Detect Structuring — Sub-Threshold Deposit Clustering in SQL

Objective

Structuring (a.k.a. smurfing) is breaking a large cash amount into multiple deposits each kept just under the $10,000 Currency Transaction Report threshold. It is one of the most common money-laundering typologies and one of the easiest to catch — if your monitoring can aggregate. This recipe flags it with one query.

Step 1: A transactions table

DROP TABLE IF EXISTS aml_tx;

CREATE TABLE aml_tx (
    id   INT PRIMARY KEY,
    cust TEXT,
    amt  DOUBLE,
    day  INT
);

INSERT INTO aml_tx VALUES
 (1,'C1',9500,1),
 (2,'C1',9400,1),
 (3,'C1',9200,2),
 (4,'C2',500,1),
 (5,'C2',300,2),
 (6,'C1',9600,3);

Step 2: Flag the structuring pattern

Find customers with three or more sub-$10k deposits that sum to over $10k — the tell-tale shape of a threshold-avoiding structuring scheme.

SELECT cust,
       COUNT(*)  AS n_deposits,
       SUM(amt)  AS total
FROM   aml_tx
WHERE  amt < 10000
GROUP  BY cust
HAVING COUNT(*) >= 3
   AND SUM(amt) > 10000
ORDER  BY total DESC;

Result — C1 is flagged (four sub-$10k deposits totaling $37,700); C2's small legitimate deposits are correctly ignored:

Why it matters

The HAVING clause encodes the typology directly: enough sub-threshold deposits, adding up to a reportable sum. It runs in the same database as your transactions — no export to a monitoring engine. Feed a flagged customer's accounts into fund-flow tracing to see where the money went, retrieve the most similar prior SAR narratives, and log the disposition to a tamper-evident ledger.