance teams strengthen their programs before an examiner finds the gap.

• Monitoring only single transactions instead of aggregating across branches and channels
• Treating sub-threshold cash activity as inherently innocent without comparing it to the customer profile
• Failing to file a SAR for attempted structuring where the customer backed off after an inquiry
• Not documenting the decision not to file, leaving the rationale unrecorded
• Training staff on the threshold amount but not on pattern recognition or aggregation

Structuring Red Flags at a Glance

A quick reference for evaluating and escalating potential structuring activity.

A single sub-threshold transaction is not, by itself, structuring. Evaluate each pattern in context against the customer\'s known profile and legitimate business needs before escalating.