链上交易监控与可疑活动报告 (SARs)

It's rarely a single threshold, more often a combination of factors. The "clear aggregated value" is usually set internally based on risk appetite, but the pattern of consolidation after multiple small sends definitely raises flags for many institutions, particularly if it crosses a certain volume or velocity over a short period. Regulators tend to focus on the 'why' behind the activity.

That's a really good question. I've been wondering the same thing about how those thresholds are actually determined in practice. Is there a general guideline, or is it more dependent on the specific institution's risk model?

It's not just about the value; the pattern itself is key. Multiple low-value sends followed by consolidation, especially across different addresses, often flags as potential 'peeling' or 'layering' to obscure origin. Even if individually small, the aggregate activity and the method can be suspicious.