Structuring and Mule-Account Cluster at a Mid-Size Exchange

The pattern shows structuring, mule-account use, and layering. Deposits are deliberately kept below $10,000, spread across 11 banks, and aggregated across 38 newly opened accounts. The shared device fingerprint, Tor logins, clustered addresses, and reused utility bill indicate coordinated identity manipulation rather than independent customers. Rapid conversion to BTC and transmission to four shared addresses is consistent with placement and layering through mule accounts.

Immediate actions should include: (1) preserve account, device, IP, and blockchain data before any closure; (2) escalate to enhanced due diligence, including source-of-funds requests and negative-news screening; (3) trace the four deposit addresses and identify any exposure to darknet markets, mixers, or sanctioned addresses; (4) aggregate the 38 accounts for SAR purposes rather than treating each as isolated; (5) restrict further deposits without tipping off the customers; and (6) have counsel and the BSA officer decide whether to close now or continue monitoring to identify controllers. Closure is permissible, but the exchange must not tell customers that a SAR was or will be filed, and it should not return funds to a third party without legal review.

The narrative should answer who, what, when, where, why, and how: 38 accounts, 57 ACH deposits totaling $512,000, the date range, the 11 banks, the 24-hour conversion pattern, the four shared BTC addresses, the common device fingerprint, Tor use, address clustering, and the reused utility bill. It should explain why the activity is suspicious, not merely describe it, and should identify the subjects and any known controllers. The internal 24-hour review deadline is not the SAR deadline. FinCEN generally requires a SAR within 30 calendar days after initial detection of facts that may constitute a basis for filing; if no suspect is identified, the institution may take up to 60 calendar days. ChainBridge should document its detection date and file within the applicable period.

ChainBridge may close accounts, but it must not disclose that a SAR was filed or that the customer is suspected of illicit activity. A closure notice should be generic and reviewed by counsel. Tipping off is prohibited and can create criminal exposure. The exchange should also avoid returning funds to the shared addresses or to a new third party without confirming ownership and legal authority.

First, implement related-account aggregation using device fingerprint, IP, address, and beneficiary clustering at onboarding and periodically thereafter. This would have surfaced the 38 accounts as one network before $512,000 was deposited. Second, add blockchain-analytics rules that automatically escalate transfers to shared or high-risk addresses, including mixers and sanctioned wallets. This addresses the layering step and produces evidence for the SAR. Third, adopt enhanced due diligence triggers for new accounts with rapid pass-through activity, especially deposits just below reporting or monitoring thresholds. That would force source-of-funds review before conversion to BTC.

Supporting changes should include a written investigations procedure with a named owner, Tor/VPN risk scoring, periodic agent and customer screening, and board-level reporting on alert dispositions. The exchange should also test whether its monitoring scenarios aggregate ACH deposits across accounts and whether account closure procedures preserve records. These changes target the actual failures: siloed reviews, weak new-account monitoring, and no blockchain-driven escalation.