Deposits Just Under the Line
A credit union has banked Sunrise Convenience Ltd for six years. Turnover was steady at roughly $380,000 a year. Over the last five months cash deposits reached $1.9 million, with 78% of individual deposits falling between $8,700 and $9,900 - just below the $10,000 reporting threshold. Deposits are made at fourteen different branches, frequently by three individuals who are not signatories. The stated business is a convenience store with reported annual sales of $600,000. The owner says a second location opened, but no lease, licence, or utility document has arrived after two requests. Four months ago the owner's nephew opened a personal account; it has received eleven transfers from the business and immediately wires funds to two accounts in a country where the business claims no connection.
1. Identify the typologies in play and explain what separates a genuine pattern from an artefact of the data.
Read the worked answer
Several typologies overlap, and naming them precisely changes the response:
- Structuring. Deposits clustered under the threshold across multiple branches is the textbook pattern. Note the legal point: structuring is an offence in many jurisdictions whether or not the underlying funds are illicit, so the pattern matters independently of source.
- Third-party deposits. Non-signatories depositing business cash is not inherently suspicious in retail, but combined with branch dispersion it looks like deliberate distribution to avoid recognition.
- Funnel / layering account. The nephew's account receives from the business and immediately wires offshore - a pass-through with no economic purpose stated.
The counter-check is what stops this being pattern-matching: convenience stores are legitimately cash-heavy, and cash deposits can outrun declared sales if the owner is understating revenue for tax reasons. A second site is plausible. What makes the explanation fail is not the cash volume but the absence of corroboration after two requests plus the geographic dispersion plus the offshore exit with no stated trade link. Each alone is weak; the combination, and specifically the unverifiable stated purpose, is what converts pattern into suspicion.
2. Do you file, exit, or both - and in what order?
Read the worked answer
The filing obligation is triggered by suspicion, not by proof, and not by completion of a full investigation. Waiting for the lease documents to arrive is not a reason to defer; if the file is already overdue by your own standard, that is a breach in itself.
Order of operations:
- File the suspicious activity/transaction report now, on the basis of the pattern and the unverified stated purpose, flagging that corroboration is outstanding. The report does not need to be conclusive, and it can be supplemented.
- Do not close the account first. Closing before filing risks tipping off; closing after filing may also be premature, because the reporting unit may want the account to remain open for monitoring. Ask the question rather than assume.
- Treat the nephew's account as a separate subject with its own file. Bundling them into one report can obscure the layering link; cross-reference instead.
- Decide on risk appetite for continued operation - restrict to inbound credits only, or require source documentation before further outbound wires, as an interim control that neither tips off nor facilitates.
- Consider the branch angle. Fourteen branches and sub-threshold amounts suggest either coaching or a common instruction. That is an operational control question and belongs in the file.
3. What would prove you wrong, and how would you test it?
Read the worked answer
A defensible conclusion states its falsifiers. Here they are concrete:
- Genuine expansion. Confirm with a lease or rates bill for the second site, a business licence, and photographs or a site visit - not a customer statement.
- Deposits consistent with real trading. Compare point-of-sale daily Z-reports against cash banked. A store banking more cash than it rings up is either under-declaring sales or banking someone else's money; either answer is material.
- Cash-intensive supply chain. Some wholesalers and lottery/ATM float arrangements generate legitimate cash swings. Ask for supplier statements and settlement records.
- Seasonality. Pull the same five months from prior years. Steady $380k turnover followed by a step change is not seasonal; a smooth curve would be.
- The offshore wires. Ask what the nephew's account is for and obtain the underlying invoices. No answer, or an answer inconsistent with the business, strengthens the layering reading.
If the second site is verified, POS reconciles to deposits within a defensible tolerance, and the offshore transfers have documented trade backing, the suspicion weakens considerably. Until then, the file stands on the unrebutted pattern.