Transaction monitoring

What it is

Transaction monitoring is the part of ongoing customer due diligence that looks at what customers actually do. Firms must scrutinise transactions to make sure they match what they know about the customer, its business, its risk profile and its source of funds.

Most banks use automated systems. Scenarios or rules flag patterns such as:

• many cash deposits just under a reporting threshold (structuring);
• funds received and sent out quickly to unrelated parties (pass-through or mule activity);
• flows to or from high-risk countries inconsistent with the stated business;
• sudden volume changes on a dormant account.

Many firms add statistical models or machine learning to score alerts or detect anomalies. Each alert goes to an analyst, who reviews the customer file, transaction history and open-source information, then closes it with a rationale or escalates it to an investigation.

Why it matters

Monitoring turns static KYC data into a live control. It is the main source of suspicious activity reports sent to financial intelligence units. Supervisors test whether scenarios match the firm’s risk assessment, whether thresholds are tuned and documented, and whether alerts are handled on time. Backlogs and untuned systems are frequent findings.

Worked example

Illustrative numbers.

A scenario flags any customer who receives more than 10 incoming payments and sends more than 90% of the amount out within 48 hours.

• Population: 500,000 accounts. Monthly alerts: 2,000.
• Level 1 review closes 1,700 as explained (for example a payroll agent).
• Level 2 investigation takes 300. Of these, 60 lead to a suspicious activity report.
• Conversion rate: 60 / 2,000 = 3%.

The team then tunes: raising the minimum count to 15 cuts alerts to 1,200 and loses 2 of the 60 reported cases in back-testing. Compliance must judge whether that loss is acceptable and record the decision.

Who uses it

• AML analysts review alerts and write case notes.
• Fraud analysts monitor similar data for unauthorised payments and scams, often on shared platforms.
• Financial crime investigators handle complex cases and prepare reports to the FIU.
• Data scientists build and validate detection and scoring models.
• Compliance officers own the scenario library, tuning governance and backlog reporting.
• Payments operations teams act on holds and requests for information.

Common confusions

• Transaction monitoring and sanctions screening differ. Screening checks names against lists before execution; monitoring looks at patterns, often after execution.
• An alert is not a suspicion. Most alerts are false positives closed with a reason.
• Fewer alerts is not automatically better. Thresholds must be justified with risk and testing evidence.
• Fraud monitoring protects the customer and the firm; AML monitoring protects the financial system. They overlap in data and tools.