A cash alert shows deposits just under $10,000, and the analyst's first decision is whether one customer made them or a ring did. The answer sets the grouping key the next rule needs and what the SAR has to show.
Structuring is splitting or spreading cash so that no single part reaches a reporting line. Smurfing is the name for doing it through several people, the smurfs, who each carry part of the cash for one organizer.
Both are placement methods, used when criminal cash first goes into a bank.
How do smurfing and structuring differ?
Table 1. Structuring vs smurfing at a glance (US law, October 2026)
| Structuring by one customer | Smurfing (structuring by a ring) | |
|---|---|---|
| Who acts | One person splitting their own cash | Several depositors working for one organizer |
| Who the smurf is | Nobody; the customer is the structurer | Each depositor, one of the "other persons" in the US definition |
| US offense | 31 U.S.C. 5324 | The same section; no separate smurfing offense |
| What the CTR count sees | One customer's cash, summed per business day | Each depositor's cash on its own, every amount under the line |
| Grouping key | The customer, over days | The receiving account, the payee or a shared detail, across people |
| Where the pattern shows | One account history | Many depositors, accounts and branches in a short window |
Who acts drives the other differences in the table. A single customer typically splits cash over days or branches, so the pattern sits in one account history. A ring splits it over people. Each depositor's history then looks ordinary, and the pattern appears only when deposits are grouped by where the money lands, which is why, for a bank, the difference between smurfing and structuring comes down to a grouping key.
Who counts as a smurf?
A smurf is any depositor who carries part of the organizer's cash to the counter. US law has no word for the role: its structuring definition covers a person acting with or for "other persons", and each smurf is one of them.
Two other terms get mixed up with it. A money mule moves criminal money through an account of their own, knowingly or not. In cuckoo smurfing the cash lands in the account of an honest customer who is waiting for a transfer from abroad and has no idea where the cash came from.
Is smurfing a separate crime from structuring in the US?
No. US law has one offense, and the ring sits inside its definition. Under 31 CFR 1010.100(xx), a person who conducts cash transactions to evade the report structures them whether "acting alone" or acting "in conjunction with, or on behalf of, other persons". The same paragraph adds that the split counts even when no single bank, on no single day, takes in more than $10,000.
The statute, 31 U.S.C. 5324, forbids anyone in (a)(3) to "structure or assist in structuring" a transaction with a domestic financial institution, so the organizer who plans the split and each depositor who shares its purpose answer under one section. Subsection (d) allows up to 5 years in prison, and up to 10 years with a doubled fine when the offense comes with another federal violation or is part of a pattern of illegal activity over $100,000 within a 12 month period.
A West Virginia case shows two depositors charged under it. Merrick Rice and Miranda Aliff "both pleaded guilty on May 7, 2024, to structuring transactions with one or more domestic financial institutions", admitting deposits of drug proceeds totaling $228,000 to evade currency transaction reports. The proceeds went into accounts that a third person, Jack Paskin, "individually controlled or had signatory authority over", and Paskin withdrew $30,000 in cash from one of them on 24 February 2021, according to the US Attorney's release of 17 September 2025.
On 21 October 2024 Rice received one year and three months in prison and Aliff five years of probation; Paskin, sentenced for money laundering, received nine months on 16 September 2025. The release calls what the two depositors did structuring and never uses the word smurfing. Section 5324 asks only for the purpose of evading the report and says nothing about where the cash came from.
How do smurfing and structuring show up in transaction data?
The same $36,000 leaves two different traces. Picture both versions at one bank (figures illustrative).
- One customer, five business days. A customer pays in $7,200 in cash on each day from Monday to Friday, at two branches. No day passes $10,000, so no currency transaction report is filed. Grouped by customer over the week, the account shows $36,000 in five even deposits.
- Four depositors, one afternoon. Four people pay $9,000 each into four different accounts at two branches between 2 pm and 4 pm. The next morning all four account holders send the money to one company. Each depositor and each account stays under $10,000, and grouped by customer nothing stands out: four people, one deposit each.
Two sections of the regulation decide what the bank sees. 31 CFR 1010.311 asks for a report on cash of more than $10,000. Section 1010.313 says what is added up first. It treats every domestic branch as part of one institution, and it merges several cash transactions into one only where the bank knows them to be "by or on behalf of any person" and their sum passes $10,000 within one business day.
The one customer week stays under that count on every day. The ring stays under it four times over, once per depositor, until something links them.
Why is smurfing harder to detect than structuring?
The CTR count works per known person. A structurer working alone is still one customer, so a rule that sums one customer's cash over a rolling week finds the $36,000 without help. In the ring no customer holds the pattern, and no account does either, since each of the four took a single deposit. What joins them is the company all four account holders paid the next morning, or a phone, address or device the depositors share.
Which rules and alerts catch each one?
Table 2. Grouping keys for structuring and smurfing rules (thresholds set per product, none given here)
| Grouping key | What it catches | Pattern | Data needed | What it misses |
|---|---|---|---|---|
| Customer | One person splitting cash | Repeated cash under a line over days or branches | Customer ID on every cash transaction | Any ring, since each smurf looks ordinary |
| Receiving account (distinct depositors) | Several people paying into one account | Many depositors, few accounts | Depositor identity on third party deposits | A ring that gives each depositor their own account |
| Beneficiary or payee | Accounts that empty into one place | Many senders, one payee within days | Outgoing payment counterparties | A ring that pays out to many payees |
| Conductor across accounts | One person spreading cash over other people's accounts | One depositor, many receiving accounts | Conductor identity at the counter | A conductor who sends others instead |
| Shared phone, address, device or ID document | Depositors who look unrelated | Unrelated customers sharing a detail | Onboarding and device data | A ring whose members share no detail |
The first row is the usual structuring rule. Customer level structuring rules sum one person's cash over a window, with thresholds set per product and segment. A ring needs at least one of the other four rows, because its members never share a customer number.
Money transmitters see the same split in transfers. An indictment returned on 20 August 2026 and announced by the US Attorney in Minnesota on 25 August 2026 alleges that an employee of a Minnesota money transmitter broke cartel drug proceeds into transfers "always right below $1,000", the firm's own threshold for collecting and verifying a customer's ID. The employee allegedly used "fake names" as senders and paid "straw beneficiaries" in Mexico, and the charge is a conspiracy to launder at least $750,000 between February 2023 and February 2026. These are allegations, not findings.
A sender key can miss that pattern, because the senders were made up. The transfers still share the straw beneficiaries, an amount band just under the firm's ID line and the employee who processed them.
complead, formerly Sanction Scanner, offers transaction monitoring software whose rules engine builds detection rules from conditions, thresholds and score effects without code. A team writes the conditions of each structuring rule itself and backtests the rule on a 30, 60 or 90 day window of real history before switching it on. Each alert names the rule that fired, and the analyst decides what the pattern is.
How do Canada, Australia and the EU treat split cash by several depositors?
Table 3. Split cash by several depositors in five rulebooks (read 30 October 2026)
| Jurisdiction | Report and line | Window and grouping | Several depositors | Source |
|---|---|---|---|---|
| United States | CTR on cash over $10,000; at MSBs in eight border counties, cash of $1,000 to $10,000 until 1 March 2027 | One business day, by or on behalf of one known person | Inside the structuring definition ("other persons") | 31 CFR 1010.311 and 1010.313; FinCEN order, 91 FR 56776 |
| Canada | Large cash transaction report on $10,000 or more, filed within 15 calendar days | One 24 hour window, grouped by conductor, by third party or by beneficiary | Cash for one beneficiary is added up, whoever brings it, when the firm knows | FINTRAC 24 hour rule; large cash guidance |
| Australia | Threshold transaction report on physical currency of $10,000 or more, within 10 business days (s.43) | No fixed window; s.142(3) weighs each value, the total, the period, the intervals and the locations | The offense reaches whoever "causes another person to become, a party to" the split transactions (s.142(1)(a)) | AML/CTF Act 2006 (Cth), compilation 63 |
| European Union, from 10 July 2027 | Traders and service providers may take or make cash payments only up to EUR 10,000, "in a single operation or in several operations which appear to be linked" (Art 80(1)) | Linked when origin, destination and purpose are identical or similar, or other relevant characteristics match, over a specific period (Art 2(1)(20)) | Payments or deposits at banks, electronic money issuers and payment service providers fall outside the cap, but those above it are reported to the FIU (Art 80(4)(b)) | Regulation (EU) 2024/1624 |
| United Kingdom | No cash transaction report in the regulations | Due diligence thresholds count "several operations which appear to be linked" | Proceeds of crime offenses | Money Laundering Regulations 2017, reg 27 |
FINTRAC's 24 hour rule puts the ring into the count. It adds up cash received in one window when the firm knows it was brought by the same person, for the same third party or for the same beneficiary, so four depositors paying one account holder make one report. The same rule covers large virtual currency transactions and international funds transfers.
In Australia the ring sits in the offense itself. Section 142 applies to a person who is, or "causes another person to become, a party to" two or more transactions that each stay under the line, where it is reasonable to conclude that avoiding a threshold report was the sole or dominant purpose. The defendant must prove another purpose (s.142(2)), and the maximum is 5 years in prison, 300 penalty units, or both.
The EU definition of linked transactions does not need one payer. Besides an identical or similar origin, destination and purpose, it accepts "other relevant characteristics, over a specific period", which leaves room for cash from several payers to one trader.
What changed for split cash in 2026?
- 31 March 2026. In the Australian Act compiled from that day, section 142 reads "virtual asset" where it had read "digital currency".
- 25 August 2026. The Minnesota indictment, alleging transfers split under a $1,000 ID line, was announced.
- 3 September 2026. A FinCEN geographic targeting order took effect for MSBs in zip codes of five Texas and three New Mexico counties: cash of "$1,000 or more, but not more than $10,000" is reported until 1 March 2027; Texas MSBs under a court injunction are exempt. FinCEN encourages MSBs to file SARs voluntarily where cash is split to stay under the $1,000 line.
- Next, 10 July 2027. The EU cash cap and its linked operations test apply (Article 90).
What should a SAR narrative show for each?
FinCEN's SAR FAQs of 9 October 2025 frame the near threshold question per person: transactions by or for the same person "at or near the $10,000 CTR threshold" are, on their own, not enough to require a SAR. A filing turns on knowing, suspecting or having reason to suspect evasion, so when you file a SAR the narrative has to show why.
For one customer:
- Dates and amounts. Each deposit with its branch, so the split over days shows without the alert.
- The stated reason. What the customer said about the cash, because purpose is what the offense turns on.
For a ring:
- Each depositor. Name, ID and each deposit, since no one person's cash crossed the line.
- Each receiving account. Which depositor paid into which account, and who holds it, since the holder is often not the depositor.
- The common payee. Where the money went next, with dates; in the four depositor example it was the only point they shared.
- The link. The shared detail or the timing that ties the depositors.
A SAR does not replace the cash report. One person's cash above $10,000 in a business day still goes on a CTR.
One decision is left for the rule owner: what the structuring rule groups by. A customer key catches the person who splits alone, a receiving account or payee key catches the ring, and running both means two alert queues to tune. Choose per product which keys run and at which line, for cash at the counter and for transfers, and write the choice into the rule's own record for the next examiner.
Sources and review. Sinan Tekin read these sources on 30 October 2026: 31 CFR 1010.100, 1010.311 and 1010.313, 31 U.S.C. 5324, FinCEN's SAR FAQs of 9 October 2025, the geographic targeting order at 91 FR 56776, FINTRAC's 24 hour rule and large cash guidance, compilations 59, 60 and 63 of the AML/CTF Act 2006 (Cth), Regulation (EU) 2024/1624, regulation 27 of the UK Money Laundering Regulations 2017 and the two Justice Department releases. Fact checked by Ufuk Gürdaş, Compliance Specialist; reviewed on the publish date.
