Restaurant cash deposits just under the reporting threshold
Golden Wok, a restaurant customer of a US community bank for six years, has declared annual revenue of USD 400,000 and average monthly cash deposits of USD 18,000. Over the last eight weeks it made 14 cash deposits, each between USD 9,200 and USD 9,800, on Fridays, at three different branches. It also received five inbound transfers totaling USD 45,000 from a food-supply company and sent USD 38,000 to a prepaid-card provider. Total cash deposits in the period were USD 131,000. The owner says the cash comes from "catering jobs" and that he splits deposits to "avoid the paperwork." One deposit included a note reading "for Mr. Chen." The bank's alert rule flags cash deposits just under USD 10,000. The relationship manager notes the restaurant's POS receipts have not increased. A prior alert six months ago was closed as "business as usual" with no documented rationale.
1. Triage the alert: what is suspicious and what is not, and what additional data would you pull?
Read the worked answer
Suspicious: 14 deposits just under USD 10,000 across three branches, on Fridays, totaling USD 131,000 in eight weeks against declared annual revenue of USD 400,000; a note "for Mr. Chen"; immediate transfers to a prepaid-card provider; and the owner's statement that he splits deposits to avoid paperwork, which is an admission of structuring intent. Not suspicious by itself: cash deposits are normal for a restaurant; the prior alert may have been closed for a legitimate reason, but the file has no rationale. Additional data: tax returns and POS receipts for the period, payroll and supplier invoices, the identity of Mr. Chen and any signatory authority, the food-supply company's ownership, other accounts at the bank, teller observations, and the prior alert file. Compare cash deposits to reported revenue and to prior years. The pattern matters more than any single deposit.
2. Set out the investigation plan and decide whether to file a STR.
Read the worked answer
Investigation plan: pull 12 months of statements and compare cash deposits with POS and tax filings; identify Mr. Chen (customer, employee, or unrelated third party); review the prepaid-card transfers and whether they are consistent with payroll or supplier payments; interview the owner with open questions, not accusations; check other branches for deposits; and review the prior alert closure. If the explanation remains unsupported, file a STR. The narrative should include dates, amounts, branches, the USD 9,200–9,800 range, the "for Mr. Chen" note, the owner's statement, the revenue mismatch, and the prior alert. Do not include speculative conclusions; state the facts and why they are suspicious.
3. What relationship actions should the bank take during and after the investigation?
Read the worked answer
During the investigation, do not tip off the customer. The bank may continue normal service unless the MLRO decides to restrict the account; closing abruptly could alert the customer. Document the decision to keep the account open and any restrictions. After filing, continue monitoring for 90 days and update the risk rating. If the bank exits, do so in a way that does not reveal the STR. The governance point is that the prior "business as usual" closure without rationale is a control failure; the current review should correct the file and set a standard for future alert closures.