Structuring exposes the limits of identity-led AML controls

At a glance

What this is: This is a Veriff analysis of structuring in AML, showing that sub-threshold deposits, AI-generated identities, and deepfakes weaken identity-led controls when banks rely too heavily on transaction monitoring alone.

Why it matters: It matters because financial institutions need AML programmes that connect identity proofing, transaction pattern analysis, and suspicious-activity reporting, rather than treating them as separate controls.

By the numbers:

• The Veriff Fraud Index 2025 reports a 21% year-on-year increase in online fraud since 2024.
• The Veriff Fraud Index found that almost 79% of people have been targeted by AI-generated fraud or deepfakes at least once in the last year.
• More than 97% of people believe strong security measures matter when signing up for a new financial service, according to Veriff's Fraud Index 2025.
• More than two-thirds of consumers say they are happy to use identity verification and biometric technology for stronger protection, according to Veriff's Fraud Index 2025.

Context

Structuring, also called smurfing, is the practice of splitting a large cash movement into smaller transactions so each one stays below a legal reporting threshold. In the United States, that threshold is $10,000 for cash transactions, which means the control problem is not the size of one deposit but the pattern created across deposits, branches, days, and accounts.

For AML teams, the issue is governance as much as detection. Identity proofing, transaction monitoring, and suspicious-activity reporting are often operated as separate workflows, but structuring exploits the gaps between them. When AI-generated identities and deepfakes make account creation easier to fake, the account layer becomes part of the laundering path, not just the onboarding step.

Key questions

Q: What breaks when AML programmes rely mainly on transaction thresholds?

A: Threshold-based monitoring misses structuring because the behaviour is distributed across smaller deposits that look ordinary in isolation. The failure is not the absence of alerts, but the absence of correlation across time, branch, account, and identity. Teams need behavioural joins, not just amount triggers, to see the laundering pattern.

Q: Why do synthetic identities make structuring harder to detect?

A: Synthetic identities let criminals create mule accounts that look legitimate enough to pass onboarding and then absorb structured deposits. That shifts the problem upstream from transaction monitoring into identity proofing and account issuance. When onboarding assurance is weak, downstream AML controls inherit false trust and fewer reliable signals.

Q: How should financial institutions connect identity proofing to AML monitoring?

A: They should treat onboarding confidence as an input to AML triage, not a separate compliance step. Higher-risk accounts need stricter behavioural thresholds, stronger monitoring, and faster review because weak identity assurance increases the chance that structured deposits are being routed through mule accounts.

Q: How can teams tell whether suspicious-activity reporting is working?

A: A good test is whether the system can build a complete case from linked identities, deposits, timing, and locations without manual reconstruction. If SARs still depend on analysts stitching together disconnected alerts, the reporting workflow is descriptive rather than investigative and will lag structured laundering patterns.

Technical breakdown

How structuring stays below reporting thresholds

Structuring works by fragmenting one large transaction into many smaller ones that stay under the threshold that triggers reporting. In the article's example, US$50,000 is deposited as five separate US$10,000 transactions, sometimes across multiple days, branches, or institutions. The technical issue is not the individual deposit, but the intent revealed by the sequence and distribution. Basic threshold rules can therefore miss the pattern when no single transaction looks exceptional. Effective detection requires correlating amounts, timing, location, and linked identities across records, because the laundering logic emerges only when the transactions are reassembled into one behavioural view.

Practical implication: monitor cross-transaction patterns, not just single-deposit thresholds.

Why AI-generated identities increase mule-account risk

The article ties modern AML pressure to AI-generated identities and deepfakes, which let criminals create believable fake customers and supporting documents. That matters because mule accounts are often the operational layer used to receive and move structured deposits. If onboarding controls cannot reliably prove the account holder is real, the bank may be validating an identity shell that exists only to absorb funds and fragment them further. This is where identity verification and fraud detection intersect. The problem is not only impersonation, but scale: synthetic identities can be created quickly, repeatedly, and with enough variation to evade manual review.

Practical implication: strengthen identity verification before accounts are opened for high-risk payment activity.

How AML reporting workflows are being automated

The article says systems can compile suspicious-activity report inputs automatically, including who is involved, what instruments were used, when and where the activity occurred, and why it is suspicious. That automation matters because structured laundering cases create a lot of low-signal events, and manual collation slows the response. SAR generation is therefore part of the control chain, not just a back-office task. The governance challenge is ensuring the report reflects correlated evidence rather than isolated alerts. In practice, automated reporting only helps if upstream detection has already linked the deposits, identities, and behaviours into a defensible case.

Practical implication: automate SAR preparation only after detection logic can join identity and transaction evidence.

Threat narrative

Attacker objective: The attacker objective is to move illicit cash into the financial system while avoiding regulatory reporting and obscuring the origin of the funds.

1. Entry occurs when a criminal uses a synthetic or fraudulently verified identity to open accounts that can receive cash deposits without immediate suspicion.
2. Credential and account access are then used to place repeated sub-threshold deposits, often distributed across branches, days, or institutions to avoid a single reporting trigger.
3. Escalation happens when linked accounts and coordinated deposit patterns create a laundering network that is difficult to see through manual review alone.
4. Impact is achieved when illicit funds are moved into the legitimate financial system while compliance teams receive only fragmented signals and delayed reports.

NHI Mgmt Group analysis

Structuring is a control-gap problem, not just a transaction-size problem. The article shows that splitting payments into sub-threshold amounts defeats alerting when monitoring logic is too local. AML programmes that evaluate each deposit in isolation are already behind the behaviour they are meant to govern. The practitioner conclusion is that structuring detection has to be built around patterns, not thresholds alone.

Identity-led AML fails when onboarding and monitoring are treated as separate domains. Veriff's discussion of AI-generated identities and deepfakes shows that the account layer can be manufactured before laundering begins. That means the trust decision at onboarding directly shapes what the transaction-monitoring layer will later see. The practitioner conclusion is that identity proofing is part of AML control design, not a front-door formality.

Suspicious activity reporting only works when evidence is correlated before submission. The article's SAR workflow depends on joining who, what, when, where, and why into one case narrative. If the underlying systems cannot connect deposits across accounts and time, reporting becomes administrative rather than investigative. The practitioner conclusion is that AML reporting quality depends on correlation quality upstream.

AI-generated identity is now a laundering enabler, not just a fraud channel. The same synthetic identity techniques used to open bogus accounts can also supply the mule network that structured cash deposits require. This widens the threat model for financial institutions beyond customer onboarding mistakes into account orchestration and transaction coordination. The practitioner conclusion is that financial identity governance must assume synthetic account populations will be part of the attack surface.

Identity-led AML control must be measured against coordinated behaviour, not isolated KYC pass rates. The real question is whether a programme can connect onboarding, account ownership, and suspicious deposit patterns across channels. If it cannot, the institution may still be compliant on paper while operationally blind to structuring. The practitioner conclusion is to test the join between identity proofing and monitoring, not either control on its own.

What this signals

Identity-led AML needs a tighter join between onboarding and behaviour. Structuring is effective when institutions trust the account before they have enough evidence about the actor behind it. That creates a governance gap between identity proofing and transaction monitoring that financial crime teams need to close in one operating model.

Structured deposits expose a blind spot in threshold-based controls. The control surface must move from single-transaction alerts to account network analysis, because laundering behaviour is often only visible when deposits, branches, and identities are linked together.

Synthetic identity risk now belongs in AML design discussions. Deepfakes and AI-generated identities are not only fraud enablers at onboarding. They also supply the mule infrastructure that makes low-value deposit fragmentation viable at scale.

For practitioners

• Strengthen identity proofing for high-risk account types Use stronger document, biometric, and liveness checks where accounts can be used for cash-heavy or rapid-deposit behaviour, especially when synthetic identity risk is elevated.
• Correlate deposits across branches and institutions Tune AML rules to join sub-threshold deposits by timing, geography, and shared identity signals so structuring appears as one behavioural pattern rather than many small events.
• Join onboarding risk to transaction monitoring Feed identity-verification confidence into AML triage so accounts opened with weaker assurance are reviewed with lower thresholds and tighter behavioural scrutiny.
• Automate SAR assembly from linked evidence Build report generation around related identities, deposits, and locations so suspicious activity reports contain a coherent case narrative instead of disconnected alerts.

Key takeaways

• Structuring defeats AML programmes when deposits are assessed one by one instead of as a coordinated pattern across accounts and channels.
• The article connects modern laundering risk to AI-generated identities, deepfakes, and mule accounts, which makes onboarding assurance part of AML design.
• The practical fix is to join identity proofing, behavioural monitoring, and suspicious-activity reporting so evidence is correlated before escalation.

Key terms

• Structuring: Structuring is a money-laundering technique that breaks a large transaction into smaller ones to avoid reporting thresholds. The fraud works because each transfer can look ordinary on its own, so investigators need aggregated behavioural analysis and identity linkage to see the pattern.
• Mule Account: A mule account is an identity or account used to receive, move, or obscure illicit funds on behalf of another party. In financial crime operations, it is the bridge between the initial deception and the laundering phase, often appearing legitimate until behavior reveals coordination.
• Synthetic Identity: A synthetic identity is a software-based actor that can authenticate, request access, and execute actions without being a human user. In practice, this includes AI agents, bots, service accounts, tokens, and other machine identities that need clear ownership, scope, and revocation.
• Suspicious activity report: A suspicious activity report is a formal regulatory filing used when activity cannot be explained by the customer profile or expected behaviour. Strong reporting depends on clear evidence, documented reasoning, and timely submission, because weak narratives are a common audit and supervisory failure point.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.