Every reporting threshold in the financial system is a line drawn by a regulator: cash transactions above ten thousand, structured deposits below it, cash-equivalent purchases under ten. The system's design assumption is that honest people conduct business above the line and nobody has a reason to chop their own money into pieces — which makes structuring the simplest possible response to a control that only watches the amount field. This is how the thresholds actually work across rails, what patterns trip them independent of amount, and why discipline below the line is a rhythm problem, not a subtraction problem.
ROUTE MAP (PLAIN ENGLISH)
A threshold is a number where a report gets written — not where crime occurs, not where an account closes, not where anyone is arrested. Above ten thousand in cash, a currency transaction report records who, what, when; below it, nothing automatic happens — but deliberately breaking one large movement into sub-threshold pieces to evade the report is the separate offense the thresholds were legislated to catch, which means the amount field is no longer the whole story. Behavior around the amount is: same-day multiple deposits under the line at one institution, deposits fanned across branches and accounts in one morning, purchases of cash equivalents just under ten at a single retailer — each pattern reads as evasion to models built precisely for it.
The practical map splits by rail. Cash has hard statutory reporting. Bank rails (ACH, wires, deposits) run threshold reporting plus behavioral models on velocity and aggregation. Cash-equivalent rails (gift cards, money orders) carry their own purchase and deposit thresholds. Every rail's report feeds the same downstream: institutions review, and a structuring pattern on a reviewed account pulls the whole transaction history into scope — the aggregation is what makes the pattern matter, not any single transaction's size.
STEP 1 - THE THRESHOLD MAP
STEP 2 - WHAT TRIPS PATTERNS, NOT AMOUNTS
STEP 3 - RHYTHM DISCIPLINE BELOW THE LINE
STEP 4 - CASH-EQUIVALENT AND INSTRUMENT SEQUENCES
STEP 5 - DOWNSTREAM CONSEQUENCES AND RECORDS
WORKED EXAMPLE - QUARTER OF DEPOSIT RHYTHM
Operating account carrying proceeds that arrived as one larger sum, with the requirement that quarterly deposits stay below the reporting line's attention zone while funding real activity. Approach: no deposit anywhere exceeds $9,600, and no two deposits share a day at the same institution — eight deposits across the quarter, amounts $4,180 / $7,340 / $9,550 / $5,920 / $8,105 / $9,600 / $6,475 / $8,930 — irregular by nature because they are pulled from a ledger with actual variance, not chosen on a calculator. Two deposits exceed the "aggressive sub-threshold" zone entirely: a $14,200 figure lands once, mid-quarter, from genuine-looking commercial activity — the routine report it generates documents exactly what an active account does, and its presence in history proves the account is not shaped around a ceiling. Same-day duplicates: none. Branch fanning: none — one institution, normal hours, no machine-then-branch sequences. Outflow mirrors deposit sums: never — withdrawals follow spending cadence on unrelated schedules. Cash-equivalent purchases: none. Result across the quarter: zero aggregated same-day cash sequences, one routine large-transaction report whose context reads as business, deposit timing distributed across weekdays at plausible hours, and no rhythm an aggregation model would render as evasion — the account's story, read in full at any later date, describes a small business handling its money instead of a person counting to a number.
WORKING SEQUENCE
QUICK ANSWERS
RELATED
A threshold is a number where a report gets written — not where crime occurs, not where an account closes, not where anyone is arrested. Above ten thousand in cash, a currency transaction report records who, what, when; below it, nothing automatic happens — but deliberately breaking one large movement into sub-threshold pieces to evade the report is the separate offense the thresholds were legislated to catch, which means the amount field is no longer the whole story. Behavior around the amount is: same-day multiple deposits under the line at one institution, deposits fanned across branches and accounts in one morning, purchases of cash equivalents just under ten at a single retailer — each pattern reads as evasion to models built precisely for it.
The practical map splits by rail. Cash has hard statutory reporting. Bank rails (ACH, wires, deposits) run threshold reporting plus behavioral models on velocity and aggregation. Cash-equivalent rails (gift cards, money orders) carry their own purchase and deposit thresholds. Every rail's report feeds the same downstream: institutions review, and a structuring pattern on a reviewed account pulls the whole transaction history into scope — the aggregation is what makes the pattern matter, not any single transaction's size.
STEP 1 - THE THRESHOLD MAP
- Cash: currency transactions over $10,000 in one business day (aggregated per person per bank per day) generate a currency transaction report automatically. The evasion definition sits right below it — breaking one intended transaction into sub-$10,000 pieces to avoid the report is structuring regardless of whether the underlying money is clean. Report filing itself is routine and lawful; the pattern of avoiding it is the exposure.
- Bank deposits and withdrawals: below-threshold cash deposits do not report automatically, but deposit aggregation is modeled — cash-heavy deposits repeated at sub-threshold amounts are the canonical structuring signature every BSA model ships with. Account closures for "suspicious activity" happen at deposit volumes far below any statutory line; the institution's risk appetite, not the statute, is usually what ends the account.
- Monetary instruments: cashier's checks, money orders, and similar purchased with cash in aggregate over $3,000 in one day trigger a purchase record — the instrument's own threshold, separate from deposit behavior when the instrument later lands in an account.
- Electronic and trade rails: international wires and cross-border AML thresholds (the EU's €10,000 AMLD line and equivalents) report on their own rails; domestic ACH carries no per-transaction statutory line at all — it runs entirely on institutional risk models, which is why ACH patterns get judged on rhythm rather than on a number.
STEP 2 - WHAT TRIPS PATTERNS, NOT AMOUNTS
- Temporal clustering: multiple sub-threshold transactions inside one day at one institution aggregate in every model — deposit at 9am, deposit at 11am, deposit at 4pm under the line reads as one intended transaction chopped into three. Cadence is the signal: true economic activity scatters, evasion concentrates.
- Branch and channel fanning: splitting deposits across branches, ATMs, and accounts to keep each individual visit small is itself a scored pattern — machines and locations are attributes of every transaction, and fanning across them inside one morning shows a single operator optimizing a number.
- Round-number gravity: deposits of $9,000–$9,500 repeated are a signature as recognizable as a fingerprint — economically real deposits vary in amount (rent is exact, payroll is exact, everything else has cents and irregularity), while evasion amounts hug the ceiling's underside.
- Inflow-outflow mirroring: money that arrives and immediately leaves at matching amounts in cash — deposit then same-day ATM withdrawal near the deposit sum — reads as passing value through the account rather than conducting business in it. Placement patterns like this score regardless of every individual transaction being sub-threshold.
STEP 3 - RHYTHM DISCIPLINE BELOW THE LINE
- Natural amounts: real economic activity produces irregular numbers — a deposit of $8,417.23 reads like commerce; $9,500 reads like a number someone chose. Amount variance across transactions is the cheapest camouflage available because it costs nothing except the discipline of not optimizing for roundness.
- Organic timing: deposits and purchases that land when the account's actual money would arrive — post-payday cycles, seasonal sales patterns, the weekly rhythm of whatever the account's stated activity is — rather than a Monday morning sequence of three sub-threshold visits. Time-of-day and day-of-week distributions are model features.
- Institutional spacing: one institution's view of your activity includes only your activity there — but institutions share information through the downstream review process, and accounts fanned across three banks inside one week pattern the same as one account fanned across three branches. Spacing in time beats spacing in place.
- Let some volume exceed: economically active accounts produce large transactions now and then — a genuine $14,000 deposit from real commerce generates a routine report and no consequence, because the report's existence means nothing without suspicious context around it. An account that never once exceeds the line while moving serious volume is describing evasion in the shape of its history.
STEP 4 - CASH-EQUIVALENT AND INSTRUMENT SEQUENCES
- Purchase-side thresholds: cash purchases of monetary instruments aggregating over $3,000 per day are recorded at the point of sale — the buyer's identity and the instruments' details get logged before any of it reaches a bank. Purchase discipline therefore starts at the retailer: multiple retailers, natural amounts, no same-register fan across ten instruments.
- Deposit-side behavior on instruments: money orders deposited into accounts carry their own pattern surface — serial numbers, purchaser fields, and deposit timing all recorded, and stacks of small money orders landing together pattern as structured placement regardless of each one's face value. Space them, vary them, and never deposit a batch whose serials were bought in one visit.
- Gift-card conversion rails: retail gift cards convert through resale markets rather than bank deposits — the bank threshold map does not apply to the resale leg at all, which is why this rail exists in the flowchart at all: acquisition at retail, conversion at market, proceeds arriving as ordinary peer-to-peer or marketplace inflows with no cash transaction anywhere in the chain.
- The aggregation lens: what looks disciplined per-transaction can be trivially aggregated across a week by any institution holding the account — instrument purchases, deposits, and withdrawals are scored together over rolling windows, which is why the rhythm has to hold across time horizons, not just per visit.
STEP 5 - DOWNSTREAM CONSEQUENCES AND RECORDS
- What a report actually is: a routine internal record at the institution, filed automatically, that by itself changes nothing — nobody is notified, no account action follows. Reports become relevant only when a pattern of them plus behavioral flags triggers a review, and reviews pull history: every transaction the institution has ever seen on the account and often the linked ones.
- Suspicious activity decisions: where institutions file beyond the routine reports, the filing is internal and confidential — account closure often follows quietly, and the reasons given to the customer never match the actual filing. Closure for cause is the real operational risk: the account dies mid-flow and the balances freeze during review.
- Structured-offense exposure: the aggregation pattern, once reviewed, is the exact evidence shape of the statutory offense — the amounts chosen, the timing, the fanning. Where underlying funds have any tainted provenance, the pattern converts a clean-looking history into documented intent to evade.
- Record longevity: these records persist for years and get reused in any later review — an account closed in 2026 for deposit patterns informs how a sibling account's first large wire gets treated in 2028. The rhythm has to be durable because the record is.
WORKED EXAMPLE - QUARTER OF DEPOSIT RHYTHM
Operating account carrying proceeds that arrived as one larger sum, with the requirement that quarterly deposits stay below the reporting line's attention zone while funding real activity. Approach: no deposit anywhere exceeds $9,600, and no two deposits share a day at the same institution — eight deposits across the quarter, amounts $4,180 / $7,340 / $9,550 / $5,920 / $8,105 / $9,600 / $6,475 / $8,930 — irregular by nature because they are pulled from a ledger with actual variance, not chosen on a calculator. Two deposits exceed the "aggressive sub-threshold" zone entirely: a $14,200 figure lands once, mid-quarter, from genuine-looking commercial activity — the routine report it generates documents exactly what an active account does, and its presence in history proves the account is not shaped around a ceiling. Same-day duplicates: none. Branch fanning: none — one institution, normal hours, no machine-then-branch sequences. Outflow mirrors deposit sums: never — withdrawals follow spending cadence on unrelated schedules. Cash-equivalent purchases: none. Result across the quarter: zero aggregated same-day cash sequences, one routine large-transaction report whose context reads as business, deposit timing distributed across weekdays at plausible hours, and no rhythm an aggregation model would render as evasion — the account's story, read in full at any later date, describes a small business handling its money instead of a person counting to a number.
WORKING SEQUENCE
Code:
map rail: cash CTR $10k/day agg + structuring offense below it, instruments $3k/day purchase record, ACH/wires model-only, cash-equivalent resale avoids bank map entirely -> rhythm: irregular natural amounts, organic timing, one institution normal hours, occasional true over-threshold from real commerce, no same-day sub-threshold clusters ever -> instruments: no single-visit batch deposits, serial/timing variance, purchase-side spread across retailers -> account level: outflow never mirrors inflow, no machine+branch fan, cadence matches stated activity -> remember: records persist years, reviews aggregate everything, the shape of history is the evidenceQUICK ANSWERS
- Is depositing under $10,000 illegal? No — sub-threshold deposits are ordinary and unreported by themselves. The offense is breaking one intended transaction into pieces to avoid a required report; the difference between the two lives entirely in pattern — intent read from clustering, round-number gravity, fanning, and timing rather than from any single amount.
- Do banks report deposits under $10,000? Not automatically, no — but everything is recorded, modeled, and aggregated across rolling windows. Sub-threshold cash patterns are the canonical structuring signature every behavioral model detects first, and account action for suspicious activity routinely happens at volumes far below any statutory line.
- Why let a deposit go over the threshold at all? Because an account that moves real volume and never once crosses $10,000 is shaped like evasion, and shape is what gets scored. One routine large transaction with economically true context documents ordinary activity; its presence makes every other deposit read as business instead of avoidance.
- Does splitting across banks help? Each institution only sees its own activity, which looks appealing — but the same operator's accounts fanned across three banks inside one week is the identical pattern with more edges, and downstream information sharing reaches any account that later draws review. Spacing in time is the discipline that holds; spacing in place mostly multiplies the surface.
- What about money orders and cashier's checks? They carry their own threshold — cash purchases aggregating over $3,000 in a day are recorded at the point of sale before anything reaches a bank, and stacks of small instruments deposited together pattern as placement regardless of face value. They move the reporting point, not eliminate it; purchase-side and deposit-side both require the same rhythm discipline.
- How long do these records follow an account? Years — routine reports, instrument purchase records, and any suspicious filings persist through the institution's retention windows and get reused in any later review, including on linked accounts. The deposit rhythm has to be one you could defend reading the entire transaction history back in a review two years from now.
RELATED