Cash-intensive business — a named higher-risk factor

“Cash-intensive business” is not a label a firm makes up for its own risk model. EU law writes it in as a higher-risk factor. Annex III to Regulation (EU) 2024/1624 (the AMLR) lists “businesses that are cash-intensive” among the customer risk factors that firms must take into account. Annex III is expressly non-exhaustive, so the list is a floor, not a checklist. The same Regulation also sets a Union-wide cash-payment ceiling of €10,000 in Article 80. It carves deposits at payment service providers out of that ceiling, but pairs the carve-out with an FIU reporting duty. The AMLR applies from 10 July 2027. Payment and e-money institutions building their risk models now should design for both parts.

1. Where it sits in Annex III

Annex III is referred to in Article 20. Article 34(3) requires firms, when assessing a relationship or occasional transaction, to take into account at least the Annex III factors, AMLA guidelines, FIU notifications and the findings of the business-wide risk assessment. Cash intensity is point (1)(e). It appears alongside other customer and product factors that often come with it, and they are more useful read together than alone:

Annex III is not new. Directive (EU) 2015/849 already listed cash-intensive businesses as a higher-risk customer factor, and national AML laws transposed that list. What changes with the AMLR is that the list sits in a directly applicable regulation. From July 2027, the same text will apply in every member state.

2. What the factor changes in due diligence

Cash intensity is a factor, not a classification. Its effect comes through three provisions:

• Article 20(1)(e) and (f). CDD includes understanding the nature of the customer’s business. Ongoing monitoring must check that transactions are consistent with what you know of the customer, including the source of funds where necessary. For a cash business, the expected cash share of turnover is part of the customer profile.
• Article 34(2). For every transaction that is complex, unusually large, conducted in an unusual pattern, or has no apparent economic or lawful purpose, examine the origin and destination of the funds and the purpose. You need a baseline to spot an unusual pattern in a cash business, so record one at onboarding.
• Article 34(4). Where the overall risk is higher, apply enhanced measures in proportion to it. Examples are more information on source of funds, reasons for transactions and their consistency with the relationship, senior-management approval, and enhanced monitoring with more frequent controls.

In practice, record three things at onboarding for a cash-intensive customer. First, the expected cash share of turnover. Second, the expected deposit rhythm, such as daily takings or weekly lodgements. Third, the other channels the same business uses, such as card acquiring and incoming transfers. Monitoring then compares against the customer’s own profile, not a generic sector average.

3. The €10,000 cash payment limit, and the deposit carve-out

Article 80(1) sets the ceiling. Persons trading in goods or providing services may accept or make a cash payment only up to €10,000, or the equivalent in national or foreign currency. This applies whether the transaction is carried out in one operation or in several operations that appear to be linked.

• Member states may go lower under Article 80(2), after consulting the European Central Bank. They must notify the Commission within three months.
• Existing lower national limits continue under Article 80(3). Member states had to notify them to the Commission by 10 October 2024.
• Two carve-outs under Article 80(4). The limit does not apply to payments between natural persons not acting in a professional capacity. Nor does it apply to payments or deposits at the premises of credit institutions, e-money issuers and payment service providers.
• The carve-out comes with a reporting duty. The second subparagraph of Article 80(4) requires above-limit payments or deposits at those premises to be reported to the FIU, within the deadlines the FIU sets.

The last point is the one most summaries leave out. The carve-out does not mean a payments firm can take large cash deposits without scrutiny. It swaps the merchant’s hard ceiling for an FIU report. That report is a threshold-based report, separate from a suspicious transaction report, and CDD, monitoring and Annex III still apply alongside it. Watch each national FIU’s deadlines and format. Several home markets already run threshold-based cash reporting, such as Italy’s comunicazioni oggettive.

Several home markets already have national limits below €10,000, which Article 80(3) preserves:

Check each national text for exceptions before relying on the figure, such as non-resident individuals or tax payments. A merchant customer taking payments above these lower limits is a signal in its own right.

4. Three worked scenarios

Scenario one — cash rising while card stays flat. Facts: a customer runs one small food outlet. Its daily cash lodgements are in line with that trade. Over a quarter, cash deposits treble while card-acquiring volume through the same business stays flat. Rule: factor (1)(e) was present from the start and is unremarkable. What changes the picture is the gap between two channels for the same business. That is the “unusual circumstances” limb, (1)(a), and it triggers the Article 34(2) examination for a transaction pattern that is unusual. What the analyst does: examines the origin, destination and purpose of the funds, and asks the customer about any change in the business. The analyst does not escalate on volume alone. The key comparison is internal: cash against card for the same merchant over time. That controls for the type of trade with no external benchmark. Outcome: if there is no credible explanation, the analyst escalates for a suspicion assessment. If there is one, such as a catering contract paid in cash, the customer profile is updated and the evidence kept.

Scenario two — a large cash deposit at an agent location. Facts: an e-money institution accepts cash top-ups through a network of agents. A customer deposits €12,500 in one visit to fund an account used to pay a supplier. Rule: Article 80(4)(b) takes the deposit outside the €10,000 ceiling, because it is made at the premises of an e-money issuer. From the AMLR’s application date, the second subparagraph requires the deposit to be reported to the FIU within the FIU’s deadlines. The Article 34(2) examination of an unusually large transaction also applies. What the team does: it files the threshold report within the FIU’s timeframe. It records the stated purpose and the supplier relationship. It checks whether the supplier payment itself would breach a national cash limit if made in cash. Outcome: the threshold report is filed as a matter of course. A suspicious transaction report follows only if the examination turns up grounds for one.

Scenario three — split deposits below the ceiling. Facts: over four days, a customer makes three cash deposits of €3,500 each at different agents. The customer says they are for one used-car sale. Rule: Article 80(1) counts operations “which appear to be linked” together. The seller, trading in goods, would be accepting €10,500 for one sale. In a country with a lower national limit, the seller has already passed it. What the analyst does: treats the deposits as one linked transaction and reviews them as a structuring pattern. The analyst assesses whether the customer is acting in a professional capacity, because payments between private individuals fall outside Article 80. Outcome: for a trader, the split points to an attempt to get around the ceiling and is a candidate for a suspicious transaction report. For a genuine private sale, the file records why Article 80 did not apply.

5. Controls that make the factor usable

• Sector codes that separate cash trades. Map the activity codes you collect to a cash-intensity flag. Review the mapping when activity classifications change, such as the NACE Rev. 2.1 migration.
• Cash share, not cash amount. A monitoring rule on absolute cash volume flags every busy restaurant. A rule on cash as a share of total inflows, compared with the customer’s own baseline, flags the ones that changed.
• Linked-operation logic. Aggregate cash across agents, days and accounts held by the same customer. Article 80 looks at operations that appear to be linked, not at single receipts.
• A threshold-report pipeline. Build the Article 80(4) FIU report as a separate workflow from suspicious transaction reports, with each FIU’s deadlines, before July 2027.

FAQ

6. What to do, today

• Record a cash baseline at onboarding for every customer flagged as cash-intensive: cash share, rhythm and other channels.
• Switch monitoring from cash amount to cash share, measured against the customer’s own history.
• Aggregate linked cash operations across agents, days and accounts.
• Design the Article 80(4) FIU report now, per FIU, for application from 10 July 2027.
• Keep a table of national cash limits for the markets where your merchant customers operate.

Related: Structuring and smurfing · Enhanced due diligence · Italy’s objective cash communications