Transaction Monitoring

Surfacing wire, ACH, and cash activity that looks like money laundering inside a much larger volume of ordinary payments, without burying investigators or the customers who depend on fast payments.

AI is suitable with conditions

The ranking problem is real: investigators have fixed capacity and the rules produce far more alerts than that capacity can absorb, which is exactly the shape a model handles well. It stays conditional rather than strong because the available label, a filed SAR, records an analyst's suspicion rather than a proven crime, and model risk guidance expects a model to be documented, validated, and monitored in proportion to how much it influences decisions such as a filing. US regulators said in 2018 that they welcome innovation such as artificial intelligence, and that piloting it, including in transaction monitoring, would not in itself draw supervisory criticism, so in this playbook's judgement the barrier is evidence rather than permission. Where label quality and explainability cannot be demonstrated, a tuned rule set with disciplined threshold governance is a better choice than a model nobody can explain.

Problem Statement

A small share of the payments moving through a bank are placing, layering, or integrating criminal proceeds.

Finding them is not the hard part, since many laundering typologies are documented and well understood.

The hard part is finding them inside an alert volume where rule-based monitoring is widely reported to produce a high rate of false positives that warrant no further action, without missing the minority that matters and without freezing out legitimate customers whose only crime is an irregular cash flow.

Business Context

Transaction monitoring is a ranking and triage problem constrained by a fixed number of investigator hours, not a yes-or-no classification problem.

A bank cannot investigate every alert to the same depth, so the practical question every day is which alerts, out of the queue the rules produced, get worked first and worked most thoroughly.

This framing matters because the metric that counts is not how many alerts a system generates.

It is how much investigator time goes to alerts that convert into a filed SAR, versus alerts that were never going to convert and consumed the hours that could have gone to one that would.

Why This Is Hard

The label problem here is subtle.

A filed SAR records that an investigator formed a suspicion, not that a crime was proven, and the bank rarely learns whether that suspicion was correct.

Training or evaluating a model as if a SAR were confirmed ground truth bakes in every bias present in who got investigated and who got the benefit of the doubt.

Typologies also do not sit still.

Structuring just under a reporting threshold, layering through a chain of rapid pass-through accounts, and money mule networks recruited to receive and forward funds all evolve as launderers learn what gets flagged.

On top of that, supervisory guidance on model risk, such as the US agencies’ revised guidance of 2026, expects documentation, validation, and monitoring proportionate to how much a model influences a decision.

That guidance is not an enforceable rule, but investigators and auditors still need to see why an alert was ranked where it was, which rules out any approach that cannot explain itself in a typology’s own terms.

How The Solutions Fit Together

Threshold and typology rules encode what the bank and its regulators already agree constitutes suspicious activity, and they remain the explainable floor even after other methods are added.

Alert triage scoring reranks the alerts those rules already produced, so the highest-value cases reach an investigator first instead of being worked in arrival order.

Peer-group behaviour analysis supplies discovery, surfacing accounts that deviate from what is normal for their segment before any rule or label exists for the pattern.

Network and layering detection changes the unit of review from the single transaction to the chain of accounts behind it, which is how a mule network or a layering scheme becomes visible when each individual transfer looks unremarkable.

None of these methods files a report or closes an account.

Each one changes what an investigator sees first and what evidence is sitting in front of them when they see it.

Implementation Considerations

Start by tuning and retiring rules that have not been touched in years, since that is cheaper than any model and, in this playbook’s judgement, worth doing first.

Fix outcome and disposition recording next, because every scoring approach depends on knowing which alerts were actually worked and how they were resolved, not just which ones were filed.

Introduce a triage score as a reranking of the existing alert queue, never as a parallel queue investigators also have to check.

Document the below-the-line testing behind every threshold change before it goes live, because it is far harder to reconstruct after the fact if an examiner asks for it.

Size everything to the investigator capacity that actually exists, not to a target alert volume chosen for its own sake.

ROI Considerations

The return comes from three places.

Investigator hours redirected from alerts that were never going to convert to ones that do, backlog risk reduced enough that queue age no longer needs explaining to a supervisor, and fewer legitimate customers pushed into unnecessary friction or account restriction.

The third is easy to underweight, but a bank that de-risks aggressively loses the deposit relationships and payment volume that make banking those customers worthwhile in the first place.

Security, Privacy, and Regulation

Transaction and KYC data are among the most sensitive records a bank holds, and access should be limited to the compliance and investigation functions that need it.

Every score that influences a SAR filing or an account action should be explainable to an investigator and an examiner in terms specific to the typology it relates to, not as an opaque blended number.

Sanctions and PEP screening are a separate regulatory control with their own data and tolerances, and should stay out of the transaction monitoring model rather than being folded in.

Check alert and outcome rates across customer segments on a recurring cycle, because a monitoring program that is disproportionately suspicious of certain business types or geographies is a fair-banking and reputational problem before it is a technical one.

Symptoms

Alert queues run weeks behind, and the backlog itself becomes something the bank has to explain to its supervisor.
Investigators close the large majority of alerts with no further action, which practitioners and researchers attribute to the high false positive rate of rule-based monitoring.
The same rule fires on the same low-risk correspondent relationship every cycle with no new information in it.
SARs get filed close to the regulatory deadline because investigators are working the queue in arrival order, not risk order.
Genuine customers, particularly small businesses with irregular cash flow, get their accounts restricted or closed with little explanation.

Root causes

Rule thresholds were calibrated years ago against a customer base and payment mix that has since shifted.
Structuring, layering, and mule-network typologies are written as separate rules that overlap and re-alert on the same underlying account.
Alert volume is sized to what the rules produce, not to the analyst headcount actually available to work it.
Outcome labels are weak: a filed SAR records a suspicion an analyst formed, not a confirmed crime, and the bank rarely learns whether that suspicion was later confirmed.
KYC and beneficial ownership data used to assess a customer's risk profile is incomplete or stale at the point an alert needs it.

Business impact

Analyst hours consumed by alerts that are closed with no further action, which is a large direct cost of any monitoring programme.
Regulatory exposure when alert backlogs grow, since an unworked alert queue is hard to defend to a supervisor.
Remediation and look-back reviews after a missed typology, which are far more expensive than the monitoring that would have caught it.
Harm to legitimate customers when accounts are frozen or exited on weak signals, which carries conduct risk as well as lost revenue.
Growth constrained by monitoring capacity, because new products and corridors add alert volume before they add margin.

Traditional approaches

Fixed-threshold rules keyed to transaction amount, velocity, and known typologies such as structuring just under the reporting threshold.
Manual list-based screening of counterparties against internally maintained watchlists.
Periodic look-back reviews of a customer segment after a typology becomes publicly known.
Escalation of every alert above a fixed score to a Level 1 analyst queue worked in arrival order.

Solution approaches

Each of these is written for this problem specifically, not borrowed from a generic catalogue.

Recommendation

Keep typology rules as the explainable floor, add a supervised score that reranks the alerts those rules produce so investigator hours go to the highest-value cases first, use peer-group anomaly detection as a discovery feed rather than a referral source, and reserve graph analysis for the alerts that need it, meaning suspected layering or mule networks. Every SAR filing decision and every account restriction stays with a human investigator.

Data requirements

Transaction records high sensitivity: Wire, ACH, cash deposit and withdrawal, and internal transfer records, with counterparty, amount, channel, and timestamp.
KYC and CDD records high sensitivity: Customer due diligence file including stated business purpose, expected activity, and beneficial ownership, joined to the account at alert time.
SAR and case history high sensitivity: Prior alerts, investigator disposition, and filed SARs with filing date, treated as a weak and biased label rather than ground truth.
Sanctions and PEP screening results high sensitivity: Screening hits and resolutions from the separate sanctions and PEP screening process, referenced for context but not re-run here.
Peer group and segment definitions medium sensitivity: Customer segmentation used to define what normal activity looks like for a given business type, geography, and account tenure.

Evaluation metrics

Alert-to-SAR conversion rate at the investigator capacity actually available, not at an arbitrary top percentile.
Analyst hours spent per filed SAR, tracked against the queue the new approach replaced.
Backlog age, since an aging queue is itself a regulatory exposure independent of what is in it.
False positive rate by customer segment, checked for disparate impact on segments such as money service businesses or immigrant-owned small businesses.
Below-the-line testing results, meaning the rate at which alerts the system would have suppressed turn out, on sampled manual review, to have merited a SAR.

Human oversight

A trained investigator reviews every alert and makes every SAR filing decision. No score files a report, restricts an account, or closes a relationship on its own, and any de-risking action goes through a separate, documented escalation that a compliance officer signs off on.

Common pitfalls

Treating a filed SAR as ground truth for training, when it records suspicion, not confirmed criminal activity, and inherits every bias in who got investigated in the first place.
Tuning a threshold down to hit a target alert volume without documenting the below-the-line testing that justifies it, which an examiner can reasonably ask to see.
Building a single opaque score that blends typologies together, so that when an investigator, auditor, or examiner asks why an alert fired, nobody can answer in typology-specific terms.
Letting model-driven de-risking recommendations become automatic account closures, which causes real harm to legitimate customers and creates fair-banking exposure.
Ignoring that sanctions and PEP screening is a different control with different data and different tolerances, and trying to fold it into the same model.

When not to use AI

The bank cannot yet produce a documented, auditable rationale for any threshold or score influencing a filing decision.
KYC and beneficial ownership data is too incomplete to join to an alert with any confidence.
Investigator disposition data has not been captured consistently enough to know which alerts were actually worked and how.
The existing rule set has not been tuned or retired in years, since that unglamorous work is cheaper than a model and, in this playbook's judgement, worth doing first.

Sources

Agent context

A distilled brief for an AI agent or an engineer scoping this work. It carries the constraints and pitfalls that change an implementation decision, not the whole page.

Get the agent context as Markdown

Objective

Rank the alerts produced by transaction monitoring rules so a fixed investigator queue works the highest-value cases first, without automating any SAR filing or account restriction decision.

Constraints

Never file a SAR, restrict an account, or close a customer relationship automatically. The system ranks and surfaces evidence, a human investigator decides.
Never treat a filed SAR as confirmed ground truth. It records a suspicion, not a proven crime, and must be labelled and weighted as such.
Keep typology-specific explainability. A score that cannot say which typology drove it is not usable in a filing decision.
Document below-the-line testing for any threshold or score change before it goes live, not after an examiner asks.
Size the reranked queue to real investigator capacity, not to a target alert volume or recall figure.
Keep sanctions and PEP screening out of scope. It is a separate control with separate data and tolerances.
Log every score and every contributing feature for audit and examiner review.

Inputs

Wire, ACH, cash, and internal transfer records with counterparty, amount, channel, and timestamp.
KYC and CDD records, including beneficial ownership, joined to the account as of alert time.
Prior alert and case disposition history, including filed SARs with filing date, used as a weak label.
Sanctions and PEP screening results, referenced for context only.
Investigator capacity expressed as alerts per analyst per day.

Outputs

A reranked alert queue truncated at investigator capacity.
A typology-specific explanation for each ranked alert, in language an investigator can cite in a filing memo.
Peer-group outlier candidates routed to a discovery queue, separate from the referral queue.
Network summaries for alerts flagged as possible layering or mule activity, listing the connected accounts.

Success criteria

Alert-to-SAR conversion improves at the same investigator capacity as the queue it replaced.
Backlog age decreases and stays within a range the bank can defend to its supervisor.
No measurable disparate impact in false positive or restriction rates across customer segments.
Below-the-line testing is documented and available before any threshold change ships.
Analysts can trace every ranked alert back to the specific typology and features that drove it.

Last updated 2026-09-07