The Suspicious Pattern in Four Small Deposits
A branch teller notices that a customer has made four cash deposits of $9,400, $9,200, $9,600, and $9,300 over eight business days, each just under the $10,000 reporting threshold. The customer is a small restaurant owner whose account previously received monthly deposits of around $3,000. The teller mentions it to the branch manager, who says the amounts are "below the limit, so there's nothing to report" and that filing anything would annoy a long-standing client. The bank's automated monitoring system has not generated an alert because its rule triggers only at $10,000. The branch manager is also the customer's personal friend and has a small investment in the restaurant. The teller is unsure whether to escalate further and does not know to whom.
1. Analyse the suspicious activity and the failures in the bank's controls.
Read the worked answer
The pattern. Four deposits in eight days, each within $800 of the threshold and each inconsistent with the account's prior activity, is a textbook structuring pattern. The individual amounts are irrelevant; the pattern is the signal. Structuring to evade a reporting threshold is itself a suspicious activity regardless of the source of funds.
Misunderstanding of the obligation. "Below the limit, so nothing to report" confuses a threshold-based report with the broader obligation to report suspicious activity, which has no minimum amount. The branch manager's statement is wrong in law and in policy.
Monitoring design flaw. A rule that triggers only at $10,000 will never catch structuring, by definition. Effective monitoring includes near-threshold aggregation, velocity rules, and deviation from customer profile.
Conflict of interest. The branch manager has a friendship and a financial interest in the customer's business. He should have recused himself; instead he discouraged escalation. That is a serious governance failure and potentially a tipping-off risk if he alerts the customer.
Escalation gap. A teller who does not know how to escalate, or fears doing so, is a control weakness. Whistleblowing and escalation routes must be known and safe.
2. What should the teller do, and what should the bank change?
Read the worked answer
Teller's immediate steps. Escalate through the bank's suspicious activity reporting channel, bypassing the branch manager given his conflict. If no clear channel exists, report to compliance or the money laundering reporting officer directly, and document the report, the date, and the response. The teller must not discuss the matter with the customer or the branch manager beyond what is necessary.
Bank's immediate steps. Review the account and related accounts, assess whether a suspicious activity report is required, and file promptly if so. Remove the branch manager from any decision on this customer and review his other accounts for similar conflicts. Preserve records.
Control changes.
- Add near-threshold and structuring rules to monitoring, with aggregation over rolling periods.
- Train staff that the reporting obligation is not limited to threshold amounts, and test understanding.
- Publish and publicise a confidential escalation route, with anti-retaliation protection.
- Require declaration of personal interests and automatic recusal where a conflict exists.
- Review whether the branch manager's conduct breached policy and refer for disciplinary assessment.
Tone. The teller did the right thing by noticing and asking. The bank should reinforce that behaviour, not punish it.