Threshold and typology rules
Deterministic rules that flag wire, ACH, and cash activity matching known laundering typologies such as structuring and rapid layering.
Part of the recommended approachTechnique: Rules Engine
Threshold and typology rules are the first layer of transaction monitoring, checking each transaction or account pattern against logic compliance and regulators already agree constitutes suspicious activity.
They catch what an investigator would catch by hand: cash deposits structured just under the reporting threshold, a sudden burst of wire activity inconsistent with a customer’s stated business purpose, or a correspondent banking relationship routing volume through a high-risk corridor.
This is the standard starting point for every bank, because these rules give investigators and examiners an explainable, auditable floor that no model score alone provides.
They stay in place even after a triage score is added, since a typology-specific rule can say exactly why it fired in a way a blended model score cannot.
They are the wrong tool once launderers have adapted specifically to the known thresholds, because a rule only ever catches a pattern someone has already described and documented.
Strengths for this problem
- Catches known typologies immediately, such as a sequence of cash deposits each kept just under the reporting threshold.
- Every alert is explainable to an examiner in typology-specific terms, since it names the exact rule and the transactions that tripped it.
- Cheap to stand up against fields the core banking and payments systems already capture, such as amount, channel, and counterparty.
Limitations for this problem
- Only catches typologies compliance has already written down, such as structuring or a specific correspondent banking corridor.
- Fixed thresholds get learned and routed around: launderers structure deposits just under whatever limit the rule checks.
- Rule sets accumulate across product lines and channels and start firing on the same account for overlapping reasons, inflating alert volume without adding signal.
Data needed
- Transaction fields: amount, channel, counterparty, and timestamp for wire, ACH, and cash activity.
- Account opening date and KYC risk rating, to check activity against the customer's stated expected profile.
- Correspondent banking relationship data, to apply corridor-specific thresholds where cross-border wire risk is higher.
How it is measured
- Firing rate and precision per individual rule, not the rule set as a whole.
- Share of filed SARs attributable to each rule.
- Documented below-the-line testing results whenever a threshold is changed.
Pitfalls
- Letting thresholds go uncalibrated for years, so most alert volume comes from a handful of low-precision rules nobody has retired.
- Writing a rule around one publicised typology, which stops paying off within a review cycle once launderers adjust to it.
- Changing a threshold without documenting the below-the-line testing behind it, which an examiner can reasonably ask to see.
Human oversight
A Level 1 analyst reviews every alert before escalation or closure, and no rule files a SAR or restricts an account on its own. Threshold changes go through a documented governance process before they ship.