Structuring — breaking a large sum into many smaller deposits to dodge reporting thresholds — is one of the oldest laundering techniques and still one of the most common. Its whole design is to look unremarkable transaction by transaction. Catching it means looking across transactions, accounts and time.
The signals that matter
A good structuring scenario combines several signals:
- Aggregation windows — sum activity per customer over rolling periods (a day, a week) and compare against thresholds, not single transactions.
- Sub-threshold clustering — many deposits landing just below a reporting limit is more suspicious than one large one.
- Cross-account coordination — “smurfing” spreads deposits across multiple accounts or individuals feeding a common beneficiary.
- Cash intensity — a sudden shift toward cash relative to a customer’s baseline.
Why it belongs near the data
These calculations need the full transaction history, joined and aggregated. Doing that in a vendor cloud means exporting exactly the records you’d rather keep home. With near-data monitoring, the aggregation runs inside your data plane; only the resulting alerts leave.
From pattern to network
Individual structuring alerts get sharper when you resolve the entities behind them. Linking accounts, individuals and beneficiaries into a graph exposes the coordination that single-account rules miss — the same entity-resolution approach used to surface fraud rings.
Tuning without the noise
The failure mode of any threshold rule is false positives. The data-science agent tunes windows and thresholds against your historical outcomes so analysts see real risk, not everyone who happens to make regular deposits.
Structuring hides in aggregate. Score in aggregate — on your own data — and it stops hiding.