Structuring and Smurfing: How Criminals Dodge Reporting Thresholds

Cash reporting rules are designed to give banks and authorities visibility into large currency movements that may be linked to money laundering, tax evasion, fraud or other crime. Criminals may try to avoid that visibility by splitting a larger amount into smaller transactions. Two closely related terms describe this behavior: structuring and smurfing.

The practice is not merely a technical breach of a bank's procedures. In the United States, deliberately arranging transactions to evade certain reporting requirements is itself a federal crime. The legality of the money does not necessarily change that result if the person acted with the intent to evade reporting.

What is structuring?

Structuring means breaking up a cash transaction that would trigger a reporting requirement into smaller transactions intended to stay below that threshold. The best-known US example involves the Currency Transaction Report, or CTR. Banks generally must file a CTR for cash transactions totaling more than $10,000 by, or on behalf of, the same person in one business day.

A threshold is a reporting trigger, not a cap on lawful banking. A customer may lawfully deposit, withdraw or exchange more than $10,000 in cash, and a bank may ask questions and file the required report. The problem arises when someone intentionally divides activity to prevent the bank from recognizing or reporting the larger amount.

For example, a person with a larger quantity of cash might make a series of smaller deposits on successive days, or separate a transaction among accounts, with the purpose of avoiding a CTR. Whether conduct amounts to structuring depends heavily on facts and intent. A customer who happens to make several smaller cash transactions for ordinary reasons is not automatically committing a crime.

What is smurfing?

Smurfing is a more organized form of structuring. It involves multiple people, often called smurfs, who make deposits, purchases, money-order transactions or other financial moves on behalf of another person or group. Spreading transactions among people can make the activity appear less connected at first glance.

A smurfing operation may use different bank branches, financial institutions, accounts or locations. It can also involve intermediaries who are paid to conduct transactions, sometimes without fully understanding the source of the funds. The central feature is coordination: multiple actors are used to fragment activity that is effectively tied to one source, beneficiary or criminal enterprise.

Why US law treats structuring separately

US anti-money-laundering rules require financial institutions to report certain cash transactions and suspicious activity. The Bank Secrecy Act framework makes it unlawful to structure, or attempt to structure, transactions for the purpose of evading reporting requirements. The rule can apply even where the cash was earned lawfully, such as proceeds from a cash-intensive business, if the customer intentionally sought to defeat the reporting system.

That distinction matters because some people incorrectly assume that only illicit funds create legal risk. Banks also may file a Suspicious Activity Report, or SAR, when they suspect possible money laundering, fraud, structuring or other suspicious conduct. A SAR is not a finding of wrongdoing. It is a confidential report used by financial institutions to alert US authorities to potential concerns.

• A CTR concerns qualifying cash transactions and is generally triggered above $10,000 in a single business day in the United States.
• A SAR may be filed when a bank identifies suspicious behavior, including apparent attempts to avoid a CTR.
• Banks assess related activity across accounts, customers, branches and time periods rather than viewing each transaction in isolation.
• Rules, thresholds and reporting processes differ outside the United States. EU institutions follow EU anti-money-laundering rules as implemented through national law.

How banks and compliance teams detect the pattern

Banks use transaction-monitoring systems, customer records and human investigation to identify activity that may be connected. These controls look beyond whether any one deposit is below a reporting threshold. They may aggregate cash transactions made on the same day, compare activity with a customer's expected profile and identify links among accounts, depositors and beneficiaries.

Common warning signs include repeated cash amounts just below a familiar reporting threshold, frequent transactions with no clear business rationale, multiple people depositing into one account, and activity spread across branches or institutions. Banks may also consider whether cash deposits are quickly transferred elsewhere, converted into other instruments or used in ways inconsistent with the stated purpose of an account.

These indicators are not proof of criminal conduct. Legitimate customers can have unusual transaction patterns, particularly cash-based businesses and people dealing with major life events. Financial institutions are expected to investigate context, document their decisions and, where appropriate, seek information from customers rather than rely solely on automated alerts.

Modern forms of fragmentation

The underlying tactic has adapted as payment choices have expanded. Prepaid cards can be loaded with cash and used to move value, although issuers may impose identification, loading and monitoring controls. Money orders remain relevant because they can convert cash into a more portable payment instrument. Repeated purchases by related people or at multiple locations can draw scrutiny.

Crypto ATMs, also called virtual-currency kiosks, can allow customers to exchange cash for cryptoassets. Regulated operators may collect identity information, apply transaction limits and monitor activity, but criminals may still try to fragment purchases or use third parties. Payment apps present a different issue: while they are often funded from bank accounts rather than cash, investigators can examine linked accounts, rapid transfers, shared devices and networks of recipients for signs of coordinated movement of funds.

A practical compliance point

Customers with a legitimate need to conduct a large cash transaction should not try to manage the amount around a reporting threshold. They should expect questions, keep records showing the source and purpose of funds, and provide accurate information when requested. Businesses should train staff to escalate suspicious patterns rather than advise customers how to avoid reporting.

This explainer describes general concepts, with US reporting rules specifically identified where relevant. It is not legal advice. Anyone facing a bank inquiry, account restriction, civil forfeiture issue or potential criminal exposure should seek advice from a qualified lawyer in the relevant jurisdiction.