Money services businesses filed 97% of the human smuggling-related Suspicious Activity Reports in FinCEN's recent analysis, but banks' 3% accounted for 61% of the dollar volume. That gap reveals something your transaction monitoring system might miss: the difference between spotting individual payments and mapping the network they feed.
This template provides a framework for building network intelligence queries that connect scattered transactions into investigable patterns. It won't replace your existing transaction monitoring, but it will help you see what happens when dozens of flagged payments converge.
Purpose of the Template
This SQL-style query template helps build network relationship maps in your AML case management or data warehouse environment. Use it to:
- Identify funnel accounts receiving payments from multiple originators
- Map relationships between senders, beneficiaries, and intermediate accounts
- Detect patterns across geographies, payment types, and time windows
- Generate leads for investigators that show connections, not just outliers
The template assumes you have access to transaction data, customer profiles, and prior SAR filings in a queryable format. If you're working in a vendor platform with limited SQL access, adapt the logic to your available filters and relationship mapping tools.
Prerequisites
Before customizing this template, ensure you have:
- Transaction history spanning at least 90 days (180+ days preferred for pattern detection)
- Customer relationship data including beneficial owners, authorized signers, and linked accounts
- Geographic metadata for transaction origins, destinations, and customer addresses
- Prior SAR filing data to identify accounts already under review
- Access permissions to query across retail, business, and wire transfer systems
You'll also need a working definition of what constitutes "high volume" and "suspicious convergence" for your institution. A regional bank will set different thresholds than a global money center bank.
The Template
-- Network Convergence Detection Template
-- Purpose: Identify accounts receiving funds from multiple unrelated parties
-- Customize: Thresholds, time windows, geographic filters, account types
WITH funnel_candidates AS (
SELECT
beneficiary_account_id,
COUNT(DISTINCT originator_account_id) AS unique_senders,
COUNT(DISTINCT originator_customer_id) AS unique_sender_customers,
SUM(transaction_amount) AS total_received,
COUNT(transaction_id) AS transaction_count,
MIN(transaction_date) AS first_transaction,
MAX(transaction_date) AS last_transaction
FROM wire_transfers -- Replace with your transaction table
WHERE transaction_date >= CURRENT_DATE - INTERVAL '90 days'
AND transaction_type IN ('wire', 'ACH', 'P2P') -- Customize by payment type
GROUP BY beneficiary_account_id
HAVING COUNT(DISTINCT originator_account_id) >= 10 -- Threshold: 10+ unique senders
AND SUM(transaction_amount) >= 50000 -- Threshold: $50K+ total
),
relationship_check AS (
SELECT
fc.beneficiary_account_id,
fc.unique_senders,
fc.total_received,
COUNT(cr.relationship_type) AS verified_relationships
FROM funnel_candidates fc
LEFT JOIN customer_relationships cr -- Your CRM or KYC relationship table
ON fc.beneficiary_account_id = cr.account_id
AND cr.relationship_type IN ('family', 'business_partner', 'employee')
GROUP BY fc.beneficiary_account_id, fc.unique_senders, fc.total_received
),
geographic_pattern AS (
SELECT
wt.beneficiary_account_id,
COUNT(DISTINCT wt.originator_country) AS originating_countries,
STRING_AGG(DISTINCT wt.originator_country, ', ') AS country_list
FROM wire_transfers wt
INNER JOIN funnel_candidates fc
ON wt.beneficiary_account_id = fc.beneficiary_account_id
WHERE wt.transaction_date >= CURRENT_DATE - INTERVAL '90 days'
GROUP BY wt.beneficiary_account_id
)
SELECT
rc.beneficiary_account_id,
c.customer_name,
c.account_open_date,
rc.unique_senders,
rc.verified_relationships,
(rc.unique_senders - rc.verified_relationships) AS unverified_senders,
rc.total_received,
gp.originating_countries,
gp.country_list,
CASE
WHEN rc.verified_relationships = 0 THEN 'HIGH'
WHEN (rc.unique_senders - rc.verified_relationships) >= 8 THEN 'MEDIUM'
ELSE 'LOW'
END AS risk_score
FROM relationship_check rc
INNER JOIN customers c ON rc.beneficiary_account_id = c.account_id
LEFT JOIN geographic_pattern gp ON rc.beneficiary_account_id = gp.beneficiary_account_id
WHERE (rc.unique_senders - rc.verified_relationships) >= 5 -- At least 5 unverified senders
ORDER BY risk_score DESC, rc.total_received DESC;
Customizing the Template
Adjust thresholds for your risk appetite and institution size:
unique_senders >= 10: Lower this to 5 for smaller institutions or specific high-risk corridors; raise it to 20+ for retail banks with high legitimate P2P volume.total_received >= 50000: Scale based on your average transaction size and customer base.INTERVAL '90 days': Extend to 180 days to catch slower-building networks; shorten to 30 days during heightened enforcement periods.
Add industry-specific filters:
AND c.business_type NOT IN ('payroll_service', 'marketplace', 'nonprofit')
Exclude account types that legitimately receive funds from many unrelated parties. Document every exclusion in your AML policy.
Layer in behavioral signals:
AND NOT EXISTS (
SELECT 1 FROM prior_sars ps
WHERE ps.account_id = fc.beneficiary_account_id
AND ps.filing_date >= CURRENT_DATE - INTERVAL '12 months'
)
This variant identifies new funnel patterns on accounts that haven't triggered recent SARs. If you want to track accounts with repeat patterns, reverse the logic.
Incorporate cash activity:
Join your branch transaction data to flag accounts that both receive multiple wire transfers and show structured cash withdrawals. FinCEN's analysis noted cash structuring as a recurring indicator in bank filings.
Map migration routes:
If you serve regions with known migration corridors, add geographic filters:
WHERE wt.originator_country IN ('MX', 'GT', 'HN', 'SV', 'CO') -- ISO country codes
AND wt.beneficiary_state IN ('TX', 'CA', 'AZ', 'NM')
The FinCEN dataset ranked the U.S., Mexico, Guatemala, Honduras, and Colombia as the top subject locations. Your institution's risk profile will determine which corridors matter most.
Validation Steps
1. Test against known cases
Run the query against accounts tied to previously filed SARs. If it doesn't surface at least 60% of your confirmed funnel account cases, your thresholds are too high or your relationship data is incomplete.
2. Review false positive patterns
Pull 20 accounts flagged as HIGH risk and manually verify whether the unverified relationships are actually suspicious. If more than half turn out to be explainable (legitimate business relationships not captured in your CRM, family remittances with documentation gaps), recalibrate your verified_relationships join logic or add business type exclusions.
3. Measure investigator efficiency
Track how long it takes investigators to disposition cases generated by this query versus cases from traditional transaction monitoring. Network intelligence should reduce investigation time by giving investigators a map, not just an alert. If your team spends the same amount of time per case, the query isn't providing enough context. Add fields that show transaction velocity, time-of-day patterns, or linked accounts.
4. Monitor for drift
Rerun validation quarterly. Criminal networks adapt. A threshold that worked in Q1 may miss evolved structuring patterns in Q3. If your SAR filing volume drops while peer institutions' volumes hold steady, you're likely missing something.
5. Document your assumptions
Your examiners will ask why you chose 10 senders instead of 8, or why you excluded certain business types. Maintain a change log that records every threshold adjustment, the data that justified it, and the date you implemented it. That documentation is your defense when FFIEC asks whether your system is risk-based or arbitrary.
This template won't catch every smuggling network. But it will help you see what MSBs can't: the accounts where individual payments converge into something larger.
