Structuring is the practice of splitting cash deposits to stay under the $10,000 Currency Transaction Report threshold. It is a federal offense in its own right, whether or not the cash is clean. It remains one of the most common reasons transaction-monitoring rules fire, and one of the most time-consuming alert types to clear.

The pattern is old. The way it reaches a bank is not. This article looks at what has changed, what our triage agent checks before anyone opens the case, and what an analyst should expect to receive.

What changed

The pattern used to be one branch, one week, one teller. A teller noticed the same customer twice and said something. Today deposits arrive across branches, ATMs, partner accounts and cash-heavy merchants within the same few days. No single teller sees more than one of them.

Rules have kept up in volume, not in sense. A rule that fires on cash deposits between $8,000 and $10,000 sees fourteen separate alerts. Each one lands in the queue on its own, often with a different analyst. An investigator needs to see one customer and one story.

The result is familiar to most BSA teams. Alerts are worked in order of arrival, each one is cleared or escalated on its own merits, and the pattern only becomes visible when someone happens to open the fifth alert on the same name.

A worked example

Take Halvard Trading Ltd, a case from the demo queue on our Home page. Between March 3 and March 21, the company made 14 cash deposits, each between $9,200 and $9,900. Over 19 days, that is $131,400 in cash, none of it above the reporting line.

Seen one at a time, each deposit is unremarkable. A $9,600 deposit from a trading company is not a case. Fourteen of them in nineteen days, from a company that declared $40,000 a year in turnover, is a different question.

What an agent checks first

Tipline's Alert Triage agent starts by grouping alerts by beneficial owner, not by account. Deposits into three accounts owned by the same person are one pattern, not three. Only then does it look at amounts and dates.

It then compares the pattern with the customer's declared business, its seasonality and 24 months of history before anything reaches an analyst. The checks are the same ones an experienced investigator would run, done in the same order every time:

• Group every open alert by beneficial owner and related parties.

• Count deposits in the band just under $10,000 over 7, 14 and 30 days.

• Compare total cash with the turnover declared at onboarding.

• Check the same months in prior years for a seasonal pattern.

• List the branches, ATMs and channels used, and how far apart they are.

• Note where the cash goes next: wires, new counterparties, cash out.

A food truck that deposits cash every summer is not the same case as a newly opened trading company that deposits $9,600 fourteen times in nineteen days. The difference is in the history, and the history is in data the bank already holds.

What the agent does not do

The agent does not decide that a customer is structuring. Intent is a legal question, and it belongs to the people who sign. The agent states what the data shows and where each fact comes from.

It also does not clear an alert because the amounts look small. A pattern that fails one test but passes the others stays in the case, with the reason written next to it. An analyst can see what was checked and what was not.

What reaches a person

Cases that survive triage arrive with the grouped deposits, the owner, the counterparties and a first finding, each with its source. In the Halvard case, that means the 14 deposits from core banking, the turnover from the KYC file and the wires that followed, one line each.

On the demo queue, the agents work 3,118 morning alerts down to 41 cases. The other alerts are not ignored: each one is closed with a written reason that an analyst can open, sample or reverse. The 41 are the ones that need a decision.

The analyst decides. The agent never files on its own. If the analyst escalates, the SAR Drafting agent prepares a narrative, and the analyst edits and signs it.

What to do on Monday

Pull last month's structuring alerts and sort them by beneficial owner instead of by date. Count how many owners had more than three alerts worked by different analysts. That number is the size of the problem, and the first thing to show your team before changing a single rule.