The SME That Never Quite Crosses the Threshold
Meridian Commercial Bank's Colombo south branch serves Vinco Packaging (Pvt) Ltd, a corrugated-box manufacturer with a stated monthly turnover of LKR 8–10 million. Over seven weeks the branch accepts 11 cash deposits totalling LKR 9.4 million, each between LKR 780,000 and LKR 950,000. The bank's internal cash-reporting threshold is LKR 1 million. The deposits are made by three individuals: the director's driver, a cousin, and a person not named on the account mandate. Vinco's declared business is B2B invoicing on 30-day credit terms, and until now its account received mainly cheques and online transfers from four regular buyers. A junior analyst marks the alert 'below threshold, no report needed' and closes it. The relationship manager says Vinco is expanding into retail sales and does not want to lose the account before a planned loan renewal. The branch's AML risk assessment rates the customer medium risk. The compliance officer must decide before the next deposit, expected on Friday.
1. Identify the red flags and explain why the below-threshold reasoning is unsafe. What questions must be answered before Friday?
Read the worked answer
Threshold reasoning
The LKR 1 million figure is an internal reporting trigger, not a safe harbour. Suspicion is assessed on the whole relationship, not on whether a single deposit crosses a line. Eleven deposits of LKR 780,000–950,000 in seven weeks total LKR 9.4 million. The pattern is consistent with structuring: repeated amounts below the trigger, third-party depositors, and a business profile that describes B2B credit sales rather than cash retail sales. The analyst's closure is unsafe because it treats the threshold as the only test and ignores aggregation, source of cash, and the customer's profile. Medium risk is a starting point, not a conclusion.
Questions before Friday
Who are the three depositors, and what is their relationship to Vinco and to the director? What sales, invoices or ledgers explain each cash amount? Has Vinco actually begun retail sales, and if so where are the receipts, VAT records and customer list? What is the source of the cash, and which bank accounts or customers does it come from? Who are the beneficial owners, and are any of them PEPs or subject to adverse media? What cash volumes should the bank expect, and why were earlier transfers mostly cheques and online? Has the customer been asked about the deposits, and what did it say? The loan renewal must not influence the AML judgement.
2. Set out the immediate actions, including whether an STR should be filed, how to handle the customer and staff, and what records to preserve.
Read the worked answer
Immediate actions
Escalate to the MLRO and reopen the alert; do not let the branch close it. Treat the matter as a potential STR case and decide promptly whether suspicion is established. If it is, file an STR with the FIU and do not tell the customer, the driver or the cousin that a report has been made or is being considered. Internal sharing should be need-to-know: the relationship manager may need to be instructed not to discuss the alert, and the loan team should be separated from the AML decision.
Account handling
Consider whether the next deposit should be accepted. Under the applicable law the bank may be able to seek consent to continue, impose restrictions, or refuse further cash deposits while the investigation continues; the MLRO should determine which is available. Do not simply close the account to avoid the problem, because that can displace the risk and may itself raise tipping-off or de-risking concerns.
Records and remediation
Preserve deposit slips, CCTV, identification records for the depositors, screening results, alert notes and all emails. Record why each decision was taken. Give the analyst feedback and check whether other branches have similar patterns. If the relationship continues, apply enhanced monitoring and senior approval, and keep the loan renewal decision independent of the AML outcome.