The Thursday Alert Queue
You are a financial crime investigator at a $4 billion community bank. On Thursday morning the automated monitoring system generates 38 alerts, and your team's service standard is to triage each within two business days. One alert concerns Golden Wok Catering LLC, a restaurant customer for seven years. In the past 45 days the account received 12 cash deposits ranging from $9,200 to $9,800, totaling $114,600, compared with a prior average of $18,000 per month in cash. The alert rule is 'multiple cash deposits below $10,000.' No currency transaction reports have been filed. The relationship manager says the deposits are 'catering revenue from weddings' and notes the owner recently added his nephew as a 50% owner. The account has no history of international wires. You have 30 minutes before the queue meeting.
1. What triage decision should you make before the queue meeting, and which factors drive it? Explain how you would rank this alert against the other 37.
Read the worked answer
Decision: Do not close the alert. Open a preliminary case and set priority as high, but do not yet conclude structuring. The 30-minute window is enough for a documented triage decision, not for a final disposition.
Ranking factors:
- Deviation from baseline: $114,600 in 45 days versus about $18,000 per month is a material change, not ordinary seasonality.
- Pattern: 12 deposits all below the $10,000 currency transaction report threshold is a structuring red flag, especially if they are same-branch, same-teller, or clustered on consecutive days.
- Ownership change: a new 50% owner is a customer due diligence trigger; the nephew's source of funds and role are unexplained.
- Business type: cash-intensive restaurant, but the claimed wedding catering volume needs corroboration.
- Control weakness: no currency transaction reports were filed, so either the deposits were deliberately structured or the bank's aggregation controls are weak.
Ranking: this is higher than routine alerts because it combines a threshold-adjacent pattern with an ownership change and an unverified relationship manager explanation. A single $9,500 deposit would be low risk; twelve in 45 days is not.
What not to do: Do not accept the relationship manager's explanation as disposition evidence. Do not describe the escalation to the relationship manager in a way that risks tipping off the customer.
2. Identify the specific records you would request and explain how each could move the assessment up or down.
Read the worked answer
Request these records and test them against the stated explanation:
- Deposit detail: dates, branch, teller, depositor identity, and whether the deposits were cash or checks. If the same person made all 12 deposits at the same branch, or the amounts track just under the threshold, the structuring inference strengthens. If 12 different wedding clients made documented payments, it weakens.
- Account statements: source and use of funds, ending balances, payments to owners, payroll, and tax payments. Deposits that are immediately withdrawn or transferred to the nephew increase risk; retained operating funds support the catering explanation.
- KYC and ownership documents: the nephew's identification, source of funds for his 50% purchase, role in the business, and adverse media or politically exposed person status. An unexplained buy-in from an unknown source raises risk.
- Business financials and tax returns: compare reported revenue and cash receipts with deposits. Cash deposits far exceeding reported revenue raise risk.
- Catering contracts and invoices: 12 documented events at roughly $9,500 each would support the explanation; missing contracts weaken it.
- Prior alerts, case history, and adverse media: prior structuring, tax liens, or labor violations increase risk.
- Currency transaction report aggregation report: confirm whether any day or period required a report; a system aggregation failure is a separate control issue.
Reasoning: each item either corroborates an independent business reason or exposes an inconsistency. No single record is dispositive, so the intake note should say what is known, what is assumed, and what remains unresolved.
3. Draft the intake note you would take into the queue meeting: hypothesis, immediate actions, and what would make you close the case later.
Read the worked answer
Intake note - Golden Wok Catering LLC
Alert: 12 cash deposits of $9,200-$9,800 in 45 days, total $114,600; prior average $18,000 per month.
Hypothesis: Possible structuring or unverified cash-intensive business revenue, compounded by an unexplained ownership change. Alternative hypothesis: legitimate wedding catering growth with poor documentation.
Risk rating: High for triage; not yet a confirmed case.
Immediate actions:
- Place a 90-day preservation hold on account and deposit records.
- Request deposit slips, teller detail, statements, and the nephew's onboarding file.
- Request catering contracts, invoices, and business tax returns for the period.
- Run prior alert, adverse media, and currency transaction report aggregation checks.
- Schedule a case review within five business days.
Closure criteria: close only if documented catering revenue independently explains the deposits, the nephew's source of funds and role are verified, no additional structuring pattern appears, and monitoring shows no further threshold-adjacent deposits.
Escalation trigger: any refusal to provide records, inconsistent invoices, deposits made by the same individual, or further cash deposits below the threshold.