On-chain transaction monitoring & SARs

It's rarely a single threshold, more often a combination of factors. The "clear aggregated value" is usually set internally based on risk appetite, but the pattern of consolidation after multiple small sends definitely raises flags for many institutions, particularly if it crosses a certain volume or velocity over a short period. Regulators tend to focus on the 'why' behind the activity.

There's no universal hard rule for a SAR trigger on aggregated low-value transactions, which is part of the problem. It often comes down to the institution's internal risk models and the qualitative assessment of patterns suggesting structuring or illicit activity, which can be quite subjective.

That's a really good question. I've been wondering the same thing about how those thresholds are actually determined in practice. Is there a general guideline, or is it more dependent on the specific institution's risk model?

That's a great question about the nuances of transaction monitoring. My understanding is that while there isn't a single, universally defined aggregated value, a series of small, seemingly unrelated transactions that are then consolidated, especially if they involve a common intermediary or destination, would definitely raise red flags for potential structuring or layering, regardless of the individual transaction size. It's often the pattern more than the precise amount that triggers review.

It's not just about the value; the pattern itself is key. Multiple low-value sends followed by consolidation, especially across different addresses, often flags as potential 'peeling' or 'layering' to obscure origin. Even if individually small, the aggregate activity and the method can be suspicious.