Chapter 1 of 4 · 4 min

How to detect structuring and account-integrity red flags in transaction monitoring

Learn how structuring detection rules work and why PII changes before a large payment signal account takeover or layering in AML monitoring.

TL;DW

Structuring exploits reporting thresholds by splitting transactions into amounts just below the regulatory limit. A well-calibrated rule searches for multiple transactions in a narrow band below your jurisdiction's threshold within a defined lookback window. PII changes before a large outbound payment present two distinct risks: account takeover by a third party and layering by the account holder.

Watch: 10 AML Rules that Every Transaction Monitoring Team Should Consider

▶ Watch this chapter on YouTube from 0:00

Lesson · 3 parts

Automated transaction monitoring is not one-size-fits-all. Risk exposure depends on your institution's business model, the geographies it operates in, the products it offers, and the customers it serves. Despite this variation, a core set of rules addresses money laundering schemes that appear repeatedly across regulated institutions. Regulators expect documented evidence that those baseline rules exist, are calibrated to the firm's risk profile, and are actively maintained. This chapter introduces why that foundation matters and examines the first two detection patterns every program should deploy.

Structuring is the deliberate splitting of a larger sum into multiple transactions, each designed to stay just below a regulatory reporting threshold. To detect it, your rule must aggregate transactions within a specific value band over a defined lookback window. The band should be set just below your jurisdiction's reporting threshold, not across all sub-threshold amounts, to reduce noise and target true threshold-avoidance behavior. Without that precision, ordinary low-value transactions generate alert volume that overwhelms investigators and dilutes the quality of every review queue.

When an account holder updates personally identifiable information shortly before making a significant outbound payment, the timing creates a detectable pattern. This rule should fire whenever a PII modification and a large payment occur within a defined window. The alert requires investigator judgment because two very different risk scenarios can produce the same signal, and distinguishing them requires reviewing the full account context: the beneficiary, the account's prior transaction history, and whether the account holder can confirm both the update and the payment.

Study notes

Part 1 of 3 · 0:00 to 2:08

Why every monitoring program needs a rules foundation

Concept Transaction monitoring rules convert regulatory obligations into machine-executable detection logic. A rule defines a pattern, sets parameters, and triggers an alert when those conditions are met in your transaction data. Without rules, you have data but no detection. The ten rules in this course represent patterns that regulators and financial intelligence units have identified as recurring across money laundering typologies worldwide.

Why it matters Every institution's risk profile is unique, but money launderers are opportunistic and methodical. The same core techniques appear across banks, payment firms, exchanges, and marketplaces. A baseline ruleset does not replace firm-specific tuning; it ensures that the most common schemes do not slip through while your team focuses on more complex detection challenges. Regulators expect this baseline to be present and demonstrably effective.

Pitfall One common design error is treating transaction monitoring as binary: either a firm has automated monitoring or it does not. Having a system with poorly calibrated rules is nearly as risky as having none. Regulators assess not just whether monitoring exists, but whether the rules in use are fit for purpose given the firm's risk profile, transaction volumes, and customer segments. A large stock of low-quality alerts is itself a finding.

Do this

Before moving on, list the top three factors that make your institution's transaction monitoring context unique, such as the geographic footprint, the primary customer type, or the product mix.

Part 2 of 3 · 2:08 to 3:03

Rule 1: Detecting structuring activity

Concept Structuring works because most reporting obligations are triggered by individual transaction amounts, not cumulative totals over a period. A money launderer who knows your jurisdiction's $10,000 threshold can move $90,000 by completing nine $9,900 transactions across different days or accounts. Your detection rule must aggregate over time and look for clusters, not individual events, to surface this pattern reliably.

Example Consider a jurisdiction with a $10,000 Currency Transaction Report threshold. A structuring detection rule would alert when a customer completes three or more transactions between $9,000 and $9,999 within a 60-day window. This targets the characteristic behavior of a launderer deliberately avoiding the reporting limit, not a customer who simply tends to transact below the threshold for legitimate reasons.

Pitfall Structuring rules set with too wide a value band, such as all transactions from $1 to $10,000, produce excessive noise. A narrow band calibrated to your specific threshold and your customer segment's typical transaction distribution is far more effective. Review your rule's parameters against actual alert data to confirm the band and lookback window are identifying genuine anomalies rather than flagging ordinary low-value activity.

Part 3 of 3 · 3:03 to 4:01

Rule 2: PII changes before a large outbound payment

Concept Personally identifiable information is any data that links a transaction to a specific individual: names, addresses, identification numbers, contact details. Criminals who have taken over an account will often update contact details to reroute authentication messages and prevent the real account holder from receiving fraud alerts. This makes the PII-change pattern one of the more reliable early signals of account compromise when combined with a large payment trigger.

Why it matters Two distinct risk categories produce this pattern. In account takeover, a criminal who gained access updates PII to maintain control before moving funds. In a layering scenario, the legitimate account holder modifies PII to complicate audit trails or misdirect investigation. The investigation must determine which applies, which usually requires reviewing the account's full transaction history, the nature of the beneficiary, and whether the account holder can confirm the changes.

Try it Review your institution's definition of 'shortly before' for PII-change alerts. If it is not precisely defined in your rule parameters, two investigators may interpret the same alert differently. Set a concrete time window, such as 48 to 72 hours, and document the rationale so that calibration decisions are consistent across your team and defensible in a supervisory review.

Do this

Review your jurisdiction's reporting threshold and set a structuring band of roughly 90 to 99 percent of that amount.
For Rule 2, define 'shortly before' precisely: a 24 to 72-hour window typically reduces false positives without eliminating true signals.

Key terms

Structuring: The deliberate splitting of transactions into amounts below a reporting threshold to avoid a regulatory filing obligation, also called smurfing.
Reporting threshold: The transaction amount above which a financial institution must file a regulatory report, such as a Currency Transaction Report in the US at $10,000.
PII (Personally Identifiable Information): Data that can identify a specific individual, such as name, address, date of birth, or national identification number.
Layering: The second stage of money laundering, in which the origin of funds is obscured by moving money through multiple accounts, transactions, or jurisdictions.

Key takeaways

Structuring rules should target a transaction value band just below your reporting threshold, not all sub-threshold amounts.
PII changes immediately before a large payment are a dual signal: they can indicate account takeover or ongoing layering.
Every regulated entity must calibrate baseline rules to its own business model, geography, and customer base.

Watch out

Setting the structuring detection window too short, such as a single day, will miss the typical pattern, which often spans several weeks.
Legitimate PII changes generate false positives. Consider adding a minimum payment size and a precise time-gap parameter before the alert fires.

Check your understanding

What are the two key parameters that define an effective structuring detection rule?

The value band below the reporting threshold, set to capture transactions suspiciously close to but just under the limit, and the lookback window over which multiple such transactions are aggregated. Together they identify the repeated pattern that characterizes deliberate structuring, as opposed to a customer who simply prefers smaller transactions for legitimate reasons.

A customer updates their home address and, two days later, initiates a $45,000 overseas transfer. What are the two risk scenarios an investigator should consider?

First, account takeover: a criminal who obtained account access changed the address to redirect authentication alerts before moving funds. Second, layering by the legitimate account holder: the PII change was made to obscure the audit trail for an ongoing laundering scheme. The investigation should examine the account's full transaction history, the beneficiary of the transfer, and whether the account holder can be contacted to confirm both the address change and the payment.

How to detect structuring and account-integrity red flags in transaction monitoring

01 0:00 Concept Why every monitoring program needs a rules foundation ▾

02 2:08 Concept Rule 1: Detecting structuring activity ▾

03 3:03 Concept Rule 2: PII changes before a large outbound payment ▾