Four Deposits, One Invoice, Forty Minutes
Ms. Ahn, 34, a salaried employee who declared 62,000 of annual income at onboarding, has held a brokerage account for 11 months with average monthly deposits of about 2,000. Over six weeks she makes four cash deposits at three different branches: 9,300; 9,700; 9,400; and 8,900. Each is a few hundred below your firm's large-currency cash reporting threshold, and each time she tells the teller she prefers cash 'to keep things simple.' That is 37,300 in six weeks, roughly nineteen months of her declared income. Eight days later an incoming wire of 84,000 arrives from a company registered in a jurisdiction your firm rates high risk for trade-based money laundering; the reference field reads 'invoice 4471.' Forty minutes after the credit posts she calls the representative to send 79,000 out to a different company in a different country, then asks whether the deposit 'could wait until next week when the paperwork is cleaner.' She also asks whether the representative can 'keep the source-of-funds note short, the family doesn't like records.'
1. Identify the red flags and distinguish those that are independently significant from those that matter mainly in combination.
Read the worked answer
Independently significant: the four cash deposits are structured. Each sits just under the reporting threshold, they cluster in six weeks, they are spread across three branches, and she volunteers a preference for cash each time. Structuring is a red flag even if the underlying money is legitimate. Equally strong is the profile mismatch: 37,300 against 2,000 monthly deposits and 62,000 declared income is an unexplained order-of-magnitude change. The 84,000 in and 79,000 out within the same hour, to different counterparties in different countries, is layering behavior, and the bare 'invoice 4471' reference with no shipping or contract documents is a classic trade-based laundering indicator.
Significant mainly in combination: the request to delay the wire and the request to shorten the source-of-funds note. Each could be innocent alone; together with the deposits they show a client actively trying to shape the record and the timing. The branch-hopping matters because it defeats recognition by any one employee. Nothing here proves a crime, which is exactly the standard: suspicion, not proof, drives escalation.
2. What do you do next, in what order, and what must you not do?
Read the worked answer
First, do not tip her off. Do not say a report is being considered, do not mention the threshold, and do not tell her why the wire is delayed. Second, place the 79,000 outbound wire on hold or referral per firm procedure, and do not process it while the source of the 84,000 is unexplained. Third, escalate the same day to the AML compliance officer with the deposit tickets, branch locations, wire details, KYC profile, and your contemporaneous notes.
On the note-keeping: do not shorten, soften, or omit anything in the source-of-funds record, and do not agree to her request. Record verbatim that she asked you to keep it short, because that request is itself relevant information. Fourth, the compliance officer, not the representative, decides whether a suspicious-transaction report is filed; the filing threshold is suspicion and it is unaffected by her being a long-standing, polite client. Fifth, continue normal monitoring and do not close the account unilaterally, since abrupt exit can itself constitute tipping off. Sixth, do not discuss the matter with her family, with other branch staff outside the escalation chain, or in any shared system she could access through a branch visit.
3. Should the firm exit the relationship? What factors drive that decision, and how should an exit be handled if it happens?
Read the worked answer
Exit is a compliance and business-line decision, not a representative's decision, and it is analytically separate from the reporting decision. The factors are the strength and corroboration of the suspicion, whether the firm can continue to monitor the account effectively, the customer's risk rating, the firm's stated risk appetite, and legal advice on the jurisdiction receiving the wires. A filed report does not require exit, and exit does not require a filed report.
If the firm exits, it must do so without disclosing the reason or the existence of any report. That normally means a neutral, documented explanation consistent with the account agreement, orderly return of the remaining balance through a traceable channel to an account in the client's own name, and a record of who approved the exit and when. The firm should not return funds in a form or on a timetable that helps the client avoid reporting, and it should not keep the relationship alive purely to observe if doing so exposes it to further laundering. Whatever is decided, the representative's documentation duty is unchanged and the report-timing obligation runs on its own clock.