Structured Cash Deposits at a Branchless Banking Agent
A mid-tier bank's branchless banking (BB) agent in Orangi Town, Karachi, handles 42 cash-in deposits over 18 days, each between PKR 1.85 million and PKR 1.96 million, tendered by 28 different CNIC holders. Most depositors are students, daily-wage workers, or shopkeepers whose stated monthly income is below PKR 60,000. After deposit, funds are consolidated into six mobile wallets and moved the same day by interbank funds transfer to three accounts at another bank. The agent's commission pattern is flat, and the agent's own account received two unexplained credits of PKR 500,000 from one of the depositors. The bank's transaction monitoring system generated only three CTRs and no alerts, because the rule is set at PKR 2 million per transaction and does not aggregate linked wallets. The branch manager considers the agent a strong performer and resists disruption.
1. Should the bank file a suspicious transaction report (STR), and how does the PKR 2 million currency transaction reporting (CTR) threshold affect that decision? Set out the reasoning.
Read the worked answer
The CTR threshold is a reporting trigger, not a safe harbour. A CTR is required for cash transactions at or above PKR 2 million, but an STR has no minimum amount: it is triggered by knowledge, suspicion, or reasonable grounds to suspect that funds are proceeds of crime or linked to terrorism financing.
Here the facts supply that suspicion. Forty-two deposits in 18 days, each deliberately kept below PKR 2 million, from 28 CNIC holders whose stated incomes do not match the amounts, followed by same-day consolidation into six wallets and onward transfer to three accounts, is a structuring pattern. The agent's unexplained PKR 500,000 credits add a facilitation or corruption indicator. The bank should file an STR promptly, cross-reference the three CTRs, and describe the aggregation and wallet flows. It should not wait for proof. It also should not treat the CTRs as discharge of its obligation: the STR should flag the monitoring rule gap so that aggregation logic is fixed.
2. What immediate investigative and containment steps should the AML/CFT function take, and what must staff avoid doing?
Read the worked answer
The AML/CFT function should preserve the agent's transaction logs, wallet KYC records, device and IP data, deposit slips, CNIC copies, and the agent's own account statements. It should review the 28 depositors' profiles and account activity, check whether they are mules or genuine customers, and screen all parties against sanctions and PEP lists. It should examine whether the six wallets are controlled by one person or cluster and whether the three receiving accounts belong to related parties.
Containment should be proportionate: suspend new cash-in limits for the agent while the review is underway, increase monitoring, and escalate to the MLRO. Staff must not tell the agent, the depositors, or the branch manager that an STR is being considered. They must not close accounts or destroy records to "clean up" the relationship. They should document each decision and its rationale, because the bank may need to justify why it continued or restricted the relationship. A decision to keep the agency live during the review is defensible only with enhanced monitoring and a clear remediation plan.
3. The agent is a top performer. Should the bank terminate, suspend, or remediate the agency relationship? Identify the facts that would change your answer.
Read the worked answer
The principal bank remains responsible for the AML/CFT controls of its branchless banking agent, so performance is not the test. The default should be suspension of high-risk cash-in activity pending an on-site review, not immediate termination and not passive remediation. The review should test whether the agent knew or should have known about the structuring, whether the PKR 500,000 credits were a kickback, whether the agent's staff performed CDD, and whether the agent's own account is being used to launder funds.
Termination becomes the right answer if there is evidence of complicity, repeated breach after warning, falsified CDD records, or refusal to cooperate. Remediation is defensible if the failures are control gaps: weak aggregation logic, poor staff training, inadequate monitoring, or a single rogue employee. Facts that would change the decision include a credible explanation for the PKR 500,000 credits, evidence that the depositors are genuine customers with verified income, a clean on-site inspection, and a verifiable remediation plan. The bank should also consider whether it must report the agent to its regulator.