Geographically Dispersed Cash Deposit

In this technique, illicit cash is placed into the financial system by distributing multiple deposits across various branches, regions, or institutions to minimize detection risks. Criminals frequently rely on several individuals or “smurfs” to deposit sums below reporting thresholds in distinct locations—both domestically and across borders—thereby complicating efforts to link the funds to a single source. Often, these deposits are carried out in rapid succession and may involve cash couriers or third parties who receive instructions on where and how to deposit the money, sometimes using handwritten slips or similar methods. Once these smaller amounts are successfully introduced into different accounts, funds are swiftly aggregated or transferred elsewhere, further obscuring their origins. Geographically dispersed deposits commonly serve as an early-stage placement step, particularly when combined with other structuring or layering tactics to avoid automated monitoring systems. By exploiting varied AML enforcement standards across multiple jurisdictions and spreading transaction patterns over numerous branches, criminals reduce the likelihood of triggering alerts, making this approach a recurring strategy for concealing illicit proceeds.

[
Code
T0053
]
[
Name
Geographically Dispersed Cash Deposit
]
[
Version
1.0
]
[
Parent Technique
]
[
Tactics
]
[
Risk
Channel Risk, Jurisdictional Risk
]
[
Created
2025-02-13
]
[
Modified
2025-04-02
]

Tactics

ML.TA0006
|
|

Criminals distribute illicit cash deposits in smaller amounts across multiple branches or institutions, introducing proceeds into the financial system while avoiding detection through threshold-based reporting and localized scrutiny. This technique constitutes an early-stage infiltration of illicit funds.

Risks

RS0003
|
Channel Risk
|

Small cash deposits are structured across numerous branches, counters, and ATMs—both domestically and abroad—making it difficult for any single channel to detect or aggregate suspicious patterns. This deliberate dispersal of deposit points exploits gaps in institution-level or channel-specific monitoring thresholds, significantly hampering the timely identification of illicit activity.

RS0004
|
Jurisdictional Risk
|

Criminals distribute and deposit illicit cash across multiple countries or regions with differing AML enforcement standards. By taking advantage of local compliance gaps and inconsistent cross-border tracking, they obscure the aggregate value of their deposits and reduce the likelihood of detection. This technique specifically exploits weak or uneven jurisdictional controls as the primary vulnerability.

Indicators

IND01880
|

Multiple small cash deposits just under reporting thresholds across different branches or regions in patterns consistent with structuring.

IND01890
|

Repeated cash deposit transactions in geographically dispersed locations that do not align with the customer's known residence or business address.

IND01892
|

Multiple individuals deposit similar cash amounts across various financial institutions within a short timeframe, consistent with coordinated smurfing.

IND01894
|

Rapid, sequential cash deposits from distinct geographical areas that collectively form large aggregated sums.

IND01896
|

Deposits made across international borders or in regions with lower regulatory oversight, inconsistent with the customer's normal geographical footprint.

IND01898
|

Pattern of funds consolidation where previously dispersed deposits are later aggregated into a single account or transferred to another financial institution.

IND01900
|

Multiple customer profiles sharing overlapping identification details or linked via common contact information making small cash deposits at geographically dispersed locations.

IND01903
|

Use of designated cash couriers or third-party depositors who submit multiple small deposits at different branches following identical deposit instructions or forms.

Data Sources

  • Highlights jurisdictions with weaker AML/CFT enforcement or higher corruption risk.
  • Enables targeted monitoring of cross-border cash deposits that exploit regional differences in reporting thresholds or oversight.
  • Assists in risk-scoring geographically dispersed deposits and prioritizing investigative resources accordingly.
  • Captures deposit timestamps, amounts, branch or institution identifiers, and account details.
  • Helps detect patterns of structured cash deposits below reporting thresholds across multiple locations to obscure the source of funds.
  • Facilitates monitoring of rapid or sequential deposits by multiple individuals, enabling quick identification of potential smurfing activity.
  • Provides verified customer identities, addresses, and beneficial ownership details.
  • Allows comparison of declared residence or business locations against actual deposit locations to spot inconsistencies.
  • Identifies potential collusion among multiple depositors linked by overlapping personal identifiers or contact information, indicating coordinated smurfing.
  • Contains information on international transaction flows passing through correspondent banking channels, including amounts, sending/receiving institutions, and involved countries.
  • Reveals cross-border deposits and subsequent fund transfers that may hide illicit proceeds.
  • Supports investigations into the rapid movement of aggregated funds across multiple financial institutions abroad.
  • Provides detailed origin and destination metadata for financial transactions, including branch locations or regional identifiers.
  • Facilitates detection of rapid deposits in multiple distant areas, a hallmark of smurfing.
  • Enables geo-mapping of deposit clusters to spot emerging patterns inconsistent with a customer’s normal activity.

Mitigations

Incorporate heightened geographic risk scoring for regions with weaker AML oversight. Require additional monitoring or verification for customers and transactions involving these locations. Adapting deposit controls to jurisdiction-specific risks disrupts criminals seeking to exploit uneven enforcement across multiple geographies.

Apply deeper scrutiny to accounts exhibiting geographically dispersed cash deposits. Verify depositors’ identities, confirm legitimate fund sources, and evaluate whether repeated below-threshold placements align with declared customer profiles or business activities. This focused approach exposes coordinated smurfing or layering efforts early in the placement stage.

Perform comprehensive identification and verification of all depositors, particularly those who are not the named account holders, ensuring each deposit is traceable to a legitimate source. Cross-check the geographic distribution of deposits against a customer’s stated business or personal profile to detect and escalate irregular sub-threshold placements.

Implement scenario-based transaction monitoring rules to identify repeated sub-threshold cash deposits across multiple branches or geographies in short timeframes. This approach directly addresses smurfing by linking deposit patterns that individually appear low-risk yet collectively reveal structured placements, enabling prompt detection and escalation of suspicious activity.

Institute internal aggregation protocols to capture multiple smaller cash deposits that collectively meet or exceed reporting thresholds. By consolidating deposit data from different branches or accounts, institutions can disrupt criminals' attempts to evade CTR requirements through geographically dispersed structuring.

Provide specialized training to frontline staff, particularly cashiers and branch personnel, to recognize coordinated smurfing indicators such as multiple individuals depositing similar amounts, repetitive deposit slips, or unusual cross-branch activity. By equipping staff with scenario-based examples, financial institutions can flag suspicious placement attempts at the point of deposit.

Engage in lawful interbank and cross-border information-sharing partnerships to identify repeated sub-threshold cash deposits made at multiple institutions or in different regions. By exchanging data on similar deposit patterns, banks can expose smurfing networks that rely on geographical dispersion to stay below detection thresholds.

Instruments

  • Once smurfs deposit small amounts of cash into separate bank accounts at various branches, the funds can be swiftly transferred or aggregated elsewhere.
  • Normal transaction monitoring may fail to link these geographically dispersed deposits to a single criminal operation.
  • The ability to hold multiple accounts in different locations makes it easier to compartmentalize and layer illicit funds, reducing the likelihood of detection.
IN0051
|
|
  • Criminals use physical currency to make multiple small deposits across geographically dispersed bank branches or institutions.
  • Because individual cash deposits are kept below reporting thresholds, it becomes harder for financial institutions to detect a larger aggregate of illicit proceeds.
  • The anonymity and fungibility of physical cash allow smurfs or couriers to deposit funds without leaving a clear audit trail linking all deposits to a single source.

Service & Products

  • Criminals deposit smaller amounts of cash below official thresholds at numerous branches or counters, circumventing detection triggers.
  • Distributing deposits geographically obscures the connection among individual transactions, hampering investigators’ ability to flag a consolidated illicit source.
PS0024
|
|
  • Smurfs or third parties deposit small cash sums via ATMs across wide geographic areas, minimizing direct teller interaction and detection.
  • Rapid electronic consolidation of these deposits further obscures suspicious patterns, making it difficult to trace the overall trajectory of funds.
  • Illicit funds are funneled through multiple business accounts in different geographic regions under the guise of legitimate commercial transactions.
  • Repeated, low-value cash deposits blend in with normal revenue streams, reducing the likelihood of triggering AML alerts.
  • Multiple small cash deposits are submitted at different remittance outlets, both locally and across borders, disguising the true origin of funds.
  • The fragmented nature of these transactions makes it harder for authorities to identify a single underlying criminal operation.
  • Multiple individuals or “smurfs” deposit small cash amounts into various personal accounts at different locations, circumventing reporting thresholds.
  • Once placed, these funds are swiftly combined or transferred into a single channel, masking their illicit origin.

Actors

They orchestrate the deposit scheme by:

  • Generating illicit funds from predicate offenses and seeking to introduce them into the financial system.
  • Instructing multiple individuals or smurfs to make small deposits across diverse branches or locations, each below reporting thresholds.

This approach masks a single illicit source by dispersing deposits geographically, complicating financial institutions' detection efforts.

AT0064
|
|

They facilitate the physical transport of currency by:

  • Moving bulk cash across domestic or international boundaries for quick deposit.
  • Delivering funds to different regions and branches in coordination with deposit instructions.

This enables criminals to spread out deposits and dodge localized scrutiny.

AT0076
|
|

They act as smurfs by:

  • Depositing modest sums of cash into various personal or provided accounts across different branches or institutions.
  • Following specific instructions to keep each deposit under suspicion thresholds, unwittingly or knowingly aiding in layering illicit proceeds.

This role is critical in distributing transactions so they appear unrelated.

They are unwittingly exploited by:

  • Accepting multiple small cash deposits, often below reporting thresholds, across various branches or counters.
  • Providing channels (e.g., ATM services, teller windows) through which dispersed deposits obscure any single suspicious total.

This fragmented use of numerous locations hampers the timely recognition of illicit patterns.

References

  1. APG (Asia/Pacific Group on Money Laundering). (2019, August). APG Yearly Typologies Report 2019. Asia/Pacific Group on Money Laundering. https://apgml.org/documents/default.aspx

  2. Financial Action Task Force (FATF). (2018). Professional money laundering. FATF. https://www.fatf-gafi.org/content/dam/fatf-gafi/reports/Professional-Money-Laundering.pdf

  3. AUSTRAC (Australian Transaction Reports and Analysis Centre). (2012). Typologies and case studies report 2012. AUSTRAC. https://www.austrac.gov.au/business/how-comply-guidance-and-resources/guidance-resources/typologies-and-case-studies-report-2012

  4. AUSTRAC (Australian Transaction Reports and Analysis Centre). (2014). AUSTRAC typologies and case studies report 2014. Commonwealth of Australia . http://www.austrac.gov.https://www.austrac.gov.au/sites/default/files/2019-07/typologies-report-2014.pdf