Structuring (Smurfing): Definition, Detection Signals, and Examples
Structuring is the deliberate breaking of a single large cash transaction into multiple smaller deposits, each below the reporting threshold (commonly 10,000 USD/CAD/AUD or 10,000 EUR), to evade Currency Transaction Report or equivalent filing obligations. In US law, the intent to evade is itself a federal offense under 31 USC § 5324, regardless of whether the underlying funds are illicit.
Test for structuring indicators in 90 seconds →Structuring is one of the oldest and most enduring placement-stage typologies in money laundering. The mechanics are simple: take a large amount of cash that would trigger an automatic regulatory report if deposited in a single transaction, and split it into a series of smaller deposits that individually fall below the threshold. The goal is to move funds into the financial system without creating a regulator-visible record at the deposit stage.
Despite its simplicity, structuring remains a top AML focus area for FinCEN, FCA, AUSTRAC, FINTRAC, and most major financial intelligence units. It is the entry point for cash from drug trafficking, illegal gambling, tax evasion, human smuggling, and unregistered money services, and it generates a recognizable footprint in transaction monitoring data.
How Structuring Works
The launderer holds physical cash that exceeds a single jurisdiction's reporting threshold. Rather than deposit the full amount and trigger a Currency Transaction Report (US), Large Cash Transaction Report (Canada), or Threshold Transaction Report (Australia), the launderer divides the cash into smaller increments and deposits them across multiple branches, multiple days, multiple ATMs, or multiple accounts. The deposits may be made by the launderer alone or coordinated across multiple individuals (smurfing).
The deposited funds are then typically moved out of the receiving accounts quickly, either via wire transfer to a different jurisdiction, conversion to a different financial instrument such as a cashier's check or money order, or transfer to a brokerage or investment account. The placement-then-immediate-movement pattern is one of the strongest signals that structuring is in play rather than legitimate cash management.
Detection Signals
The following indicators, considered individually, are not conclusive. Considered as a pattern, they form the diagnostic basis for structuring alerts in mature transaction monitoring programs.
- 01Multiple sub-threshold deposits in a single day. The same individual or related parties make multiple cash deposits at the same branch, different branches, or across ATMs, each below the reporting threshold but adding to a substantially larger total.
- 02Daily deposits clustered just below threshold. A pattern of deposits in the 9,000 to 9,900 range, day after day, particularly when the customer's known business does not generate that volume of cash.
- 03Smurfing across multiple individuals. Several individuals, often friends, family, or recruited mules, each make smaller deposits which are subsequently aggregated into a single account through internal transfers.
- 04Mixed-channel structuring. Deposits split across in-branch cash, ATM cash, money orders, and prepaid card loadings, all below threshold individually, all credited to the same destination account.
- 05Deposits followed by immediate wire out. The classic placement-then-layering pattern. Cash enters in structured amounts and is wired out shortly after, often to a different jurisdiction, with the account returning to near-zero balance.
- 06Deposits at multiple branches in distant locations. The same customer makes deposits at branches in cities the customer has no apparent business in, often within the same calendar week.
- 07Round-numbered deposits just below threshold. Deposits of exactly 9,000 or 9,500 are statistically unlikely in genuine commerce. A sustained pattern is diagnostic.
- 08Customer asks about reporting thresholds. Any customer who explicitly asks at what amount a deposit becomes reportable, or requests to "split" a deposit to stay below a threshold, has provided evidence of structuring intent.
- 09Use of third-party deposits to a customer's account. Multiple unrelated individuals make sub-threshold cash deposits to the same account holder, particularly when the deposits originate in jurisdictions the account holder is not present in.
- 10Cash deposits inconsistent with declared business. A small business with a declared monthly turnover of 30,000 making 200,000 in monthly cash deposits, structured to stay sub-threshold, is the textbook commercial-cover case.
- 11Frequent purchase of monetary instruments below threshold. Cashier's checks, money orders, and travelers checks purchased in 9,000 increments and aggregated downstream into a single account.
- 12Deposits timed around bank reporting periods. Activity that clusters at month-end or year-end, when reporting attention is highest, in patterns that visibly reset for the next period.
Real-World Patterns
A regional cash-intensive small business deposits 8,500 to 9,800 in cash, four to five times per week, across two branches in the same city. The declared business is a hair salon with reasonable expected turnover of 25,000 to 35,000 monthly. Actual aggregated deposits exceed 180,000 monthly. The funds are wired out within seven days of deposit to a related entity in a higher-risk jurisdiction. This is the classic commercial-cover structuring pattern and is one of the most frequent fact patterns underpinning structuring SARs.
An individual customer with no declared business activity opens an account and within two weeks begins receiving multiple 8,000 to 9,500 cash deposits made by different third parties at branches across three states. The depositors are unrelated to the account holder. The funds are then transferred to a single foreign beneficiary. This is recruited-mule smurfing and frequently overlaps with money-mule typologies.
Test these indicators against an actual transaction or relationship. The Red Flag Check assessment tool includes scenario-specific red flag sets covering structuring alongside the broader AML indicator set. Run the assessment →
Regulatory Basis
United States. Currency Transaction Reports (CTRs) are required for cash transactions exceeding 10,000 USD in a single business day under 31 CFR 1010.311. Structuring to evade is a federal criminal offense under 31 USC § 5324, with penalties including up to five years imprisonment per offense. The intent to evade is sufficient; the underlying funds need not be illicit.
Canada. Large Cash Transaction Reports must be filed with FINTRAC for cash transactions of CAD 10,000 or more under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act.
Australia. Threshold Transaction Reports must be filed with AUSTRAC for cash transactions of AUD 10,000 or more under the AML/CTF Act 2006.
European Union. The EU AML Package adopted in 2024 — comprising the AML Regulation (Regulation (EU) 2024/1624), the 6th AML Directive (Directive (EU) 2024/1640), and the AMLA Regulation — introduces a harmonized 10,000 EUR cash payment limit across the bloc, applying from 10 July 2027. Existing national cash thresholds (often lower) continue to apply in member states until then.
United Kingdom. While there is no equivalent automatic threshold, unusual cash activity is captured under the Suspicious Activity Report regime in the Proceeds of Crime Act 2002.
Common Investigation Mistakes
Closing alerts on a single sub-threshold deposit (the signal is the pattern, not the data point), accepting customer explanations that themselves admit evasion intent (in the US, "I split deposits to avoid the form" is closer to a confession than a defense), failing to aggregate across linked accounts (joint owners, family members, recurring transferees), and failing to look for the corresponding outbound flow that confirms placement-to-layering activity. Cash-intensive businesses also need their declared turnover and physical capacity tested against the deposit volume; many structuring SARs reach the right conclusion through this single comparison.