Fraud & Compliance / Learning brief
Cash Transaction Reports and the AML Reporting Chain
Your notes
In simple terms / 01
What this means in plain language
Anti-money-laundering reporting runs on two complementary tracks: objective threshold reports for large cash, and judgement-based suspicious-activity reports. Together they give the authorities both a wide net and a sharp filter.
Financial institutions do not decide on their own what the authorities get to see about money movements; the rules set out a reporting chain. One track is objective: when cash crosses a set threshold, a Cash Transaction Report (CTR) is filed regardless of whether anyone is suspicious. The other track is a matter of judgement: when staff form a suspicion, they file a Suspicious Transaction Report, also called a Suspicious Activity Report (STR or SAR). Both flow to the national Financial Intelligence Unit. The two tracks are designed to work together, one catching size and one catching intent, and this guide explains who files, what the thresholds mean, and why both are needed.
Complete lesson / 02
Understand the full idea, step by step
Not every report a bank files means someone did something wrong. Two very different triggers put a report on its way to the authorities: a plain fact — a large cash amount — and a human judgement — a sense that something is off. Understanding that difference explains most of how AML reporting works.
Cash Transaction Report (CTR) — an objective report triggered by a cash amount crossing a threshold
A CTR is mechanical. Once a cash transaction crosses a defined threshold, the report is filed regardless of whether anyone is suspicious. It measures size, not concern. Because the trigger is objective, CTRs give the authorities a wide, consistent net over large cash movements — even the ones that look entirely ordinary.
Suspicious Transaction Report (STR), also Suspicious Activity Report (SAR)
An STR or SAR is the opposite in spirit. It depends on human judgement and is filed whenever staff form a reasonable suspicion — no matter how small the amount. It measures concern, not size. Where the CTR guarantees visibility of large cash, the STR catches behaviour that stays small or clever on purpose.
| CTR | STR / SAR | |
|---|---|---|
| Trigger | Amount crosses a threshold | Reasonable suspicion forms |
| Basis | Objective and mechanical | Human judgement |
| Amount | Only above the threshold | Any amount, however small |
| What it gives the FIU | A wide, consistent net | A sharp, selective filter |
Structuring
Structuring is deliberately splitting a sum into smaller amounts to keep each one under a reporting threshold. The customer in Bank Alfa's second report was structuring. The act itself is a recognised red flag: dodging the threshold is what draws attention, which is why suspicion reporting exists alongside the threshold track — to catch what the threshold alone would miss.
Where the reports go
Both kinds of report flow to the national Financial Intelligence Unit (FIU) — the government agency that gathers and analyses them and passes intelligence to law enforcement. The bank's duty ends at filing accurately and on time; it does not investigate crimes or make arrests. The FIU sees across many banks at once, which is how patterns invisible to any single institution come into view.
WHAT IF — A member of staff is tempted to warn the customer that a report has been filed.
What happens: That is tipping-off, and it is prohibited. Warning the subject would defeat the report and can be an offence in its own right.
How it is handled: The report stays confidential. Staff continue to serve the customer normally where required, restrict who knows about the report, and let the FIU and law enforcement act. Secrecy is what keeps the report useful.
Why two tracks, not one
Thresholds and suspicion cover different gaps. Threshold reporting makes large cash visible even when nothing looks wrong. Suspicion reporting catches the cases engineered to stay quiet — the structured deposits, the small odd pattern. One is a wide net; the other is a sharp filter. Together they let the FIU see both the obvious and the deliberately hidden.
FOR NOW, REMEMBER
- AML reporting runs on two tracks: objective threshold reports and judgement-based suspicion reports.
- A CTR is filed because an amount crosses a threshold; an STR/SAR is filed because suspicion forms.
- Structuring — splitting sums to stay under a threshold — is itself a red flag.
- Both reports flow to the FIU, and tipping-off the customer is prohibited.
TRY IT YOURSELF
A customer makes several cash deposits over a week, each deliberately just below the reporting threshold. Which reporting response fits?
Not every report a bank files is about crime. Next: FATCA and CRS, where the same customer data serves a different master — tax transparency.
KEEP GOINGKey takeaways / 03
Three things to remember
- 01
A Cash Transaction Report (CTR) is objective and threshold-driven: it is filed whenever cash exceeds a set limit, whether or not anyone suspects wrongdoing.
- 02
A Suspicious Transaction or Activity Report (STR/SAR) is judgement-driven: it is filed when staff form a reasonable suspicion, regardless of amount, and both report types go to the Financial Intelligence Unit (FIU).
- 03
Deliberately splitting a large sum into smaller pieces to stay under a reporting threshold, known as structuring, is itself a red flag that controls watch for; warning the customer about a report, called tipping-off, is prohibited.
Practical use cases / 04
Where you would use this
A branch automatically generating a CTR when a customer deposits cash above the legal threshold, without any judgement call required.
An analyst filing an STR after noticing a pattern of behaviour that does not fit a customer's profile, even though no single transaction crossed a threshold.
A compliance system flagging several same-day deposits just under the threshold as possible structuring for a human to review.
Worked example / 05
Put the idea into a real situation
Illustrative example: In a fictional country, the cash-reporting threshold is 10,000 units. A customer at Northgate Bank deposits 12,000 units in cash, so the branch files a Cash Transaction Report automatically, no suspicion needed. A week later a different customer makes four deposits of 2,400 units at three branches in one afternoon. No single deposit crosses the threshold, but the pattern looks like structuring, so an analyst files a Suspicious Transaction Report and, crucially, says nothing to the customer, because tipping-off is not allowed.
Evidence & review / 07
Evidence & review
General AML reporting model. CTR thresholds, exact report names, and filing timelines vary by jurisdiction.
What this brief simplifies: CTR and STR presented as a clean pair; jurisdictions differ on thresholds, forms, and timing, which are described rather than numbered.
Sources for this brief2
- Official requirement
The FATF Recommendations: International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation ↗ — Financial Action Task Force · Suspicious-transaction reporting; Financial Intelligence Units
Adopted in 2012 and updated regularly since; the June 2025 FATF plenary agreed revisions to Recommendation 16 on payment transparency. Consult the live consolidated text for the current wording.
- Simplified educational illustration
Payments Signal editorial teaching models — Payments Signal
Used wherever diagrams, scenarios, figures, or example values are didactic constructions rather than sourced facts; every such use carries a simplifications disclosure. All people, companies, banks, and list entries in examples are fictional.