NewsAML Internal Controls for Cash: 2026 BSA Compliance Guide
AML internal controls for cash go beyond CTR filings. The 2026 BSA framework shows where monitoring, training, testing, and AI...
Cash structuring red flags are behavioral and transactional signals that may indicate someone is arranging cash activity to evade Bank Secrecy Act reporting or recordkeeping requirements. Structuring can involve one or more transactions, in any amount, at one or more financial institutions, on one or more days when the purpose is to avoid an applicable reporting requirement. It is prohibited under 31 U.S.C. § 5324. FinCEN clarified in October 2025 that transactions merely occurring at or near the $10,000 Currency Transaction Report threshold are not enough by themselves to establish reportable structuring. Context and apparent intent matter.
This guide explains the most important cash structuring red flags, how structuring differs from ordinary cash activity, how CTR, SAR, and Form 8300 rules differ, and what banks and cash-handling businesses should do when suspicious patterns appear. The reporting obligation depends on the type of organization involved: banks and other covered financial institutions operate under applicable BSA reporting rules, while ordinary trades and businesses generally use Form 8300 for qualifying cash receipts.
Understanding Cash Structuring Under BSA & FinCEN Rules
The Legal Definition and the $10,000 Reporting Threshold
Structuring is broader than simply dividing one large cash deposit into smaller amounts. FinCEN defines it to include a person acting alone, with others, or on behalf of others conducting or attempting one or more currency transactions, in any amount, at one or more financial institutions, on one or more days, for the purpose of evading a reporting requirement. A transaction or series of transactions does not have to exceed $10,000 at one institution on one day to constitute structuring.
For banks, qualifying currency transactions by or on behalf of the same person must generally be aggregated when they result in more than $10,000 in cash-in or cash-out during one business day. That is the CTR rule. Transactions on different business days are not combined into one CTR merely because their combined value exceeds $10,000, although a multi-day pattern may still indicate structuring if it appears designed to evade reporting.
Form 8300 follows a different framework. A trade or business generally must file Form 8300 when it receives more than $10,000 in cash in one transaction or related transactions. Transactions within 24 hours are treated as related, and transactions more than 24 hours apart can also be related when the business knows or has reason to know they form part of a connected series.
Spotting a suspicious cash pattern is only the first step. The Anti-Money Laundering (AML) and Fraud Prevention course develops practical skills in transaction monitoring, suspicious-activity escalation, fraud detection, and BSA/AML controls for professionals handling financial-crime risk.
Structuring vs. Smurfing: What Is the Difference?
Structuring is the broader concept: transactions are arranged to evade a reporting or recordkeeping requirement. It can involve one person or multiple people, one branch or several branches, and activity occurring on the same day or across multiple days.
Smurfing is an informal term commonly used for a structuring technique in which multiple people conduct smaller transactions on behalf of an organizer. The participants may use different branches, accounts, or financial institutions to make the overall activity harder to identify.
For compliance teams, the distinction is operational rather than legal. A single teller may notice one customer's repeated transaction changes, while a coordinated pattern involving several people may only become visible when transaction monitoring connects activity across accounts or locations. FinCEN's structuring definition expressly covers people acting alone, together, or on behalf of others.
Curious about broader cash-handling risks beyond structuring itself? Our guide on cash business red flags walks through the operational warning signs every cash-intensive business should track.
Cash Structuring Red Flags Are Indicators, Not Proof
A red flag does not establish that structuring occurred. Legitimate customers can make transactions near the $10,000 threshold, ask questions about reporting requirements, or conduct several cash transactions for valid business reasons.
FinCEN clarified in October 2025 that activity at or near the CTR threshold alone is not sufficient to require a SAR. The institution must know, suspect, or have reason to suspect that the activity is designed to evade BSA requirements or otherwise satisfies the applicable SAR criteria. Compliance teams should therefore evaluate the pattern, customer profile, explanation, timing, and surrounding facts rather than relying on the dollar amount alone.
7 Critical Cash Structuring Red Flags Every Practitioner Should Know
These seven cash structuring red flags split into two groups: what a teller sees at the counter and what a compliance team sees in the transaction data.
Front-Line & Behavioral Red Flags at the Counter
1. Explicit Inquiries About Reporting Limits. A customer repeatedly asks how CTR thresholds work, what amount triggers reporting, or how transactions can be conducted without generating a report. The question alone is not proof of structuring, but it becomes more significant when followed by transaction changes or repeated activity designed around reporting thresholds.
2. Transaction Alteration or Cancellation. A customer lowers a deposit on the spot — for example, from $10,500 to $9,800 — right after learning that ID or CTR paperwork is required. Some customers cancel the transaction entirely at that moment.
3. Branch Hopping and Multi-Teller Visits. The same customer visits several branches of one bank or switches tellers within the same branch on the same day, to make separate deposits that each stay under $10,000.
Transactional & Pattern-Based Red Flags
4. Repeated "Just-Below" Deposits. A customer makes a steady sequence of deposits in the $8,000–$9,900 range with no commercial explanation for the pattern.
5. Rapid Consolidation Across Linked Accounts. Small cash amounts land in several personal or subsidiary accounts, then get wired or transferred quickly into one central account.
6. Incongruous Cash Activity. The volume of cash conflicts with the customer's known profile or industry baseline; a software consulting firm depositing $9,000 in physical cash every week is a clear mismatch.
7. Monetary Instrument Purchases Designed Around Recordkeeping Thresholds. Cash purchases of cashier's checks, bank drafts, money orders, and traveler's checks between $3,000 and $10,000 inclusive can trigger BSA identification and recordkeeping requirements. Multiple qualifying purchases on the same business day may need to be treated as one purchase when the institution knows they occurred. Sequential purchases below applicable thresholds can therefore become a structuring indicator when the pattern suggests an attempt to evade those requirements.
Recognizing these AML transaction monitoring red flags is only the first step. Knowing how to document them, escalate them, and decide when a SAR is warranted takes structured training, not just a checklist taped to a teller window.
CTR vs. SAR vs. Form 8300: Who Files What?
Structuring can appear similar across banks and ordinary businesses, but the reporting obligations are not interchangeable.
Banks generally file CTRs when qualifying cash-in or cash-out by or on behalf of the same person exceeds $10,000 during one business day. Banks may also have a SAR obligation when suspicious activity meets the applicable regulatory criteria.
A nonfinancial trade or business generally files Form 8300 when it receives more than $10,000 in cash in a single transaction or related transactions. The IRS also permits businesses to voluntarily file Form 8300 for suspicious transactions of $10,000 or less by marking the suspicious-transaction box.
This distinction matters because an ordinary retailer, dealership, or service business does not automatically become subject to the bank SAR rule simply because it handles large amounts of cash.
Identifying Related and Split Transactions
For Form 8300 purposes, transactions between the same payer or the payer's agent and the business within a 24-hour period are treated as related. Transactions more than 24 hours apart are also related when the business knows or has reason to know they are part of a connected series.
For example, if the same customer makes three related $4,000 cash payments within 24 hours, the business has received $12,000 in related cash transactions and generally must file Form 8300.
What to Do When Cash Structuring Red Flags Are Identified
Step-by-Step Internal Escalation for Financial Institutions
Document the observed facts. Record relevant transaction details, timing, customer statements, transaction changes, account history, and other information needed for review.
Escalate under the institution's procedures. Front-line employees should refer potential structuring activity to the designated AML/BSA or compliance function rather than deciding independently that a crime occurred.
Review the broader context. Compare the activity with the customer's known profile, historical transactions, expected cash activity, and available explanation.
Determine whether the applicable SAR criteria are met. Do not use “reasonable cause” as the standard. For banks, a suspicious transaction generally becomes reportable under 31 CFR § 1020.320 when it involves or aggregates at least $5,000 in funds or other assets and the bank knows, suspects, or has reason to suspect that it is designed to evade BSA requirements or otherwise meets one of the rule's suspicious-activity criteria.
What Should an Ordinary Trade or Business Do?
Ordinary businesses that are not themselves subject to a SAR rule should focus on their applicable Form 8300 obligations, accurate documentation, and internal escalation of unusual transactions. A business may voluntarily file a suspicious Form 8300 even when the amount is $10,000 or less.
Filing a Suspicious Activity Report and Protecting SAR Confidentiality
For banks, a transaction or pattern generally becomes reportable under the FinCEN SAR rule when it involves or aggregates at least $5,000 in funds or other assets and the bank knows, suspects, or has reason to suspect that the activity involves illegal funds, is designed to evade BSA requirements, lacks an apparent lawful purpose, or otherwise satisfies the regulation. Other types of covered financial institutions can have different SAR thresholds, so institutions should apply the rule that governs their specific category.
A bank generally must file an SAR no later than 30 calendar days after initially detecting facts that may constitute a basis for filing. If no suspect has been identified, an additional 30 days may be used to identify one, but filing generally cannot be delayed beyond 60 days from initial detection of the reportable activity. The appearance of an automated alert does not by itself mean that a reportable SAR has necessarily been detected; the institution must review the relevant facts.
SARs and information that would reveal the existence of a SAR are confidential. Banks and their directors, officers, employees, and agents generally may not tell a customer that an SAR was filed or reveal information that would disclose its existence, except as authorized by law.
FinCEN and the federal banking agencies clarified this point again on September 2, 2026. SAR confidentiality does not prevent a bank from discussing potentially fraudulent or suspicious transactions, conducting an investigation, requesting information, or explaining an account closure to a customer, provided the bank does not reveal the existence or filing of an SAR.
FinCEN also clarified in October 2025 that institutions are not required to conduct a separate continuing-activity review simply because a SAR was previously filed, and the BSA does not require institutions to document every decision not to file a SAR. Institutions may still adopt risk-based internal procedures that go beyond these minimum requirements.
Consequences of Weak Structuring Controls
Weak structuring controls can result in supervisory findings, remediation requirements, and increased regulatory scrutiny. Depending on the circumstances, seriousness, and applicable legal requirements, failures to detect or report suspicious activity can also contribute to civil enforcement or other penalties.
Regulators generally expect covered financial institutions to maintain risk-based systems, procedures, and training capable of identifying and escalating suspicious patterns. The appropriate response depends on the institution's risk profile rather than on a single universal monitoring rule.
Strengthening Your Proactive Structuring Defense
Cash structuring red flags extend well beyond what automated monitoring software catches on its own. Trained front-line observation, contextual profile analysis, and prompt escalation catch what a rules engine alone will miss.
Active BSA monitoring, appropriate SAR procedures, and ongoing staff training help reduce the risk of missed structuring activity, supervisory findings, and potential enforcement consequences.
