Nine Deposits Just Under the Threshold

Go through the typologies and mark each against the facts.

• Structuring. Nine deposits clustered between RM 23,000 and RM 24,500, each deliberately below a known reporting trigger, is the textbook indicator. The probability that this range occurs nine times by chance is negligible.
• Placement through branches. Four branches over five weeks suggests a deliberate attempt to avoid a single branch's familiarity threshold.
• Third-party deposits. Cash handed in by a non-account holder on two occasions raises beneficial ownership and nominee questions the file cannot answer.
• Profile inconsistency. A 34-year-old consultant depositing over RM 200,000 in cash is not consistent with salaried remuneration; the client cannot be paid that way.
• Trading pattern. Concentrated buying of a thinly traded counter ahead of an announcement, then exit within two days, is either an extraordinary coincidence or a serious market conduct issue in its own right.
• Non-cooperation and subtle threat. "Family" is not source of funds. Offering to leave if the paperwork is inconvenient is a pressure tactic aimed at the person asking the question.

The reporting decision is straightforward: report. Two points are commonly misunderstood and appear in exam scenarios. First, the obligation is suspicion-based, not threshold-based - staying under the cash reporting trigger does not avoid the suspicious transaction reporting duty; deliberately staying under it is itself the suspicion. Second, there is no de minimis and no requirement that Faizal be certain. Suspicion that a person is or may be involved in an offence is sufficient. The report should be raised through the firm's money-laundering reporting officer without delay, and it should cover the market conduct angle too, since the same transaction set supports both suspicions.

Correspondingly, the fact that the client is "a good customer" is not a relevant consideration and is not a defence.

Faizal's obligations run in three directions.

Towards the firm. He must report internally, immediately, in writing. A request to suppress or delay suspicion-based escalation is not an instruction he may follow. It should itself be recorded and escalated as a potential failure of the firm's internal controls, because the reporting channel is only as strong as the first-line employee's ability to use it without fear.

Towards the client. He must not do anything that amounts to tipping off - telling the client or any third party that a report has been or may be made, or doing anything that could prejudice an investigation. "Quietly completing the checks" is dangerous precisely because the natural next step in a quiet conversation is a hint: we may need to ask you some more questions about this cash. That is a disclosure risk. Avoid it by keeping client-facing communication factual and unrelated to the reporting decision - for example, requesting the outstanding source-of-funds documentation as a standard account maintenance requirement, without reference to any report.

Towards the transaction. Do not progress the transaction while the report is pending without the MLRO's agreement. If the firm decides to continue, that continuation requires documented senior approval and should not be the relationship manager's call.

What Faizal must not do: delay escalation, accept the relationship manager's instruction and document it as agreed, complete onboarding checks in a way that records the file as satisfactory, or handle the matter in a message that suggests concealment. Write the escalation as a factual chronology with dates, amounts, branches and the client's answers, and send it to the MLRO, copying compliance - not to the manager alone.

Finally, the market conduct angle should not be lost: the trading pattern around the announcement may need separate escalation, and potentially a separate report, depending on how the firm's regime structures market misconduct versus money-laundering reporting.

Continuation is a separate decision from reporting, and the answer is not automatic in either direction. Reporting an activity does not require the firm to exit, and exiting does not discharge the reporting duty. Work the factors:

In favour of exit (freeze and consider terminating):

• Repeated structuring below a reporting threshold, which is a deliberate act rather than neglect.
• Unverified source of funds after a specific request, plus an evasive answer ("family").
• Third-party cash deposits with no documented relationship to the account holder.
• The trading pattern around the announcement, which indicates possible misuse of information.
• The client's willingness to use the threat of exit as leverage against the firm's checks.

Against immediate exit:

• Terminating abruptly and explaining why can amount to tipping off and can prejudice the pending report and any subsequent investigation.
• Exiting without reporting can look like the firm washing its hands of the customer and passing the problem elsewhere.
• There may be other clients or accounts connected; a hasty exit may destroy visibility.

The appropriate path. Report first. Then place the account under enhanced monitoring and a hold on further cash deposits pending satisfactory source-of-wealth verification. The continuation decision should be taken by a senior MLRO or risk committee, not by the relationship manager whose commercial interest is obvious and should be recorded as such. If exit proceeds, do it in a manner consistent with the firm's policy: let the client close on ordinary commercial grounds, do not disclose the reason, do not return the relationship in a way that facilitates structuring elsewhere if the firm's policy prohibits it, and document the decision and its rationale.

Finally, the relationship manager's request to go quiet should be reviewed separately as a conduct issue. An organisation that tolerates it will find that its next suspicious file never reaches the MLRO either.