IIBF Cyber Crimes & Fraud study materials
IIBF Cyber Crimes & Fraud study resources

Fifty-Eight Deposits Just Under Ten Lakh and an AML System That Stayed Silent

IIBF Cyber Crimes & Fraud · Put your knowledge to work in context.

All case studies

Fifty-Eight Deposits Just Under Ten Lakh and an AML System That Stayed Silent

A branch in a textile trading hub maintains a current account for a proprietorship, 'Sri Venkateswara Textiles'. In the past 11 weeks the account has received ₹1.87 crore in cash across 63 deposits, 58 of them between ₹9.4 lakh and ₹9.9 lakh, almost always at the same counter between 11:00 and 14:00. Funds move out within minutes to six accounts at other banks and to a prepaid wallet. The entity's GST turnover for the period is nil. The account was opened 14 months ago with a self-declared address supported only by a rental agreement; the beneficial owner column reads 'NA'; the sole signatory is the proprietor's son. Two of the six beneficiary accounts are already flagged in the bank's system as mule accounts. The bank's AML transaction-monitoring system has not generated a single alert on the relationship. The branch manager describes the customer as 'well known' and says the deposits are helping the branch meet its target.

1. Was the bank's AML monitoring effective? Identify the red flags and name the typology.

Read the worked answer

No - it failed at both design and behaviour.

Red flags, weighted by evidentiary value. (1) Structuring: 58 of 63 deposits sit in a ₹9.4-9.9 lakh band, immediately under the ₹10 lakh cash threshold that triggers a cash transaction report; deliberate clustering below a reporting line is the pattern itself, not a coincidence. (2) Pass-through: funds leave within minutes to six accounts and a prepaid wallet - the account is a conduit, not a trading business. (3) Profile mismatch: ₹1.87 crore of cash against nil GST turnover is an irreconcilable gap for a proprietorship. (4) Counterparty risk: two of six beneficiaries are already flagged as mule accounts in the bank's own system, a linkage the engine should have made automatically. (5) Behaviour: same counter, same time window, single signatory - rehearsed, manual deposits.

Typology. Layering through a cash-intensive front entity: cash of unknown origin is placed as business receipts, structured under the reporting line, and integrated through rapid transfers to mule accounts and a prepaid wallet. The wallet leg is the most worrying, because stored-value instruments are the standard cash-out rail for mule networks.

Why no alert fired. Two design failures: the scenario library appears to threshold on individual transaction size rather than on monthly aggregate cash and band-clustering, and relationship managers are evidently allowed to explain away activity. A risk-based system must flag deviation from the customer's own declared profile - a proprietorship declaring ₹40-60 lakh a month and tripling that in a quarter should alert even when no single deposit is large.

2. What must be filed, with whom, and on what reasoning? Address CTR, STR and internal escalation.

Read the worked answer

Both a CTR and an STR - and the STR is urgent.

CTR. The ₹10 lakh threshold operates on the aggregate of a customer's cash transactions in a month, not on single deposits. With ₹1.87 crore across 11 weeks, CTRs are due for each month in the window; the fact that each deposit stayed under ₹10 lakh exempts nothing, because the aggregation rule defeats structuring. File for all months, not only the latest.

STR. Suspicion is established by the combination of structuring, rapid pass-through, nil GST turnover and two known mule accounts. STRs go to FIU-IND promptly on forming suspicion - in days, not after the investigation closes or at year-end reconciliation - and the bank need not wait for a complete case. File on the entity, the proprietor and signatory, and the six beneficiary accounts including the prepaid wallet leg. Missing or late STRs are the first thing a supervisor tests.

Internal. Record the decision trail: who formed the suspicion, on what evidence, and when. Restrict the account under the bank's policy (no fresh cash acceptance) while monitoring continues, and do not tell the customer - the tipping-off prohibition is absolute and the branch manager is the single biggest leak risk here. Escalate to the AML/CFT committee and the audit committee of the board, because a silent monitoring system is a control failure affecting every customer, not just this one.

Judgement point. Do not wait for the customer's explanation before filing. The STR reports suspicion, not proof; the investigation continues after filing.

3. The branch manager wants to retain the deposits. Construct the governance argument and the CDD remediation, including beneficial ownership.

Read the worked answer

Deposit targets are not a lawful basis for retaining suspect funds. Under a risk-based approach the relationship must be re-underwritten, and the branch manager's commercial preference is precisely the conflict the AML function exists to override.

CDD remediation. (1) Re-establish identity and activity profile: GST returns, sales and purchase ledgers, statements from other banks, and a physical site visit to the declared premises - a self-declared address plus a rental agreement is not verification of a business. (2) Beneficial ownership: a proprietorship cannot return 'NA'. Identify the natural person who ultimately owns or controls the entity and the account signatory using the applicable PMLA beneficial-ownership threshold, record the basis for the conclusion, and obtain a written explanation of the father-son structure and of a signatory who is not the proprietor. (3) Enhanced due diligence with senior-management approval: source of the cash and counterparty due diligence on all six beneficiaries. (4) Interim restrictions: no fresh cash credits, transaction limits, monthly review, until EDD closes.

Governance. The decision to continue or exit belongs to the AML/CFT committee, not the branch; minute the rationale, EDD performed and STR reference. If the branch suppressed or explained away alerts to protect deposit targets, that is a staff-accountability matter for the vigilance function. The board's message must be explicit: an unexplained ₹1.87 crore of cash is a liability, not a deposit, and the same monitoring gap that missed it will be the finding in the next inspection.