Three deposits just under the reporting line
At a Lahore branch of a mid-sized Pakistani bank, the relationship manager for Rashid Traders, a sole proprietorship that imports packaging material, notices three cash deposits within nine days: PKR 1.85 million, PKR 1.90 million and PKR 1.75 million. Each was made at a different branch and each sits just below the PKR 2 million threshold used for currency transaction reporting. The declared annual turnover at onboarding was PKR 30 million, and the account has been active for 14 months. Two days after the third deposit, the customer instructs an online transfer of PKR 5.2 million to an account at another bank opened only six weeks ago. When asked, he says the money came from a property sale but produces no sale deed. The branch manager argues that no CTR is needed because no single deposit reached the threshold, and that filing anything would embarrass a long-standing customer.
1. Identify the red flags in this pattern and explain what each one suggests about possible money laundering or terrorist financing.
Read the worked answer
The pattern should be read as a whole, not as three isolated cash deposits. First, three deposits in nine days, each just below PKR 2 million, is a classic structuring indicator: the customer appears to be keeping each transaction under the CTR threshold while still moving a large aggregate amount. Second, using three different branches reduces the chance that one branch sees the full picture, which is consistent with smurfing or deliberate avoidance of monitoring. Third, the cash intensity does not fit the declared profile: annual turnover of PKR 30 million for a packaging importer does not naturally explain PKR 5.5 million of cash in nine days. Fourth, the rapid onward transfer of PKR 5.2 million to an account only six weeks old suggests layering and raises the possibility that the receiving account is a mule or pass-through account. Fifth, the explanation of a property sale is vague and unsupported by a sale deed, so the bank cannot establish a legitimate source of funds. The branch manager's argument that the customer is long-standing is not a risk mitigant; long-standing customers can be used to legitimise funds. Even attempted transactions and patterns below the threshold must be considered under a risk-based approach. The combination points to possible placement and layering, and the bank should not wait for a single reportable transaction before escalating.
2. State whether the bank should file a CTR, an STR, both or neither, and set out the process, recipient and timing considerations under Pakistan's AML/CFT regime.
Read the worked answer
On the facts, each individual cash deposit is below PKR 2 million, so a CTR is not triggered by any single deposit unless the bank's system or the FMU's prescribed rules require aggregation of related cash transactions. The bank should check its aggregation logic, but the more important obligation is the STR. An STR has no monetary threshold and is required where the bank knows, suspects or has reasonable grounds to suspect that funds are the proceeds of crime or are linked to terrorist financing. The pattern here meets that test: structuring, profile mismatch, rapid onward movement and an unsubstantiated source of funds. The branch should escalate to the compliance/MLRO function, which should file the STR with the Financial Monitoring Unit promptly and in the format required. The bank should not wait for proof of wrongdoing; suspicion is enough. The STR should describe the three deposits, the branches used, the onward transfer, the customer's explanation, KYC information and the action taken. The branch manager should not be told that an STR has been filed; only those with a need to know should be involved. Tipping off the customer is an offence. If a later single cash deposit of PKR 2 million or more occurs, a CTR should also be filed. CTR and STR obligations are not mutually exclusive, and the bank should consider whether to delay or block the pending transfer pending review, documenting its decision either way.
3. What should the branch do about the pending transfer, the customer relationship and the record of the decision? Address tipping-off.
Read the worked answer
The pending transfer of PKR 5.2 million should not be released automatically. The bank should place it on hold pending compliance review, because releasing it could facilitate layering and could expose the bank if the receiving account is later found to be suspicious. The branch should not tell the customer that the delay is because of an STR or a suspicion of money laundering. A neutral response, such as saying the payment is undergoing routine verification, is appropriate. The relationship should be placed under enhanced monitoring, and senior management should consider whether to exit the relationship if the customer cannot substantiate the source of funds. Any exit should be handled carefully so as not to tip off the customer or others. The bank must retain the STR, investigation notes, transaction records, KYC documents, the customer's explanation and the rationale for allowing or blocking the transfer. Retention should be at least five years after the end of the relationship, and longer if required by a regulator or litigation. Staff handling the case should be reminded of confidentiality. The branch manager should not lobby to suppress the report; if he does, that should be escalated as a governance issue. The record should show who decided, when, on what evidence and with what approval, so that the bank can demonstrate a reasoned risk-based decision.