Transaction Monitoring Explained
Transaction monitoring is how a regulated firm spots activity that doesn’t fit what it knows about a customer. It is a legal requirement under the Money Laundering Regulations, a central control in the FCA’s view of financial crime systems, and, for payments, e-money and cryptoasset firms in particular, one of the biggest operational workloads in the business. Done well, it turns customer and transaction data into a manageable flow of meaningful alerts. Done badly, it produces either thousands of false positives or silence where there should be alarms. This guide explains the obligation, how monitoring works in practice, and who should run and oversee it.
The Legal Obligation
Regulation 28(11) of the Money Laundering Regulations 2017 requires firms to conduct ongoing monitoring of a business relationship. That includes scrutinising transactions undertaken throughout the relationship, including the source of funds where necessary, to make sure they are consistent with the firm’s knowledge of the customer, their business and risk profile. It also includes keeping customer due diligence documents and information up to date.
The regulation is risk-based: the extent of monitoring should reflect the risk the customer presents. Higher-risk customers, including those subject to enhanced due diligence, need enhanced ongoing monitoring. The FCA’s Financial Crime Guide sets out what it regards as good and poor practice, and the JMLSG guidance covers monitoring in its general and sector-specific chapters. Our overview of the Money Laundering Regulations 2017 explains where monitoring fits in the wider framework.
How Monitoring Works
Most firms monitor using a combination of automated rules and human review. The basic flow is:
- Data. Customer information from onboarding and transaction data from the firm’s systems feed the monitoring tool.
- Rules and scenarios. The tool applies scenarios designed to detect patterns associated with money laundering, terrorist financing, fraud or sanctions evasion.
- Alerts. Activity that meets a scenario generates an alert.
- Review. Analysts review alerts, gather context, and either close them with a documented rationale or escalate them.
- Investigation. Escalated cases are investigated in more depth.
- Reporting. Where there is knowledge or suspicion of money laundering or terrorist financing, staff make an internal report to the nominated officer, who decides whether to submit a suspicious activity report. Our guide to suspicious activity reports and the nominated officer covers that stage.
- Feedback. Outcomes feed back into scenario tuning, the customer’s risk rating and the firm’s risk assessment.
Designing Scenarios
Scenarios should flow from the firm’s business-wide risk assessment. If the assessment identifies a particular risk, there should be a monitoring scenario, or another control, that addresses it. Common scenario types include:
| Scenario type | What it looks for |
|---|---|
| Thresholds | Single or cumulative transactions above a set value |
| Velocity | Unusually rapid movement of funds in and out |
| Profile deviation | Activity inconsistent with the customer’s expected behaviour or stated business |
| Structuring | Transactions apparently split to stay below thresholds |
| Geography | Payments to or from higher-risk jurisdictions |
| Dormancy | Sudden activity on a previously dormant account |
| Network | Many customers paying the same beneficiary, or shared devices and details, often indicating mule activity |
| Round-tripping | Funds moving out and returning through connected parties |
Off-the-shelf scenarios from vendors are a starting point, not a finished control. The firm should be able to explain why each scenario exists, what risk it addresses, and how its thresholds were set.
Tuning and False Positives
Every monitoring system produces false positives: alerts that turn out, on review, not to be suspicious. Some are inevitable. Too many swamp the team, create backlogs and bury the alerts that matter. Too few may mean scenarios are set so loosely that genuine suspicious activity passes unnoticed.
Tuning is the process of adjusting scenarios and thresholds to improve the balance. Good tuning is:
- data-driven, using alert outcomes and below-the-line testing to see what changes would catch or miss
- documented, with the rationale for each change recorded and approved
- regular, not just at implementation
- independent of pressure to cut workload at the expense of coverage
- reviewed by the MLRO or someone with appropriate authority
A firm whose scenarios haven’t been reviewed since the system went live is almost certainly monitoring a business that no longer exists.
Alert Handling and Backlogs
Alert review is where monitoring succeeds or fails in practice. Good alert handling means:
- clear guidance on what analysts should check and how to document their reasoning;
- service levels for reviewing alerts, set according to risk;
- escalation routes to more senior reviewers and the nominated officer;
- quality assurance, with a sample of closed alerts reviewed independently; and
- management information showing volumes, ageing, outcomes and quality results.
Backlogs are one of the most common findings in supervisory reviews of financial crime controls. An alert that waits weeks for review offers little protection, especially in fast-moving payments businesses. Persistent backlogs usually mean the team is under-resourced, the scenarios are badly tuned, or both. Our guide to sizing the financial crime team covers how to match resources to volumes.
Real-Time and Post-Event Monitoring
Monitoring can happen before a transaction is executed or after it. Real-time or pre-event monitoring can stop a suspicious payment before funds leave, which matters for fraud and sanctions, and for fast payments where funds can be moved on within minutes. Post-event monitoring looks back over transactions to identify patterns over time, which suits many money laundering typologies. Most firms with significant payment flows use both, and sanctions screening of payments is typically done in real time. Our guide to sanctions screening covers that side.
Monitoring and Fraud
Money laundering and fraud monitoring overlap heavily. Mule accounts receiving the proceeds of authorised push payment fraud are a money laundering risk for the receiving firm and a fraud risk for the sending firm. Many firms now run combined financial crime monitoring, using shared data and scenarios, with clear routing of cases to fraud or AML teams. Whatever the structure, ownership of each scenario and each case type should be clear.
Sector Specifics
Payments and e-money
High volumes and fast settlement make monitoring both essential and demanding. Mule detection, merchant monitoring for acquirers, and real-time fraud controls are priorities.
Cryptoassets
Crypto firms monitor both off-chain activity on their platform and on-chain activity, using blockchain analytics to assess the risk of wallets and the source of funds, and to detect exposure to mixers, darknet markets, scams or sanctioned addresses. Travel rule data adds another layer. Our guide to hiring a crypto MLRO covers the skills involved.
Wealth management and private banking
Volumes are lower but values are higher, so monitoring often relies more on relationship knowledge and periodic review than on high-volume automated alerts, with close attention to source of funds for large or unusual movements.
Lending and consumer credit
Monitoring focuses on repayment patterns, early settlement with unexplained funds and application fraud, alongside AML concerns.
Scenario: An e-money institution’s monitoring system generates around 4,000 alerts a month, more than 98 per cent of which are closed as false positives. Its five analysts are three weeks behind. A tuning review using a year of alert outcomes finds that two velocity scenarios, set at launch for a consumer product, generate most of the noise because the firm now serves small businesses with very different payment patterns. The firm segments its scenarios by customer type, raises thresholds for the business segment with documented rationale and below-the-line testing, and adds a network scenario for mule activity that the original set lacked. Alert volumes fall by more than half, the backlog clears within two months, and escalations to the MLRO rise because the remaining alerts are more meaningful.
Who Runs Monitoring, and Who Oversees It
In small firms, monitoring may be run by one or two analysts, with the MLRO reviewing escalations. In larger firms, there are monitoring teams with team leaders, a monitoring or financial crime operations lead, and separate quality assurance. A deputy MLRO often runs the day-to-day operation.
The MLRO, approved as SMF17 at firms within the SMCR, oversees the effectiveness of monitoring as part of their responsibility for the firm’s anti-money laundering systems and controls. They should receive regular management information on volumes, ageing, quality and outcomes, approve significant tuning changes, and report on monitoring effectiveness to the board, typically in the annual MLRO report.
Outsourcing Monitoring
Many firms use vendors for monitoring technology, and some outsource first-level alert review to specialist providers. That can work well, but the firm remains responsible for the effectiveness of its monitoring. It should understand and approve the scenarios, oversee the provider’s quality, retain the ability to escalate and decide, and make sure the nominated officer receives internal reports properly. Our guide to what you can and can’t outsource covers the principles.
Common Failings
- scenarios not linked to the business-wide risk assessment
- vendor default scenarios never reviewed or tuned
- incomplete data feeds, so some products or customers aren’t monitored
- persistent alert backlogs
- alerts closed without a documented rationale
- no quality assurance of closed alerts
- customer risk ratings not updated after monitoring findings
- little or no management information reaching the MLRO and board
MLRO and Financial Crime Recruitment
The people who make monitoring work. Every SMF search is led personally by Adrian Lawrence FCA
Financial Crime Team
Monitoring leads, deputies and heads.
→ Financial crime leadership → Deputy MLROsSizing the team →
MLRO
Oversight of monitoring.
→ SMF17 recruitment → Fractional MLROWhat is an MLRO? →
Interim Support
Backlogs and remediation.
→ Interim MLRO and compliance → Joint SMF16 and SMF17Staffing a remediation →
Related Guides
The wider AML framework.
→ Business-wide risk assessment → SARs and the nominated officerCDD and EDD explained →
Every SMF search is led personally by Adrian Lawrence FCA
Frequently Asked Questions
Is automated transaction monitoring a legal requirement?
The Regulations require ongoing monitoring, not a particular method. Small firms with low volumes may monitor manually, but most firms with meaningful transaction volumes need automated tools to do it effectively.
What is an acceptable false positive rate?
There is no set figure. High false positive rates are common, but the firm should be able to show it is managing them, tuning scenarios based on evidence, and not missing genuine risk.
How quickly should alerts be reviewed?
The firm should set service levels based on risk. Fast-moving businesses such as payments need much shorter review times than firms with slower, lower-volume activity.
Can we outsource alert review?
Yes, but the firm remains responsible for the outcome and must oversee the provider, approve scenarios and keep control of escalation and reporting decisions.
Who should approve changes to monitoring rules?
Significant changes should be approved by the MLRO or another appropriately senior person, with the rationale and testing documented.
About the Author
Adrian Lawrence FCA is the founder of SMF Capital. He is a Chartered Accountant and Fellow of the ICAEW, holds a practising certificate in his own name, and is a former listed-company Finance Director with a BSc from Queen Mary College, University of London. He founded FD Capital in 2018 and has since built a network of five specialist recruitment practices. He leads every SMF Capital search personally. View Adrian’s ICAEW profile.
Monitoring Under Pressure?
Tell us about your volumes, alerts and team. We’ll help you find the MLRO, monitoring lead or interim specialists to bring your transaction monitoring under control. We’ll come back to you the same working day.