Most firms use automated rules and scenarios that produce alerts, which analysts then review and either close or escalate. Quality depends on good data, sensible thresholds, tuning to reduce false positives and regular testing of whether the system catches what it should.
Example
An alert fires because a student account that normally receives small transfers suddenly receives USD 40,000 from a trading company.
Where it appears in the exams
This topic is relevant for CAMS, CFCS.
Read more
Transaction monitoring explained: rules, alerts, tuning and what examiners test
Related terms
- Suspicious activity report (SAR / STR): A suspicious activity report, also called a suspicious transaction report, is a confidential report that a regulated firm files with the national financial intelligence unit when it suspects money laundering, terrorist financing or another crime.
- Structuring (smurfing): Structuring means breaking a transaction into smaller amounts to stay below a reporting or monitoring threshold. It is also called smurfing.
- Risk-based approach: The risk-based approach means a firm identifies and assesses its own money laundering and terrorist financing risks and applies controls in proportion to them, instead of treating every customer and transaction the same.
Source: FATF Recommendation 10 (ongoing monitoring); Wolfsberg Group guidance on monitoring. Independent explanation for study purposes, not legal advice.