A two-step test for smurfing on an illustrative year of cash deposits: the excess in the band under the threshold, then a binomial test per customer.
Structuring shows up as a bulge just under the threshold: compare the number of cash deposits in the band below €10,000 with what the smooth decline of the bands beneath it predicts, then test each customer's share of deposits in that band against the same expectation. On an illustrative year of data the €9,000 to €9,999 band holds 2,900 deposits against 1,638.4 expected, an excess of 1,261.6, and a customer with 9 of 14 deposits in that band has about a 3 in a million chance of doing it innocently.
Worked in full in The EU AML Handbook by Julian R. Sterling, with every figure reproduced in a free workbook.See the book on Amazon →
Structuring, or smurfing, is splitting cash so that no single deposit reaches a threshold that triggers checks or reporting. The book's threshold is the €10,000 one for occasional transactions; the method works the same for any internal line. A monitoring team needs two answers. Is structuring happening across the book? And if so, which customers are doing it? The first is a test on the distribution of all deposits; the second is a test on each customer's own deposits. Rules that skip the first step tend to set the second one by feel.
| Band, euro | Deposits | Ratio to band below |
|---|---|---|
| 5,000 to 5,999 | 4,000 | |
| 6,000 to 6,999 | 3,200 | 0.80 |
| 7,000 to 7,999 | 2,560 | 0.80 |
| 8,000 to 8,999 | 2,048 | 0.80 |
| 9,000 to 9,999 | 2,900 | 1.42 |
| 10,000 to 10,999 | 1,100 | |
| Total | 15,808 |
Deposit sizes fall away smoothly: each band holds about 0.80 of the one below. Then the band just under the threshold breaks the pattern and holds more than the band beneath it.
Fit the decline on the clean bands and project it into the band under the threshold.
Decline ratio = (2,048 / 4,000)1/3 = 0.80
Expected 9,000 to 9,999 = 2,048 × 0.80 = 1,638.4
Excess = 2,900 − 1,638.4 = 1,261.6, or 43.5% of the band
z = 1,261.6 / √1,638.4 = 31.2
Excel: =(D6/D3)^(1/3), then =(D7-D6*ratio)/SQRT(D6*ratio)
A z-score of 31.2 is not noise: deposits under the line are 1.77 times what the pattern predicts. The band above confirms it. The pattern predicts 1,310.7 deposits of €10,000 to €10,999; there are 1,100, a deficit of 210.7. Some deposits that would have been just over the line have been moved just under it, and the bulge is bigger than the hole because splitting one deposit creates several.
Under the fitted pattern, without structuring, a deposit between €5,000 and €10,999 falls in the €9,000 band with probability 1,638.4 / 14,757.12 = 11.1 per cent. Observed, the share is 18.3 per cent. Each customer's deposits can be tested against the 11.1: if they were innocent, how likely is it that so many land just under the line?
p-value = P(X ≥ k), X ~ Binomial(n, 0.111)
Customer with 9 of 14 deposits in the band: expected 1.6, p-value 0.0000030
Excel: =1-BINOM.DIST(k-1,n,0.111,TRUE)
| Deposits in the €9,000 band | Share | p-value | Flagged |
|---|---|---|---|
| 2 | 14% | 0.4709 | No |
| 3 | 21% | 0.1976 | No |
| 4 | 29% | 0.0611 | No |
| 5 | 36% | 0.0143 | No |
| 6 | 43% | 0.0025 | No |
| 7 | 50% | 0.0004 | Yes |
| 9 | 64% | 0.000003 | Yes |
The cut-off of 0.001 is a risk appetite choice, not a statistical law. It is set strict because the test runs on every customer: with many thousands of customers, a looser cut-off flags hundreds by chance alone.
The number of deposits in the band that is enough to flag depends on how many deposits the customer makes. A fixed rule of the form "three or more deposits between €9,000 and €9,999" ignores that.
| Deposits in the year | Expected in band | Count that flags | Share that flags |
|---|---|---|---|
| 4 | 0.4 | 4 | 100% |
| 8 | 0.9 | 5 | 62% |
| 14 | 1.6 | 7 | 50% |
| 24 | 2.7 | 9 | 38% |
A busy cash business with 24 deposits can put 38 per cent of them just under the line before the statistics notice; an occasional depositor cannot do it four times out of four. A fixed count of three is the wrong instrument at both ends: a customer with 24 deposits is expected to have 2.7 in the band by chance alone, so the rule fills the queue with cash-intensive businesses, while a customer with 24 deposits and 8 in the band, a real anomaly by count, sits just under the statistical line and needs judgement either way.
Testing against a flat expectation. If the six bands are assumed equally likely, the expected share of the €9,000 band is 16.7 per cent instead of 11.1. Four deposits out of 14 then look ordinary, with a p-value of 0.194, when against the real shape of the data the figure is 0.0611. Deposit sizes are never flat: they fall with size, so a band holding as many deposits as the one below it is already abnormal. Fit the decline first.
The second mistake is to confuse this with aggregation. Linked deposits that together reach €10,000 must be added for due diligence whatever the intent, as worked in when linked transactions trigger the €10,000 threshold. The structuring test looks for intent in the pattern, and its alerts compete for the same analysts as any other scenario, so tune it with the band testing in setting a transaction monitoring threshold. The book's models are in the free companion files.
Fit the decline of deposit sizes, measure the excess under the threshold, then test each customer's count in that band against the fitted probability with a binomial tail. On the worked data the book carries an excess of 1,261.6 deposits, and a customer is flagged at 7 of 14 in the band, not at an arbitrary three.
Deposits clustered just under a threshold, in a share well above what the customer's deposit pattern would produce by chance. On illustrative data the band just under €10,000 should hold 11.1 per cent of deposits between €5,000 and €10,999; a customer with 7 of 14 deposits there has a p-value of 0.0004, below a 0.001 cut-off.
It is a blunt one. The count that is unusual depends on how often the customer deposits: at an 11.1 per cent innocent probability, 4 of 4 deposits in the band is significant but 9 of 24 is the minimum for a busy depositor. A fixed count of three over-alerts on cash-intensive businesses, which expect 2.7 deposits in the band by chance out of 24.
Compare the band under the threshold with the decline of the bands beneath it. If each €1,000 band holds 0.80 of the one below, the €9,000 band should hold 1,638.4 deposits; observing 2,900 is an excess of 1,261.6 with a z-score of 31.2, and the band above showing a deficit of 210.7 confirms deposits have been moved under the line.
This article is one calculation from The EU AML Handbook. The book takes the same case from first principles to the decision, chapter by chapter, and every figure it prints is a live formula in the free companion workbooks.
Get the book on Amazon →Free companion files
Also on Amazon UK · Amazon Germany · Amazon France · Amazon Canada
Reading guide: regulation, compliance and banking → · All 1340 articles →
If this book helped, or didn’t, a few lines on Amazon are worth more than they look: they are what the next reader goes on. Write a review. The workbook stays free either way.