Domestic Bulk Cash Delivery

Domestic Bulk Cash Delivery involves transporting large sums of illicit physical currency entirely within national borders to avoid the scrutiny usually associated with cross-border activity. Criminals often rely on large-denomination banknotes to reduce physical bulk and then move these funds through private couriers, personal vehicles, or even commercial transports with minimal visibility. Once relocated, the proceeds are deposited or exchanged in amounts specifically structured to fall below mandated reporting thresholds, exploiting weaker monitoring of in-country cash movements compared to international transfers. Financial institutions must remain vigilant toward the source and purpose of large domestic cash flows, as similar risks and vulnerabilities can arise just as in cross-border scenarios, particularly when compliance standards vary regionally within the same jurisdiction. Through these layering and sub-threshold deposits, criminals evade immediate suspicion and ultimately integrate illicit funds into the financial system with fewer obstacles.

[
Code
T0119
]
[
Name
Domestic Bulk Cash Delivery
]
[
Version
1.0
]
[
Parent Technique
]
[
Tactics
]
[
Risk
Product Risk, Channel Risk
]
[
Created
2025-03-12
]
[
Modified
2025-04-02
]

Domestic Cash Movements

Tactics

ML.TA0006
|
|

Ultimately aims to introduce large volumes of criminal proceeds into the financial system through smaller, less alarming deposits.

Risks

RS0002
|
Product Risk
|

Subsequent structured deposits exploit the inherent vulnerabilities of cash transaction products, such as bank accounts, by splitting illicit funds below reporting limits. This layering tactic leverages thresholds designed for typical usage, enabling criminals to integrate large sums of illicit currency without triggering standard product-level alerts.

RS0003
|
Channel Risk
|

This technique exploits minimally scrutinized domestic transport channels. Criminals avoid cross-border attention by moving large banknotes entirely within national boundaries, then make piecemeal deposits that fall under local reporting thresholds. The primary vulnerability lies in relying on private couriers, shipping services, or personal vehicles, where oversight is weaker compared to international routes.

Indicators

IND00381
|

Frequent same-day cash deposits split across multiple branches within the same jurisdiction, each deposit remaining under applicable threshold limits.

IND00389
|

Entities with minimal historical cash operations suddenly present a surge in domestic cash-in-transit activity, unaligned with their stated business profile.

IND00390
|

Multiple related parties deposit sub-threshold cash amounts into a single account from various domestic locations, lacking any legitimate shared business link.

IND00393
|

Frequent deposit of large-denomination banknotes by unauthorized third-party couriers, lacking documentation or legitimate business rationale.

IND00547
|

Large volumes of cash deposits consistently structured below domestic reporting thresholds at branches located near primary in-country transport routes.

IND00548
|

Customer repeatedly transports physical currency to bank locations outside their normal business or residential area without a clear economic rationale.

Data Sources

Provides detailed information on intranational differences in AML/CFT regulations, enforcement, and compliance standards, highlighting regions with weaker oversight where criminals might attempt to transport and deposit large sums of cash domestically. This data enables financial institutions to prioritize those areas for enhanced due diligence and detect unusual in-country cash flows consistent with bulk cash deliveries.

Capture comprehensive details of deposits, including timestamps, amounts, denominations, parties, and channels. This enables the analysis of repeated sub-threshold transactions and unusual cash volumes. These records allow investigators to identify potential structuring that aligns with domestic bulk cash deliveries.

Encompasses a company’s operational metrics, revenue streams, and expected cash handling practices. By comparing declared business activities with observed domestic cash deposits, investigators can identify sudden, unexplained surges in cash flows indicative of bulk cash delivery schemes.

Includes verified identities, authorization details, and business profiles of customers and depositors, allowing for the detection of unauthorized third-party couriers and confirmation that cash inflows align with declared business activities. This data enables thorough investigations into suspicious deposits tied to domestic bulk cash deliveries.

Contains location-based details of deposit and withdrawal activities, showing branch usage and distances from a customer’s usual business or residential areas. This data helps identify suspicious cluster deposits along domestic transport routes, consistent with bulk cash deliveries.

Mitigations

For customers exhibiting high-volume domestic cash activity, conduct on-site inspections, request documented proof of cash origin, and verify the legitimacy of any courier or third-party depositor involved. Investigate repeated sub-threshold deposits across multiple branches as a potential sign of structuring, applying heightened scrutiny and requiring robust evidence of lawful funding sources.

Implement rules-based and data analytics-driven monitoring to flag repeated sub-threshold deposits at different domestic branches or by third-party couriers. Specifically, target unusual spikes in large-denomination banknotes, multiple deposits made in a single day below reporting thresholds, and cash movements inconsistent with the customer’s known business profile.

Consolidate daily cash deposits across all branches and channels to identify aggregated totals exceeding the reporting threshold. Require real-time reconciliation of deposits to ensure customers do not evade CTR obligations by distributing bulk cash into separate sub-threshold transactions within the same day or region.

Provide front-line employees and branch staff with targeted instruction on identifying domestic bulk cash vulnerabilities, such as large-denomination deliveries, multiple couriers depositing into a single account, and sudden spikes in sub-threshold cash transactions. Emphasize immediate escalation procedures whenever these red flags are encountered.

Assign higher-risk designations to customers who consistently deposit large amounts of cash domestically without credible justification, particularly when deposits are structured to avoid triggers. Increase the frequency of reviews and threshold checks on these accounts, ensuring that subsequent transactions receive intensified scrutiny.

Instruments

  • After transporting illicit cash domestically, criminals deposit it into bank accounts in amounts deliberately kept under mandated reporting thresholds to avoid raising red flags.
  • By spreading multiple sub-threshold deposits across various accounts and branches, they obscure the total volume of illicit proceeds.
  • Domestic transactions often face weaker oversight than cross-border transfers, facilitating prolonged layering and integration of the funds with minimal detection.
IN0051
|
|
  • Criminals exploit the portability and anonymity of physical banknotes by moving large sums domestically in high-denomination currency, reducing overall bulk and easing concealment.
  • Once relocated, they deposit or exchange the illicit funds in increments specifically structured below reporting thresholds, minimizing scrutiny from financial institutions.
  • The absence of cross-border declarations further decreases detection risk, allowing criminals to circulate illicit cash within the national financial system largely unnoticed.

Service & Products

  • Enables repeated deposits and withdrawals of physical currency at bank branches or ATMs, which criminals break into smaller amounts to remain under reporting thresholds.
  • By distributing these structured transactions across multiple locations, criminals reduce the likelihood of triggering suspicion or detection.
  • Criminals deposit proceeds into personal accounts in small increments, avoiding large one-time deposits that would attract scrutiny.
  • Multiple deposits below reporting thresholds from various branches help launder illicit cash domestically without unsettling compliance alerts.
  • Criminals exploit professional cash transportation services to discreetly move large amounts of physical currency within national borders, avoiding the scrutiny typically associated with international routes.
  • Illicit cash may be mingled with legitimate shipments, reducing the likelihood of detection and enabling bulk transfers from one region to another for subsequent structuring.
  • Businesses that count, sort, and process cash on behalf of clients can integrate illicit currency with legitimate takings, minimizing visibility of unusually large sums.
  • Through routine bulk processing, criminals obscure their deposits among legitimate transactions, facilitating sub-threshold deposits that appear normal.

Actors

Illicit operators generate and handle criminal proceeds that are transported in bulk within national borders. They:

  • Use large-denomination banknotes to minimize physical volume.
  • Deposit or exchange the cash in amounts designed to stay below reporting thresholds.

By operating domestically rather than across international boundaries, they reduce scrutiny and facilitate easier integration of illicit funds into the financial system.

AT0064
|
|

Cash couriers physically transport illicit currency for criminals within the same jurisdiction. They:

  • Move large sums by private vehicle or courier services, bypassing stricter cross-border checks.
  • May be complicit or unaware of the illicit nature of the funds.

Their involvement complicates detection, ensuring bulk amounts reach deposit points with minimal inspection.

Shipping and logistics services are exploited by criminals who:

  • Conceal high-value cash shipments among legitimate cargo.
  • Rely on established freight routes to move funds across different regions within the same country.

This reduces the visibility of illicit cash movements and complicates subsequent identification when the money eventually enters financial channels.

Financial institutions are unwittingly used once illicit cash is relocated. Criminals:

  • Deposit or exchange currency in smaller increments below domestic reporting thresholds.
  • Distribute these transactions across multiple accounts or branches to avoid red flags.

This reliance on sub-threshold structuring obscures the total volume of illicit proceeds entering the system.

References

  1. AUSTRAC (Australian Transaction Reports and Analysis Centre). (2024). Money laundering in Australia National Risk Assessment. Commonwealth of Australia. https://www.austrac.gov.au/sites/default/files/2024-07/2024%20AUSTRAC%20Money%20Laundering%20NRA.pdf

  2. Sterling, S. (2015). Identifying money laundering: Analyzing suspect financial conduct against the speed, cost, and security of legitimate transactions. Journal of Money Laundering Control, Vol. 18 No. 3, pp. 266-292. https://doi.org/10.1108/JMLC-08-2014-0025

  3. The Wolfsberg Group. (2023, February). Correspondent Banking Due Diligence Questionnaire (CBDDQ) Guidance. The Wolfsberg Group. https://wolfsberg-group.org/resources