August 17, 2026

Structuring and Smurfing: Detection Patterns That Still Work

Axle Team

Key takeaways

Structuring turns on purpose, not amount. The regulatory definition covers transactions "in any amount" conducted to evade CTR filing — there is no de minimis floor.
Smurfing is structuring with division of labor: multiple runners, accounts, or branches feeding one beneficiary. Detection is a linking problem, not a threshold problem.
The patterns that keep working: sub-threshold amount bands, rolling multi-day aggregation, funnel-account linking, and behavior shifts after a CTR conversation.
Hard-coded rules just under $10,000 train structurers to migrate down-band. Watch each customer's cash amount distribution, not just rule hits.
Suspected structuring around the CTR threshold remains among the activities most frequently described in SAR narratives, per Thomson Reuters' review of 2024 filing data.

Structuring is the oldest evasion play in the BSA rulebook, and it still fills SAR queues — Thomson Reuters' review of FinCEN's 2024 filing data lists suspected structuring around the $10,000 CTR threshold among the activities most frequently described in SAR narratives. The detection playbook has aged better than most, but only the parts built on behavior rather than a single magic number.

Structuring and smurfing detection works by flagging cash activity held at or below the $10,000 CTR threshold, aggregating transactions across days, branches, and channels, and linking multiple depositors to a common beneficiary account. Because the legal element is purpose — evading the report — patterns of behavior matter more than any single amount.

Structuring and smurfing detection starts with the definition

"…a person structures a transaction if that person, acting alone, or in conjunction with, or on behalf of, other persons, conducts or attempts to conduct one or more transactions in currency, in any amount, at one or more financial institutions, on one or more days, in any manner, for the purpose of evading the reporting requirements…"
— 31 C.F.R. § 1010.100(xx)

Three phrases do the work. "In any amount": there is no floor, and a customer keeping deposits at $6,000 is structuring if the purpose is evasion. "One or more days, at one or more financial institutions": aggregation is baked into the definition, so single-day, single-branch monitoring misses the offense as written. And "in conjunction with, or on behalf of, other persons": smurfing — the multi-runner variant — is not a separate typology. It is the definition's plural case.

The criminal statute reaches just as far:

"No person shall, for the purpose of evading the reporting requirements of section 5313(a) … structure or assist in structuring, or attempt to structure or assist in structuring…"
— 31 U.S.C. § 5324(a)

Attempts and assistance count, and conviction does not require the funds to be dirty. FinCEN's CTR educational pamphlet warns customers that structuring can bring up to five years' imprisonment and fines, with penalties doubled where the structuring involves more than $100,000 in a twelve-month period or occurs alongside another federal violation.

Six detection patterns that still work

The FFIEC exam manual keeps a dedicated structuring appendix (Appendix G) for a reason: examiners test for it every cycle. These are the patterns worth the tuning effort.

Sub-threshold banding: repeated cash-in between roughly $7,000 and $9,999, often round amounts. Needs a cash transaction feed with amounts, timestamps, and conductor ID.
Rolling multi-day aggregation: sub-threshold deposits summing past $10,000 over 3–7 rolling days. Needs per-customer rolling windows, not calendar-day cuts.
Multi-branch, multi-channel same-day activity: teller, ATM, and night-drop deposits split across locations. Needs branch and channel identifiers on every cash record.
Funnel (smurf) networks: many dispersed depositors into one account, then rapid consolidation or withdrawal. Needs a counterparty graph linking conductors to beneficiaries.
Post-CTR-conversation shifts: a customer withdraws, reduces, or splits a transaction after hearing about CTR filing. Needs teller notes and declined-transaction logs as structured data.
Micro-structuring on digital rails: P2P and ACH transfers split under program limits across linked wallets. Needs customer-level aggregation across rails, not account-level.

Pattern five deserves more respect than it gets. A CTR-education event — a teller explains the filing, the customer changes behavior — is close to direct evidence of purpose, the element everything else only infers. If those conversations live in free-text teller notes, get them into structured form; they are among the strongest features you can feed a monitoring model.

Tuning without teaching the structurers

The trade-off a generic article won't tell you: every well-tuned band rule trains its own evasion. Deploy a $9,000–$9,999 rule that works, and within a couple of quarters the same actors show up at $7,500 across more accounts and more locations. The signal of successful detection is not rising alert counts — it is a downward drift in a customer's cash-in amount distribution paired with a spreading location footprint. Review per-customer deposit distributions quarterly as their own detection surface, and treat drift-plus-spread as reportable behavior even when no single rule fires.

From alert to SAR

Aggregate before you judge. Pull the full relation set — conductor, account, beneficiary — across at least 90 days before concluding the activity is isolated.
Write the narrative around purpose. Table the transactions — dates, amounts, locations, channels — and state plainly why the pattern indicates intent to evade the CTR requirement rather than coincidence.
Set the review-forward date when you file. Structuring rarely stops after one SAR; calendar the continuing-activity review at filing time, not when an alert happens to re-fire.

If continuing-activity reviews are eating your team's week, that follow-on workflow is what Sam, Axle's SAR agent, is built to carry — drafting the narrative and keeping the review calendar honest.

FAQ

Is structuring illegal if the money is legitimate?

Yes. The offense is evading the reporting requirement, not laundering. Clean funds structured to avoid a CTR still violate 31 U.S.C. § 5324, and FinCEN's pamphlet is explicit that penalties apply regardless of where the money came from.

What is the difference between structuring and smurfing?

Smurfing is structuring executed through multiple people or accounts — runners making sub-threshold deposits that consolidate to one beneficiary. The regulation draws no distinction: the 31 C.F.R. § 1010.100(xx) definition covers persons acting "in conjunction with, or on behalf of, other persons."

What dollar amount triggers a structuring alert?

None specifically. The definition applies "in any amount" when the purpose is evading the CTR. In practice, programs monitor bands under $10,000 plus rolling aggregation — but a fixed threshold on its own is the weakest version of structuring and smurfing detection.

Rose, Axle's transaction monitoring agent, works structuring alerts the way a strong analyst does — pulling the full aggregation picture, linking conductors to beneficiaries, and drafting the disposition with the evidence attached. See how it handles structuring and smurfing detection at axleruns.com/agent/rose, or estimate the hours it returns with the ROI calculator.

Structuring and Smurfing: Detection Patterns That Still Work

More from the blog