# Agent context: Transaction Monitoring

Source: https://aiplaybooks.app/industries/banking/financial-crime/transaction-monitoring
AI suitability: conditional

## Objective

Rank the alerts produced by transaction monitoring rules so a fixed investigator queue works the highest-value cases first, without automating any SAR filing or account restriction decision.

## Constraints

- Never file a SAR, restrict an account, or close a customer relationship automatically. The system ranks and surfaces evidence, a human investigator decides.
- Never treat a filed SAR as confirmed ground truth. It records a suspicion, not a proven crime, and must be labelled and weighted as such.
- Keep typology-specific explainability. A score that cannot say which typology drove it is not usable in a filing decision.
- Document below-the-line testing for any threshold or score change before it goes live, not after an examiner asks.
- Size the reranked queue to real investigator capacity, not to a target alert volume or recall figure.
- Keep sanctions and PEP screening out of scope. It is a separate control with separate data and tolerances.
- Log every score and every contributing feature for audit and examiner review.

## Inputs

- Wire, ACH, cash, and internal transfer records with counterparty, amount, channel, and timestamp.
- KYC and CDD records, including beneficial ownership, joined to the account as of alert time.
- Prior alert and case disposition history, including filed SARs with filing date, used as a weak label.
- Sanctions and PEP screening results, referenced for context only.
- Investigator capacity expressed as alerts per analyst per day.

## Outputs

- A reranked alert queue truncated at investigator capacity.
- A typology-specific explanation for each ranked alert, in language an investigator can cite in a filing memo.
- Peer-group outlier candidates routed to a discovery queue, separate from the referral queue.
- Network summaries for alerts flagged as possible layering or mule activity, listing the connected accounts.

## Success criteria

- Alert-to-SAR conversion improves at the same investigator capacity as the queue it replaced.
- Backlog age decreases and stays within a range the bank can defend to its supervisor.
- No measurable disparate impact in false positive or restriction rates across customer segments.
- Below-the-line testing is documented and available before any threshold change ships.
- Analysts can trace every ranked alert back to the specific typology and features that drove it.

## Known pitfalls

- Treating a filed SAR as ground truth for training, when it records suspicion, not confirmed criminal activity, and inherits every bias in who got investigated in the first place.
- Tuning a threshold down to hit a target alert volume without documenting the below-the-line testing that justifies it, which an examiner can reasonably ask to see.
- Building a single opaque score that blends typologies together, so that when an investigator, auditor, or examiner asks why an alert fired, nobody can answer in typology-specific terms.
- Letting model-driven de-risking recommendations become automatic account closures, which causes real harm to legitimate customers and creates fair-banking exposure.
- Ignoring that sanctions and PEP screening is a different control with different data and different tolerances, and trying to fold it into the same model.

## When not to use AI here

- The bank cannot yet produce a documented, auditable rationale for any threshold or score influencing a filing decision.
- KYC and beneficial ownership data is too incomplete to join to an alert with any confidence.
- Investigator disposition data has not been captured consistently enough to know which alerts were actually worked and how.
- The existing rule set has not been tuned or retired in years, since that unglamorous work is cheaper than a model and, in this playbook's judgement, worth doing first.

## Candidate approaches

- Threshold and typology rules (primary): Deterministic rules that flag wire, ACH, and cash activity matching known laundering typologies such as structuring and rapid layering.
- Alert triage scoring (primary): A model trained on investigator disposition history that reranks the alerts typology rules already produced, so a fixed investigator queue works the highest-value cases first.
- Peer group behaviour outliers (discovery): Unsupervised scoring that compares an account's activity against its peer segment to surface emerging laundering patterns before any rule or label exists for them.
- Network layering detection (supporting): Graph analysis linking accounts through shared counterparties and rapid pass-through transfers to expose layering chains and money mule networks.

## Human oversight

A trained investigator reviews every alert and makes every SAR filing decision. No score files a report, restricts an account, or closes a relationship on its own, and any de-risking action goes through a separate, documented escalation that a compliance officer signs off on.

## Sources

- [How Machine Learning Can Help Fight Money Laundering](https://www.capitalone.com/tech/machine-learning/how-machine-learning-can-help-fight-money-laundering/), Capital One Tech, 2021, practitioner
- [Transaction monitoring in anti-money laundering: A qualitative analysis and points of view from industry](https://doi.org/10.1016/j.future.2024.05.027), Future Generation Computer Systems, 2024, research
- [Detecting money laundering transactions with machine learning](https://doi.org/10.1108/jmlc-07-2019-0055), Journal of Money Laundering Control, 2020, research
- [Machine Learning in Transaction Monitoring: The Prospect of xAI](https://arxiv.org/abs/2210.07648), Hawaii International Conference on System Sciences, 2023, research
- [Joint Statement on Innovative Efforts to Combat Money Laundering and Terrorist Financing](https://www.fincen.gov/sites/default/files/2018-12/Joint%20Statement%20on%20Innovation%20Statement%20%28Final%2011-30-18%29_508.pdf), Federal Reserve, FDIC, FinCEN, NCUA, and OCC, 2018, regulation
- [SR 26-2: Revised Guidance on Model Risk Management](https://www.federalreserve.gov/supervisionreg/srletters/SR2602.pdf), Board of Governors of the Federal Reserve System, 2026, regulation