What are the signs that structuring activity is taking place across accounts or branches?

Common signs include multiple deposits just below the threshold over several days, repeated withdrawals from different branches or ATMs, and customers opening accounts with similar details or unclear reasons. A pattern of small transactions that add up to a large total is more important than any single event. These behaviours often indicate an attempt to stay below reporting limits.

When structuring shows up as a pattern, not a single transaction

Structuring is usually visible only when you step back and compare behaviour across time, locations, or accounts. The key signal is repetition that appears designed to avoid a reporting trigger, rather than a one-off unusual cash event. That is why branch-to-branch movement, split deposits, and repeated small transactions matter more than any individual deposit or withdrawal.

Look for a pattern that becomes meaningful when aggregated: multiple deposits just under the threshold, repeated activity across different branches or ATMs, and several accounts that share similar opening details or weakly explained purpose. If the same customer profile keeps resurfacing in small increments, the behaviour is more consistent with concealment than with ordinary retail banking noise.

What makes cross-account and cross-branch activity especially suspicious

Cross-account structuring often works because it fragments the trail. A single account may not appear abnormal, but several related accounts can collectively move a large value while staying below review thresholds. Cross-branch activity can serve the same purpose by spreading transactions across places and times to reduce obvious concentration in one relationship or one reporting view.

This is where relationship analysis becomes important. Shared addresses, contact details, introducers, funding sources, device data, or withdrawal cadence can connect accounts that otherwise look separate. In practice, the strongest indicator is not the destination or the branch alone, but the combination of similarity, repetition, and a transaction pattern that only makes sense when the activity is viewed as one sequence.

For practitioners who need a control baseline, money-laundering detection guidance is often paired with reporting and customer-risk controls such as FATF Recommendations, the international AML/CFT standard and NIST Cybersecurity Framework 2.0 for governance and detection discipline.

Risk and Threat Considerations

Structuring is risky because it deliberately exploits visibility gaps in threshold-based monitoring. The failure mode is simple: each event looks ordinary in isolation, while the combined pattern reveals coordinated evasion of reporting, alerting, or review logic. When accounts or branches are used together, investigators can miss the linkage unless they have entity resolution and pattern-based monitoring.

Failure mechanism: Offenders split activity across accounts, branches, or days to keep each transaction under a trigger point, then rely on weak linkage rules or fragmented monitoring to avoid detection.

Impact: Missed structuring can delay suspicious activity reporting, weaken case escalation, and allow larger laundering or placement activity to continue unchecked.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0 provides the primary governance reference for this topic.

Framework	Control / Reference	Relevance
NIST CSF 2.0	GV.RM — Risk Management Strategy	Structuring detection depends on governance choices about monitoring thresholds and escalation risk tolerance.
	DE.CM — Continuous Monitoring	Cross-account structuring is detected through ongoing monitoring of repeated small-value activity patterns.
	RS.AN — Analysis	Investigating structuring requires analysis that correlates seemingly small events into a single pattern.
Recommendation — Set escalation thresholds and review cadence for structured-transaction patterns across branches. Monitor transaction sequences continuously for repeated sub-threshold activity and linked-account behaviour. Correlate linked transactions and customer attributes during alert analysis to expose structuring patterns.

Practitioner Guidance

What to verify: Do not evaluate these alerts at transaction level only. Check whether the same customer, beneficial owner, device, funding source, or introducer appears across accounts or branches, and confirm whether the pattern persists over multiple days or weeks.

Decision rule: If a sequence only appears benign when each transaction is isolated, treat the aggregated pattern as the primary investigative object. If the pattern is distributed across branches, escalate faster, because dispersion is often part of the concealment method.

Common mistake: Teams often overfocus on the amount of any single transaction and underweight the cadence, similarity, and account linkage. Structuring alerts are usually about behavioural pattern recognition, not threshold breach alone.

Practitioner takeaway: The correct question is not “Did one transaction cross the limit?” but “Do several smaller actions, taken together, show a deliberate attempt to fragment value and avoid oversight?”