Five patterns of aggregate violation

This paper treats five recurring patterns, including structuring. Each depends on a different relation that per-element review cannot observe. The inventory defines the paper’s scope rather than a taxonomy of all violations.

Threshold fragmentation is the structuring pattern: a large transaction split into sub-threshold pieces within a window of time. The defining features are a common beneficiary, amounts individually below a reporting threshold, temporal proximity, and an aggregate above the threshold. The $10,000 currency report is the canonical instance, but any regime with a transaction-level reporting threshold admits the pattern.

Ownership accumulation is the equity analogue. Disclosure attaches when a person’s interest crosses a threshold: 25 percent under the European anti-money-laundering directives and United States customer-due-diligence rule (31 CFR 1010.230). Banking law can presume control at 10 percent, as under the United States Change in Bank Control Act. Securities accumulation disclosure begins at 5 percent (Exchange Act § 13(d)).

An actor buying 10 percent, then 8 percent from another seller, then another 8 percent holds 26 percent. No purchase alone crossed the 25 percent threshold. Under § 13(d)(3), holders acting as a group are also aggregated and treated as one person. Evasion avoids computing the aggregate to which the obligation attaches. Purchases from different sellers, at different times, through different instruments make this harder to detect than fragmentation.

Chained control requires attribution through ownership relations. Suppose A holds 60 percent of B, B holds 60 percent of C, and C holds 60 percent of D. Every direct holding is truthfully filed and fully visible, while each filing shows only an ordinary majority stake. The aggregate fact that reveals the violation is A’s control of D.

Economic interest and control compose differently. Economic interests multiply along a path: 60 percent of 60 percent of 60 percent gives A a 21.6 percent look-through stake in D. Products add across parallel paths. A direct 20 percent stake plus 40 percent of an intermediary holding 30 percent gives a 32 percent interest absent from any single filing. Control is transitive: majority control of a majority controller confers control, not a 36 percent interest. A contractual edge may instead confer only a veto over named acts.

The ownership graph therefore needs typed edges with a composition rule for each kind. Multiplying control edges understates control, while treating equity edges as transitive overstates it. The companion paper Lex: A Logic for Jurisdictional Rules develops these rules and their limits. Detection produces an attribution, such as A’s indirect control of D or A’s 32 percent look-through interest. Reviewing individual links cannot produce it.

Sanctions hop-chains route funds to a sanctioned party through unsanctioned intermediaries. Every direct counterparty visible to the screen passes, while the ultimate beneficiary remains outside its view. Sanctions regimes reach indirect dealings. OFAC treats entities owned 50 percent or more in aggregate by blocked persons, directly or through ownership chains, as blocked. Evasion through intermediaries is itself a violation.

A direct-counterparty screen misses the chain when the sanctioned party appears only at its last hop, outside the screen’s view. Another institution may execute that hop. Alternatively, funds may stop at an unlisted entity the sanctioned party owns, without a further hop. Using intermediaries provides no defense.

Circular flows move funds from A to B to C and back to A. Round-tripping creates apparent revenue, and cycling funds through accounts is a common form of layering. Layering separates funds from their origin in the middle stage of the placement-layering-integration sequence.

One operation can create edges A to B and B to C, with a later operation closing the cycle through C to A. No single operation then creates a cycle. An untimed payment graph also contains ordinary refunds, so a cycle alone says little. Evidence requires a flow: edges in time order within a window, with each hop forwarding most of its receipts. Amounts and timestamps distinguish that pattern from ordinary bilateral commerce.

Violations as properties of sequences

Write V for a per-transaction predicate that passes or fails one transaction. A property of finite sequences is elementwise if some V decides it: the sequence has it exactly when every element passes V. Neither violation under the five patterns nor its complement, compliance, is elementwise. The opening example proves both claims.

Suppose V decides violation. Each deposit alone is a lawful one-element sequence, so V must fail it. The triple then contains an element failing V and cannot count as a violation, contrary to the example. Suppose instead that V decides compliance. Every deposit alone is compliant and must pass V. Every element of the violating triple therefore passes V, making the triple compliant.

For each pattern, every element of a violating sequence can occur innocently on its own. This singleton argument excludes a per-element decision rule for either violation or compliance.

Stateful monitoring already responds to this elementary constraint. A detector must consume relations between transactions: shared beneficiaries, time gaps, aggregates, and graph positions. It therefore needs state that persists across transactions. The design questions concern which views of history it maintains, when it is consulted, and the evidentiary standing of its inputs and outputs.

The views the checker maintains

The checker’s state consists of views derived from the firewall’s event log, one for each relation used by the patterns. It requires no second ledger.

For fragmentation, the checker maintains a rolling payment window with beneficiary, amount, and timestamp for each entry. A proposed sub-threshold payment triggers aggregation of entries with the same beneficiary. A multi-entry total above the reporting threshold yields a threshold-aggregation finding. This is evidence of possible structuring. § 5324 also requires a purpose of evading the report, which aggregation cannot establish. The people receiving the finding must determine that purpose.

For accumulation, the checker maintains each beneficial owner’s current holdings by netting acquisitions against disposals as it replays the log. Gross acquisitions would give the wrong result: buy 10 percent, sell 10 percent, then buy 8 percent leaves 8 percent held, not 18. Disclosure therefore depends on what the person currently holds. Purchases of 10 percent today, 8 percent next month, and 8 percent the following month trigger at 26 percent. No purchase crossed the 25 percent threshold, and any intervening sale reduces the position that counts.

For attribution, the checker maintains a typed ownership graph. Equity edges carry current fractions, control edges compose transitively, and contractual rights have their own edge kind. A proposed transfer triggers recomputation through the changed region. Products along equity paths, summed across parallel paths, are tested against the acting jurisdiction’s look-through threshold. The transitive closure of control edges is tested against that jurisdiction’s definition of control.

On an acyclic graph, depth-first search enumerates paths and sums their products. Cross-holdings introduce cycles, where a simple-path sum gives the wrong quantity. Suppose A and B each hold 50 percent of the other, and B holds 40 percent of C. The single simple path gives A a 20 percent interest in C. Accounting for the repeated distributions through the loop gives A 26.7 percent of each distribution from C.

That value is the fixed point defining look-through interest: direct stake plus, for each intermediary held, the fraction held times the intermediary’s own interest. On a cyclic component, the checker solves this recursion as a linear system. It sums over all walks and converges for every component with an outside owner.

A depth bound limits search resources. Dropping paths can only reduce the sum, so reaching the bound yields a stated lower bound on interest, never clearance. The criterion remains the composed quantity for the edge kind.

For hop-chains, the checker maintains a flow graph whose payment edges carry amounts and timestamps, together with the sanctions lists in force. Before commitment, breadth-first search follows incoming flows backward in time from each proposed transfer’s source, up to a configured horizon. Every candidate path ends at the proposed edge. A path beginning at a listed party is reported in full because the proposed transfer would carry that party’s funds onward.

The search cannot examine future transfers, and the direct screen already identifies a listed party at either end of the proposed edge. Backward search identifies an earlier party whose hop was permitted. That party may have been listed later, or listed by the acting jurisdiction but not the jurisdiction that screened the earlier hop. Its earlier hop may also have matched a list and been licensed without permission extending to the onward transfer. Funds have since passed along the chain to the proposing party.

When a list changes, forward breadth-first search follows committed outgoing flows from each newly listed party in time order. It reports every path in full. This finds property moved while its owner was unlisted and supplies evidence of where that party’s interest may persist. The evidence enters the same determination as a pre-commit candidate.

Hop-chain detection also joins the flow and attribution views. A regime that blocks entities owned in aggregate by blocked persons reaches entities absent from its lists. Under OFAC’s rule, the threshold is 50 percent or more, directly or indirectly. This rule uses threshold closure rather than multiplication of equity fractions. Once an entity is blocked, its holdings count in full. Before that, they do not count.

Starting with listed parties, add any entity whose direct holders already in the set together meet the regime’s ownership threshold. Its holdings then count in full in later rounds. Repeat until no entity joins, requiring at most as many rounds as there are entities. Each added, unlisted entity is a derived blocked party. Recompute through the changed region when holdings move and from new entries when a list changes.

The direct screen and both flow searches use the listed and derived sets together. Derived status enters the applicability determination with its supporting list entries and ownership edges.

For cycles, the checker searches the same flow graph within a time window, following edges in time order with approximately conserved amounts. Unrestricted back-edge detection in the untimed graph would also flag every refund.

These views suffice for the five specified patterns. They are an adequate choice without a claim of minimality, and the same log can support other views.

The log is the defense

The event log is append-only, while its views change with current state. Selling shares lowers the holdings view, and expired payments leave a rolling window. A mistaken transfer is corrected by a compensating transfer, a new event in the opposite direction. The original remains. A rescission likewise adds an event to the legal record while preserving the event it rescinds.

Every cross-operation check depends on earlier operations remaining visible. An adversary who could clear the graph, erase holding history, or empty a window could defeat all five checks. The system provides no such interface. Views are deterministic functions of the log, which uses the same gate and audit records as the operations it records. The register’s receipt mechanisms expose tampering with that log. An adversary unable to rewrite history can only add events, which the checker reads.

Jurisdictional parameterization

Jurisdictions share the algorithms while supplying their own thresholds and definitions.

Beneficial-ownership thresholds are 25 percent under the European directives and United States customer-due-diligence rule, 10 percent for banking control presumptions, and 5 percent for securities accumulation disclosure. The United States currency-reporting threshold is $10,000, with other figures elsewhere. The required United States reporting aggregation covers one business day (31 CFR 1010.313). Longer detection windows are policy choices. Maximum sanctions hop depth is also a policy choice balancing detection against false positives.

Definitions vary too. Jurisdictions define control through different thresholds and treatment of de facto control. Those definitions belong in the jurisdiction’s rule pack alongside its thresholds.

A jurisdiction supplies thresholds, windows, horizons, and definitions to instantiate the checker. Graph search, temporal aggregation, netting, and cycle detection remain unchanged. Detection is nevertheless parameter-relative: the same three deposits may fall within one regime’s window and outside another’s. The algorithm answers “what does this sequence aggregate to.” The jurisdiction’s parameters determine the legal meaning of that aggregate.

The integration point

Before a financial write commits, the gate evaluates its transfers against these views. Findings enter the compliance evaluation that decides admission. Their effect depends on the kind of legal fact they support.

Most findings raise reporting or disclosure obligations. Threshold aggregation supports the report required by the regime. Crossing an accumulation or attribution threshold raises the jurisdiction’s disclosure obligation. The jurisdiction supplies these responses along with the thresholds.

A sanctions candidate is a time-ordered path through committed transfers to the proposed transfer. Its source is resolved against a sanctions list or the set derived from that list. The candidate enters the sanctions applicability determination as evidence. That determination resolves identity, names the list and version, fixes the as-of date, and represents lawful licenses, humanitarian carveouts, and sovereign exemptions.

If the determination asserts non-compliance, the gate refuses the write. No ordinary finding, discretionary approval, or approval recognized from another jurisdiction lifts that terminal refusal. The refusal records the asserting authority, list and version, as-of date, and procedure for contesting the determination. Terminal force therefore attaches to the authority’s asserted determination, not to the detector’s candidate alone.

What a finding is worth

A single-entity verdict rests on attested inputs: a registrar’s signed filing, a bank’s confirmed balance, or an officer’s certified position. Each assertion has an accountable authority.

Execution attests the edges of an aggregate finding: every transfer committed through the gate and left an audit record. The register holds those edges directly, while a bank reconstructs them from its partial view. Execution does not attest every relation needed by the patterns. Whether two nodes are one person, holders act in concert, or a structure was designed for evasion requires inference. Interests passing through holdings outside the register also require inference.

A finding that depends on inference is a classification with an error rate, not a proof. Sparse relations can make an unusual but legitimate structure appear evasive. Such findings can support obligations to disclose, report, and review. Terminal refusal requires an authority to assert the determined fact and provide a means of contesting it.

Why this matters now

Aggregate violations have been a concern since the Bank Secrecy Act. Delegated execution and cross-jurisdictional structures make missed aggregates more costly and leave less time for detection.

Programs with delegated authority can rebalance portfolios, sweep cash, and issue dividends faster than people can execute transactions. A person structuring deposits makes a few transactions over days. A program can compose thousands of individually lawful operations in minutes. Monitoring after settlement can therefore begin after the violating sequence is complete. Detection must occur in the write path to intervene before commitment.

An institution operating in twenty jurisdictions through subsidiaries, joint ventures, and special-purpose vehicles can have hundreds of typed ownership edges. Every acquisition changes composed quantities absent from individual filings. Denser graphs add paths, parallel holdings, and composed interests near thresholds. Detecting these aggregate facts is necessary for both evasive and innocent structures.

The checker therefore maintains its views at the write path and evaluates each proposed write before commitment. Jurisdictional parameters give the findings their legal context. Evidence that would otherwise arise in a later investigation can enter the admission decision, with terminal force reserved for facts asserted by an authority.