Structuring that rules miss: evasion indicators worth teaching an agent
A threshold rule finds cash deposits between $8,000 and $10,000. It cannot tell a convenience store's normal week from a customer who asked a teller how to avoid a report. These indicators can.
The short version
- Structuring means breaking up cash activity to evade the CTR, which banks file for more than $10,000 in currency in one business day. Under 31 U.S.C. 5324 it is an offense whether or not the money is clean.
- Since October 2025 the regulators have said amounts near the threshold are not, by themselves, enough to require a SAR. The question is evasion.
- Indicators with real evidentiary weight: same-day deposits at different locations, tight clustering just under $10,000, the customer's own words about the threshold, several people funding one account, and cash in followed quickly by wires out.
- Context cuts the other way too. A cash business whose deposits have looked the same for two years is not evading anything.
Most structuring rules ask one question: did cash deposits land in a band just under $10,000, often enough, within a window? A common shape, and the one in our demo, is three or more cash deposits between $8,000 and $10,000 within 30 days. It is cheap to run and easy to explain to an examiner. It is also a poor test of the thing that makes structuring an offense, which is purpose.
This post is about the evidence that speaks to purpose: where the regulators describe it, what it looks like in core banking data, and how to teach an agent to find it.
The reporting rule and the offense
A bank files a currency transaction report for each cash transaction of more than $10,000 (31 CFR 1010.311). Several transactions are treated as one when the bank knows they were made by or on behalf of the same person and they total more than $10,000 in one business day. For this purpose all of a bank's domestic branches count as one institution (31 CFR 1010.313).
Structuring is arranging transactions to avoid that report. 31 U.S.C. 5324 makes it an offense to structure, help structure, or attempt to structure transactions with one or more domestic financial institutions for the purpose of evading the reporting requirement. The base offense does not depend on where the money came from. FinCEN's customer pamphlet makes the point with an ordinary example: a man sells his truck for $15,000 and splits the deposit to stay under the threshold. That is structuring, even though the money came from a legitimate sale (FinCEN CTR reference guide).
Banks have their own obligation. A SAR is required for a transaction of $5,000 or more that the bank knows, suspects or has reason to suspect was designed to evade BSA requirements (31 CFR 1020.320). In October 2025, FinCEN and the banking agencies said the presence of transactions at or near the CTR threshold is not, by itself, enough to require that SAR (SAR FAQ, question 1). The amount is where a review starts. Evidence of evasion is what finishes it.
Why the threshold rule over-fires and under-fires
The band rule fires on every cash-heavy business whose normal daily deposit happens to fall between $8,000 and $10,000. A convenience store can trip it every month for years. Meanwhile it misses the customer who keeps every deposit under $3,000 and spreads them across several accounts, a pattern the FFIEC lists as a red flag in its own right (FFIEC Appendix F). Amount is a filter. It is not a finding.
Indicators worth teaching an agent
Each indicator below comes from a primary source and can be found in records a bank already holds. That matters for an agent: if it cannot point to the record, it should not make the claim.
| Indicator | Where the regulators describe it | What the record shows |
|---|---|---|
| Same-day deposits at different locations | FFIEC Appendix F: deposits structured through multiple branches | Two or more near-threshold cash deposits on one calendar day, at more than one branch |
| Clustering just under the threshold | FFIEC Appendix F: currency deposited in amounts just below reporting thresholds | A tight band of amounts, such as $9,400 to $9,900, repeated over days |
| The customer's own words | FFIEC Appendix F: persuading staff not to file, reluctance to give CTR information, asking for an exemption | A teller or branch note, a complaint, a recorded call |
| Several people funding one account | FinCEN FIN-2014-A005 on funnel accounts; FFIEC Appendix F on groups depositing together | Different conductors, often at branches far from the account's home market |
| Cash in, wires out | FFIEC Appendix F: deposits wired to another city or country almost immediately | Hours or days between the deposits and an outbound wire of similar size |
Same-day, multi-location
A bank's domestic branches count as one institution for aggregation, so splitting one day's cash between two locations should not avoid a CTR once the bank knows the deposits belong to one person. People still try it, and the attempt itself is evidence. The pattern is precise enough to test: group the near-threshold deposits by calendar day and count the days with deposits at more than one location. A single such day can be coincidence. Two in two weeks is harder to explain.
Clustering
Legitimate cash tends to vary with hours worked or the day of the week. Nine deposits that all sit between $9,400 and $9,900 describe someone aiming at a number. Measure the band, the count and the span of days.
The customer's own words
Knowledge of the reporting requirement is what separates structuring from coincidence, and the best evidence of knowledge is usually written down by bank staff. A note that the customer asked whether deposits over $10,000 are reported, followed by a run of deposits just under it, carries more weight than any amount pattern. It is also the indicator most often missed, because it lives in free-text notes that a rule engine never reads.
Several depositors, one account
FinCEN's 2014 funnel account advisory describes accounts receiving many cash deposits below $10,000 from different people, often at branches outside the account's region, with the money withdrawn elsewhere soon after (FIN-2014-A005). One caution for anyone automating this: transaction feeds often carry no conductor for cash deposits. When the bank records who made the deposit, it belongs in the evidence. When it does not, the honest finding is “conductor not recorded,” not a guess.
Cash in, wires out
Structured cash that leaves by wire within days is a different risk from structured cash that sits in a savings account. Measure the hours from the first deposit to the outbound wire, the share of inbound money that leaves, and whether the destination is on the bank's high-risk list.
Context that argues against structuring
- A cash-intensive business whose deposits have sat in the same band for years, with an onboarding interview that expected them.
- A single, documented event, such as a private vehicle sale reviewed on an earlier alert.
- One location, a regular cadence, and volume in line with the expected monthly activity on the customer profile.
None of these clears an alert on its own. They are the facts a good L1 analyst writes down when closing one, and an agent should be held to the same standard: cite the history, or do not rely on it.
What this means for alert triage
In Assay, structuring findings are computed in code before the model is called, from the same records the analyst sees. The structuring check takes cash deposits from $8,000 to just under $10,000 in the last 30 days and records the count, total, minimum and maximum, the locations used, the span in days, the number of days with deposits at more than one location, and whether the customer's KYC notes mention the $10,000 threshold, a CTR, or reporting to the government. The funnel check counts inbound credits and distinct senders and measures the hours between them and the outbound wire. Prior SARs on the customer are part of the evidence.
The model then assesses those findings. Its system prompt carries the October 2025 FAQ position and tells it to look for evasion indicators, not amounts alone. Every claim must cite a record id that was in the evidence, or the alert goes to human review instead of arriving as a recommendation. Every dollar figure must trace to a cited transaction or a sum of cited transactions, or batch approval and auto-close are switched off for that alert.
The demo's first alert is built to exercise all of this. It has 9 cash deposits from $9,400 to $9,900 at three locations over 12 days, two of those days with deposits at two different locations, and a staff note recording the customer asking whether deposits over $10,000 are reported to the government. The agent recommends escalation and drafts a narrative for the L2 investigator. The same queue holds a convenience store whose cash deposits have sat in the same band for two years, with an onboarding note that expects them. The rule fires on both. The evidence does not point the same way.
The agent never decides whether to file a SAR, and never rules on whether a pattern is structuring as a legal matter. It assembles the indicators, cites them, and recommends. You can open both alerts in the live demo and check every citation against the records.