Twenty-Eight Deposits Just Under the Threshold

The indicators are cumulative and, taken together, not plausibly explained by the stated profile.

Indicators. (1) Volume inconsistent with profile: RM1.42 million deposited on a RM6,500 salary is roughly eighteen years of gross income in eight months. (2) Structuring: 28 deposits, every one deliberately below the RM25,000 cash transaction reporting threshold, spread across two branches and three banks - the pattern itself is the evidence, not any single deposit. (3) Third-party funding: unidentified depositors are a classic layering feature, and "helping a friend" is not source-of-funds information. (4) Evasion of documentation: refusing twice to evidence an inheritance, then becoming hostile, is a red flag, not merely reticence. (5) Probing the controls: asking whether small deposits are reported, and asking to use a brother's name, indicates awareness of thresholds and intent to avoid them. (6) Trading pattern: rapid, high-turnover small-cap dealing with no coherent investment rationale is consistent with layering or with market abuse.

What Lily must do. Escalate internally to the compliance/AML function without delay. The decision to submit a suspicious transaction report is the firm's, through its nominated officer, to Bank Negara Malaysia's financial intelligence unit; Lily's duty is to report her suspicion internally and not to investigate it herself. She must not tell Ravi, or hint, that a report is being made or considered.

Her personal view is irrelevant to the decision. AML obligations are triggered by suspicion, not by proof or by character. Long acquaintance is exactly the condition that produces tipping-off and under-reporting. Honest people do not structure deposits across three banks to stay under a threshold.

The request should be refused, clearly and without accusation, and the refusal recorded.

Why refuse. Using another person's name to hold an account the firm has been told is for a different beneficial owner is a misrepresentation of identity. If the brother is genuinely the client, he must be onboarded in his own right - identified, verified, risk-profiled, and asked about source of funds - and Ravi must be recorded as a third-party operator with a documented mandate. If the brother is not genuinely the client, the account is a nominee arrangement designed to obscure beneficial ownership, which is precisely what the firm must prevent. "The limits are better" is not a legitimate reason for a name change; there is no legitimate reason for one.

Risks of agreeing. The firm would hold an account whose stated holder is not the real controller; every subsequent transaction becomes harder to attribute, suspicious activity reporting becomes unreliable, and the firm risks facilitating layering. It would also create an immediate tipping-off risk: Ravi's question shows he is testing the controls, and a cooperative answer would confirm what he is probing for.

Risks of over-reacting. Refusing aggressively, or freezing the existing account on the spot, can also amount to tipping off and may harm an innocent client. The correct tone is procedural: "accounts must be held in the name of the beneficial owner; we will need identification and source-of-funds evidence for your brother before we can proceed."

Both directions covered. The firm should also decide, at compliance level, whether to continue transacting on the existing account pending the review. Continuing normal business is often permissible, but any decision to restrict must come from the AML function, documented, and communicated in neutral terms that do not reveal a report.

The file must be able to answer, six years later, why the firm acted as it did. Record retention obligations for customer due diligence and transaction records run for at least six years after the relationship ends or the transaction is completed, so the file is not a short-term artefact.

Contents. The original onboarding record with the stated occupation and income; every deposit record with date, branch, amount, channel and the identity of the depositor; copies of the identification obtained and the identification refused; the internal escalation note with date and time; the rationale for the suspicion decision; the suspicious transaction report reference if one was filed; the instruction and correspondence on the brother's account; the decision on whether to continue transacting, and who took it; and all client communications, in the tone actually used.

Good practice over the following months. Enhanced ongoing monitoring on the account - tighter review of deposits, counterparties and trading. A refreshed customer due diligence exercise, with the source-of-wealth question asked once, properly, in writing, with a stated deadline and a clear consequence if unanswered. A branch-level look at whether the same depositor or the same pattern touches other accounts. A check on whether the branch target pressure Lily is under is generating weak onboarding across the book - one structured file rarely exists alone. Finally, training: Lily's instinct to trust a familiar family is normal, and the control that catches it is a process that does not depend on her instinct.