Smurf signals: when structuring meets peer-to-peer transfers

Sep 3 / Leonard Nwogu-Ikojo

How do structuring and peer-to-peer (P2P) dispersion work together to conceal illicit funds? In this fictional case study, a series of small cash deposits just below reporting thresholds—paired with rapid mobile wallet transfers across Europe—reveals how criminals use everyday payment channels to build hidden networks. By combining structuring and P2P dispersion, launderers can fragment and reroute funds in ways that evade detection. This scenario highlights why modern AML efforts under AMLD 6 and the AMLR must move beyond static thresholds to recognise the bigger picture: coordinated patterns that turn small, ordinary movements into complex laundering schemes.




This article is intended for educational and informational purposes only and does not constitute legal, regulatory, or professional compliance advice. The scenario and recommendations provided are illustrative and may not capture all applicable requirements or risks in specific cases. Readers should follow their organization’s internal policies, data protection requirements, and seek professional advice tailored to their circumstances.

Case snapshot: the network hiding in small pieces

Luc sat at his desk, scanning the latest transaction monitoring alerts when one customer caught his eye. A structuring rule had flagged a pattern of cash deposits just below the €10,000 threshold—€9,800 each time, across five consecutive days and three cities in Spain. Each deposit was made in person, across different branches of the same institution.

Suspicious, but not yet damning.

Then another alert fired—this time from a peer-to-peer (P2P) monitoring rule. The same customer had initiated a string of outbound mobile wallet transfers, each ranging between €8,000 and €9,500. The recipients were scattered across Germany, France, and the Netherlands, with no apparent familial or commercial ties to the sender.

Ella leaned over Luc’s screen, studying the names and wallet IDs of the beneficiaries. They were mostly young adults with thin credit files and inactive bank accounts—classic indicators of potential mule recruitment.

“These beneficiaries are barely visible in the financial system,” she noted. “Minimal credit history, dormant accounts, and activity that starts and stops like clockwork.”

Luc pulled their onboarding records. The customer was registered as a freelance graphic designer. But there was no business website, no invoices, and no trace of creative work online.

Marcus joined in, drawing connections across past alerts.

“Look at the pattern,” he said. “Consistent deposit amounts just below reporting thresholds. Then instant digital dispersal to low-profile individuals across borders. This isn’t freelancing—it’s structured placement and mule-enabled layering. Someone’s testing how far they can push the structure before triggering a bank response.”

Luc filed a Suspicious Transaction Report (STR), citing structuring and coordinated P2P dispersion as evidence of layering and potential money mule exploitation. While each transaction appeared modest in isolation, the pattern exposed a coordinated laundering scheme hiding beneath the surface.

Why these rules matter together

Structuring, or “smurfing,” involves breaking large transactions into smaller ones to avoid reporting thresholds or scrutiny. On its own, it’s a red flag. But when paired with peer-to-peer transfers, it becomes a sign of laundering orchestration.

Structuring patterns:

  • Multiple deposits just under AML or CTR thresholds
  • Frequent branch use in different locations
  • Use of cash or anonymous funding sources

Peer-to-peer risks:

  • Use of apps with light KYC or weak monitoring
  • Transfers to unknown individuals with no clear relationship
  • International dispersion of funds without a declared business purpose

Together, they suggest a decentralized money movement strategy—used by human traffickers, fraudsters, and organized crime to obscure fund origin and flow.

This speaks directly to EU obligations under AMLD 6, which includes organized crime and facilitation of predicate offences via digital platforms and AMLR, mandating risk-based detection and monitoring of suspicious patterns, including use of new payment methods.

The P2P network described, with its coordinated cash deposits and dispersal to money mules, is a common example of an organized criminal network. The Directive provides the legal framework for Member States to prosecute such activities. By specifically including the facilitation of predicate offenses, AMLD 6 highlights the growing risk of services like mobile wallets being exploited. The case's use of P2P apps falls directly under this expanded scope, requiring Member States to ensure their legal systems can address this.

The "Smurf Signals" scenario perfectly illustrates the need for a risk-based approach. The AMLR obliges banks to go beyond simple transaction thresholds and look for the pattern of small, seemingly innocent deposits, especially when they are combined with other suspicious behavior. The use of mobile wallets for P2P transfers is a key example of a "new payment method" that the AMLR is designed to address. The Regulation requires institutions to have monitoring systems that can specifically detect the misuse of these channels.

Final thought: look for patterns, not just thresholds

Smurfing thrives when monitoring systems treat each deposit in isolation. But structuring in addition to P2P rules let you connect small movements into big stories.

Because the crime doesn’t live in the transaction—it hides in the design of the system that launders it.


Created with