Representative capture · 2 Jul 2026
Transaction-monitoring triage
Cadre pack · Sift
Closes routine alerts or sends material ones into investigation with a grounded case note.
One frozen, sanitized execution on representative data. It shows an observed path and retained decision—not repeatability, production fitness, legal instruction, or regulatory compliance.
Recorded decision
Decision record
Triage Summary — Alert A1 | Greenfield Auto Parts (C6)
Disposition: ESCALATE | Risk Score: 0.88 / 1.00
What fired
Four cash deposits ($8,900 – $9,700) across multiple branches over five days — all sub-$10,000, aggregating to $37,300.
Why this escalates
- Classic structuring pattern — every deposit sits in the $8,900–$9,700 band, a hallmark of deliberate CTR-avoidance. The combined total ($37,300) would have required CTR reporting if deposited in fewer transactions.
- Cross-branch / multi-channel execution — at least two branch locations and an ATM used in five days, a recognised structuring technique.
- Profile mismatch — the customer is a B2B auto-parts wholesaler; KYC documents expected activity as card settlement and supplier ACH. There is no documented cash-intensive business rationale.
- No mitigating history — no prior alerts exist, but this does not explain or normalise activity that is structurally inconsistent with the business profile.
Reason codes
structuring · sub-threshold-cash · cross-branch · profile-deviation · cash-inconsistent-with-wholesale-profile
Recommended next step
Route to L2 Investigations for EDD: obtain a source-of-cash explanation, review full account history for additional sub-threshold deposits, assess SAR filing obligation, and conduct a CTR look-back review.
Inspect the observed pathOpen the sanitized reasoning, actions, and ordered event record behind this decision.
Observed path
This is the retained public trace from one frozen representative execution. It is not a live run, a repeatability claim, or a complete production audit record.
I'll kick off by pulling the alert and then fan out to gather all the context I need in parallel.
Step 1 — Read the alert
Step 2 — Parallel fetch: customer profile, flagged transactions, and prior alerts
Step 3 — Analysis
Here's what the evidence shows:
| Factor | Finding |
|---|---|
| Scenario triggered | Structuring |
| Transaction pattern | 4 cash deposits in 5 days: $9,200 / $9,500 / $8,900 / $9,700 — every single one sub-$10k, totalling $37,300 |
| Branch spread | At least two distinct branches (T6002 memo: "diff. branch"); T6003 uses ATM channel |
| Customer type | B2B auto-parts wholesaler; expected activity = card settlement + supplier ACH — no cash-intensive element documented |
| Profile fit | fail Cash deposits of this nature are inconsistent with a wholesale trade profile |
| Prior alerts | None — but absence of history does not clear structuring activity |
Red-flag assessment:
- ✅ All amounts kept just below $10,000 (range: $8,900–$9,700) — classic CTR-avoidance band
- ✅ Multiple branches / channels within a compressed 5-day window — textbook cross-branch structuring
- ✅ Aggregate ($37,300) far exceeds the threshold that would have triggered a single CTR
- ✅ No documented business rationale for cash receipts; wholesalers overwhelmingly settle via ACH/wire/card, not cash
- ✅ Medium risk-rated business with no explanation on file
This is an unambiguous structuring typology with a clear profile mismatch. There is no benign explanation I can construct from the available facts. Escalating.
Step 4 — Record triage decision