Transaction Monitoring: Rules and Alerts

As of September 2026: The US AML program reform is a proposal, not a final rule. FinCEN issued a notice of proposed rulemaking on April 7, 2026 that would replace its July 3, 2024 proposal, shift supervisory focus from technical compliance to effectiveness, and steer bank resources toward higher-risk customers and activities. Public comments were due June 9, 2026. This page did not confirm a final rule as of September 2026, so existing monitoring expectations still apply. The German FIU figures are for 2022, as cited by the Wolfsberg Group, and are one country's experience rather than a global rate.

What is transaction monitoring?

Every bank is expected to notice when an account behaves oddly. Transaction monitoring is the system that does the noticing. It is software plus people: the software compares payments, deposits and transfers against what the bank knows about the customer, and analysts review what it flags.

The Wolfsberg Group, a body of large international banks, prefers a wider term: monitoring for suspicious activity. Transaction monitoring is one part. The rest includes the customer’s attributes and behaviour and ongoing customer due diligence. That matters because the yardstick is the customer’s own profile. Ten transfers of the same size are normal for one business and alarming for another.

In the US, the customer due diligence rule requires banks to run ongoing monitoring “to identify and report suspicious transactions.” Other countries impose the same duty through FATF standards.

How do rules and models differ?

Rules are explicit tests written from known red flags and typologies. Examples include several cash deposits that add up to more than a reporting threshold across days, funds that enter an account and leave almost at once, or payments to and from places the bank rates as high risk. Rules map neatly onto the patterns described in the technique pages, such as structuring and money mules. Their strength is that an examiner can read them and see exactly why an alert fired.

Models use statistics or machine learning to produce a risk score from many signals at once. According to the Wolfsberg Group, models are harder to manage than rules, because they are built to make predictions across large data sets covering many risks. Banks need to document them clearly and test them against real outcomes. Banks also use machine learning as a “booster” on top of rules, for example to add a second layer of name screening.

Both approaches share a blind spot: they see only what one bank sees. Activity spread across several institutions is far harder to spot from inside any one of them, which is why national reporting databases matter.

What happens after an alert?

An analyst reviews the alert against the customer’s profile and history. Most alerts are closed with a note explaining why the activity is normal. A smaller number are escalated to a case, which may end in a written narrative and a confidential suspicious activity report to the national financial intelligence unit.

Why is the false-positive problem so large?

Because the incentives point toward alerting. A bank that misses real laundering faces enforcement. A bank that raises too many alerts faces only cost. So systems tend to be tuned wide.

Sources for a hard number are thin. The “90 percent or more of alerts are false” line that circulates in the industry is not one this page could trace to a regulator or standard setter, so it is not repeated here. What the primary sources do say is more specific.

The Wolfsberg Group’s 2024 statement says the value from ever-rising report volumes is not “contributing proportionately” to effective outcomes. It describes banks keeping monitoring scenarios that produce little or no escalation, trying to leave no historical report behind, and gradually lowering the bar for filing. Defensive filing removes regulatory risk for the bank but is unlikely to give law enforcement anything useful. It also says the usual scorecards, such as alert volumes and alert-to-report ratios, measure quantity, not usefulness.

One national example, cited in that statement: Germany’s FIU reported that of 337,186 suspicious transaction reports in 2022, about 15 percent went on to law enforcement, and feedback showed 95 percent of the resulting cases were closed without prosecution.

How is the system changing?

Wolfsberg also asks banks to feed lessons back in. Information from case investigations and filed reports, including the narratives analysts write, can be used to refine detection, raise the risk score of suspicious entities and reveal relationships nobody had linked before. It adds that banks should define success by high-value outcomes, not just by the number of reports filed. A monitoring system is meant to learn from its own cases.

The direction is toward fewer, better alerts. The Wolfsberg Group urges banks to stop monitoring routines that never produce useful reports and to spend effort on observed risks. In the US, FinCEN’s April 2026 proposal would push supervision the same way: toward effectiveness, and toward higher-risk customers and activities instead of lower-risk ones. It is a proposal only.

How monitoring catches launderers

Monitoring works less as a tripwire than as a memory with a pattern detector. It rarely proves a crime by itself. What it does is create a dated trail: this account, this behaviour, this mismatch with the stated business. When an investigator later queries a name, that trail is already there, which is why reporting and monitoring are described as banking evidence for future cases. It also raises the cost of crude methods. Simple patterns get caught, which pushes laundering toward slower, more complicated routes that are harder to run.

For the overall picture of where this succeeds and where it fails, see why detection still fails.

First published September 21, 2026 · Last updated September 21, 2026 · Legal statuses current as of September 2026