Structuring
Breaking an amount into several smaller ones so that none of them reaches a reporting threshold. The shape is unmistakable once you know it, and it is also what a payroll run looks like.
Structuring is splitting a sum into several smaller transfers so that no single one reaches a reporting threshold. Nine transfers of between 9,400 and 9,800 USDC inside eleven hours, where the threshold is 10,000, is the textbook shape.
It is among the oldest patterns in financial crime and it carried over to onchain activity unchanged, because the thing being avoided is a reporting rule rather than anything about the rails.
Why it is treated as a concern
Deliberately arranging activity to avoid a reporting obligation is itself an offence in most regimes, separately from whatever the funds are. That is what makes structuring unusual: the pattern can be the whole of the concern, with no predicate offence established.
What it looks like
Signature patterns
- Amounts clustered just under a threshold
Not round numbers, and not spread across the range. A tight band immediately below the figure is the tell.
- A short window
Hours or a few days. Activity spread evenly across months is harder to read as deliberate.
- A common origin or destination
Many transfers out of one wallet, or many into one. Either direction counts.
- An uneconomic split
Each transfer pays its own fee, so splitting costs money. A split with no benefit other than staying under the figure is the part that is hard to explain.
- A change in behaviour
The customer previously sent single larger transfers and now does not.
Structuring
High confidenceNine transfers inside eleven hours, none reaching the reporting threshold.
Evidence
- Sent 85,640 USDC across 9 transfers in 11 hours
- Every transfer fell between 9,400 and 9,800 USDC against a 10,000 threshold
- All nine left Wallet: 0x9ab3…1c07 within one window
- The account sent single larger transfers for the preceding eleven months
A match is a hypothesis. This same evidence is what a payroll run of forty contractors produces.
Where to look
| Look at | For |
|---|---|
| The trailing ninety days | Whether this is new behaviour or how the account has always worked. |
| Transfers that did not alert | The alert is one transfer over a rule. The pattern is the ones around it. |
| The declared purpose on file | Whether a split is consistent with what the customer said the account was for. |
| Fees paid across the set | The cost of splitting, which is the economic argument against an innocent reading. |
| Both directions | Receiving many small amounts and sending one large one is the same pattern inverted. |
Rough magnitudes
Three or more transfers within about ten per cent of the threshold, inside a rolling twenty-four hours, is a common starting heuristic. It is a starting point rather than a rule, and your own procedure sets the figure you are held to.
What else produces this shape
Common false positives
- Payroll and supplier runs
A business paying forty contractors produces many similar amounts in a short window. The amounts cluster because the work does, not because of a threshold.
- Platform or counterparty limits
Exchanges and payment platforms cap single transfers. A customer moving a large sum through a capped rail has no choice but to split it.
- Fee or slippage management
Splitting a large trade to reduce price impact is ordinary practice and produces a similar series.
- Test transfers
Sending a small amount first to confirm an address is sensible behaviour, and it puts an odd small transfer at the front of the set.
The question that separates them is whether the split has a purpose other than the threshold. Where the customer can point at a cap, an invoice set or a trading reason, the shape stops being evidence of anything.
Related
What a typology is
A typology is a named pattern of financial crime, written down precisely enough that two people looking at the same case reach the same view about whether it fits.
What a transfer is
A transfer moves value from one address to another and records it permanently. What counts as one transfer differs by chain, which is why two honest counts of the same activity can disagree.
How to run a case
How to scope an investigation, what order to establish facts in and how to tell when you have enough.
Last checked against the product on .