Twenty-Three Accounts, One Apartment Complex
A $1.1 billion regional credit union that files roughly 40 SARs a year gets an automated monitoring alert on 23 newly opened consumer accounts with near-identical profiles: opened within a 12-day window at two branches, holders aged 19-24, all listing the same apartment complex, all enrolling in mobile deposit within 48 hours. Over six weeks the accounts received 1,147 deposits totaling $1.92 million, overwhelmingly in the $9,600-$9,850 range, each followed within 24-72 hours by an outgoing Zelle or ACH transfer to 11 distinct accounts at three other institutions. Eight holders appear in a local university's student directory. One holder, contacted by phone, said a friend from a gaming Discord paid him $150 per transfer to hold money for his uncle's import business. The credit union has no correspondent relationship with the receiving institutions. Account closures have not begun.
1. Identify the typology, state whether a SAR should be filed, and outline the narrative.
Read the worked answer
This is a structured-deposit mule network. Deposits cluster just under $10,000, which is the signature of structuring to avoid currency transaction reporting; the narrow band ($9,600-$9,850) is too consistent to be organic payroll or tuition. Rapid pass-through to 11 external accounts within 24-72 hours is layering through funnel accounts. The shared apartment complex, narrow age band, and simultaneous onboarding indicate recruitment rather than coincidence, and the Discord payment of $150 per transfer is a classic mule-recruitment inducement.
File. The credit union has a reasonable basis to suspect structuring and money laundering; it does not need proof. The 30-day clock runs from detection, and the pattern is continuing.
The narrative should state: number of accounts and the 12-day opening window; 1,147 deposits totaling $1.92 million; the concentration in the $9,600-$9,850 band; pass-through timing to 11 accounts at three institutions; shared address; the university directory match; and the accountholder's own statement about Discord and $150 payments. Avoid characterizing the holders as criminals - some may be unwitting. Consider whether one consolidated SAR or account-level filings best convey the network; a consolidated filing with account-level detail is usually clearer for law enforcement.
2. The branch manager wants to close all 23 accounts today. Evaluate that option against alternatives, and explain how 314(b) fits.
Read the worked answer
Closing immediately is defensible but has costs. On the plus side, it stops further victim deposits and limits the credit union's exposure. On the negative side, mass closure on a single day will almost certainly alert the organizers, who may then move the network and destroy evidence before law enforcement acts. Closing also ends the transaction visibility that makes the SAR useful.
A middle path: keep accounts open under enhanced monitoring for a defined short period - say 30 days - while coordinating with law enforcement, then close on their guidance or on a staggered schedule. If the credit union chooses this, document the risk decision and the monitoring thresholds. Do not let the accounts continue to receive deposits indefinitely; the credit union has obligations to its depositors and to the receiving institutions.
314(b) allows the credit union to share information with other financial institutions for the purpose of identifying and reporting suspected ML/TF, provided both parties are registered and the sharing is properly documented. It is the right tool to reach the three receiving institutions and learn whether the 11 accounts are themselves mule accounts or a second layer. 314(b) does not authorize sharing with law enforcement; that goes through a 314(a) request or direct referral.
3. How should the credit union handle the student accountholder who admitted receiving $150 per transfer?
Read the worked answer
Treat him as a possible uncharged subject and a possible victim at the same time, and do not resolve that ambiguity in the phone call. He has admitted conduct that could constitute money transmission without a license or aiding money laundering, and he has also been recruited with a story designed to make the conduct seem benign. The 'uncle's import business' explanation is a common cover narrative.
Practically: do not interview him further without counsel present or without law enforcement involvement, because anything he says now will be tested later. Document the call verbatim as he described it. Preserve the account records. File the SAR, which protects the credit union and creates a law enforcement lead. Consider a referral to the FBI or the local financial crimes unit, noting that he is a student and may be a recruited mule rather than an organizer.
Do not promise him immunity or tell him he is a victim. Do not tell him the accounts are under investigation in a way that lets him warn the network. If the credit union closes his account, give the standard notice required by its deposit agreement. The trafficking angle is worth checking - if any holder appears coerced or is a minor, different referral duties apply.