Transaction Monitoring and Detection Models

Introduction and context

Transaction monitoring is the post-onboarding process through which a financial institution examines customer activity, identifies behaviour inconsistent with the customer’s known profile, and escalates plausible money-laundering, terrorist-financing, proliferation-financing, fraud, sanctions-evasion, or related financial-crime concerns. It is a central control within an effective anti-money-laundering and counter-terrorist-financing framework, but it is not synonymous with sanctions screening, customer due diligence, or transaction reporting.

A mature monitoring programme does not attempt to identify a single “suspicious transaction.” It evaluates patterns across time, products, channels, geographies, counterparties and related accounts. It also recognises that legitimate customers may generate unusual activity and that criminal activity may be structured to remain individually unremarkable. The central managerial problem is therefore one of risk-based signal detection under uncertainty: the institution must detect material risk while controlling false positives, operational cost, customer friction and discriminatory outcomes.

Monitoring should be aligned with the institution’s enterprise-wide risk assessment, customer risk-rating methodology, products, delivery channels, jurisdictions and legal obligations. Rules and models are aids to professional judgement; they do not replace investigation, contextual analysis or accountable governance.

Learning objectives

By the end of this chapter, the reader should be able to:

1. Distinguish transaction monitoring from related AML controls and explain its risk-based purpose.
2. Design rules, scenarios and thresholds for retail, corporate, correspondent, payment and trade-finance activity.
3. Apply peer-group analysis and behavioural indicators to reduce reliance on crude absolute thresholds.
4. Evaluate alert-quality metrics, model performance and investigator capacity.
5. Design governance arrangements for model validation, tuning, explainability, data quality and escalation.
6. Critically assess the limitations and ethical risks of automated detection, including artificial-intelligence applications.

1. Conceptual foundations

1.1 What is being detected?

Money laundering is commonly analysed through three overlapping processes: placement, layering and integration. Transaction monitoring is most useful during layering and integration, although it may identify placement indicators such as rapid cash deposits. Terrorist-financing patterns may involve low-value transactions and therefore cannot be detected solely through high-value thresholds. Proliferation-financing and sanctions-evasion risks may appear through trade documentation, routing, ownership structures or unusual counterparties rather than transaction size.

A monitoring system generally performs five functions:

1. Data acquisition: collecting transactions, customer attributes, account relationships, counterparty information and external risk data.
2. Normalisation and enrichment: standardising currencies, dates, identifiers, locations and beneficial-owner relationships.
3. Detection: applying rules, scenarios, statistical methods, networks or machine-learning models.
4. Alert management: prioritising, assigning and investigating alerts.
5. Feedback and reporting: recording dispositions, filing required reports where appropriate, tuning detection and measuring performance.

Monitoring is different from:

These controls should exchange information, but they should not be collapsed into one undifferentiated alert process.

1.2 Risk-based monitoring

A risk-based programme allocates monitoring intensity according to the likelihood and impact of financial-crime risk. Relevant dimensions include customer type, ownership complexity, occupation or industry, geography, products, delivery channels, transaction velocity, counterparties and adverse information. Risk-based does not mean “high-risk customers are monitored and low-risk customers are ignored.” It means that the nature, frequency, depth and sensitivity of monitoring are proportionate to exposure.

An institution may use a conceptual risk score such as:

Here, R_i is the risk score for customer or relationship i; C_i, P_i, G_i, B_i and N_i represent customer, product, geographic, behavioural and network-risk components; and w_C, w_P, w_G, w_B and w_N are documented weights. The score is not a universal legal formula. It is applicable only when variables are defined consistently, weights are justified, data quality is adequate, and the institution validates that the score supports sound decisions. Weighted addition assumes that the dimensions can reasonably be combined; interaction effects may require a different model.

Risk scores should not automatically determine suspicion. They should influence monitoring intensity, scenario selection, alert priority and review frequency.

2. Detection architecture

2.1 Rules, scenarios and typologies

A rule is a logical condition, such as “cash deposits exceed a specified amount within a rolling period.” A scenario combines several conditions to represent a typology, such as rapid movement of funds through newly opened accounts, multiple unrelated senders, and transfers to a high-risk jurisdiction. A typology is a documented pattern associated with a method of financial crime.

A useful scenario specification contains:

• risk hypothesis and typology;
• customer and product scope;
• event definition and observation window;
• variables and data sources;
• threshold logic;
• exclusions and legitimate-use explanations;
• alert severity and priority;
• investigation questions;
• escalation and reporting requirements;
• performance measures and review date.

The risk hypothesis should be falsifiable. For example: “A personal account receiving funds from many unrelated parties and transferring most funds onward within 48 hours may be functioning as a pass-through account.” This is superior to “unusual activity,” which lacks an operational definition.

2.2 Threshold design

Thresholds may be absolute, relative, behavioural or network-based.

• Absolute: a transaction exceeds a fixed monetary or count limit.
• Relative: activity is large compared with the customer’s historical baseline.
• Behavioural: activity changes materially from established behaviour.
• Network-based: activity is unusual within a connected group of accounts or counterparties.

A single absolute threshold is easy to administer but often produces predictable avoidance behaviour and excessive alerts. Thresholds should be segmented by product, customer type, currency, geography, channel and risk tier. Where law specifies reporting thresholds, a monitoring threshold may need to be lower to allow investigation and avoid treating the statutory limit as a safe harbour.

Rolling windows must be carefully defined. A 24-hour window may mean calendar day, previous 24 hours from event time, or institution-defined business day. Different definitions produce materially different results.

2.3 Velocity and aggregation

Common measures include transaction count, total value, cash proportion, inbound-to-outbound ratio, concentration and time to onward transfer. For a window containing transactions x₁, x₂, ..., x_n, total value is:

where x_j is the value of transaction j in a common currency and n is the number of included transactions. Currency conversion rates, timestamp boundaries and reversals must be specified. Aggregation is meaningful only when transactions belong to the same customer, relationship, account group or defined network.

A pass-through ratio can be expressed as:

where I is qualifying inbound value and O is qualifying outbound value during the same observation period. The ratio is descriptive, not conclusive: a legitimate payment intermediary may naturally have a high value, while a laundering account may have a low value if funds are retained or withdrawn as cash.

3. Behavioural and peer-group analysis

3.1 Customer baselines

A baseline describes expected activity for a customer or relationship. It may include typical monthly value, transaction count, counterparties, countries, channels, cash intensity, salary or revenue credits, and normal business cycles. Baselines must accommodate seasonality, growth, holidays, project finance and known changes in circumstance.

A simple relative-change measure is:

where x_t is current-period activity and μ_t−1 is the prior baseline mean. This measure is undefined when the baseline is zero and unstable when the baseline is very small; minimum-volume rules or alternative measures are then required. A large percentage increase from a very small base is not automatically suspicious.

3.2 Peer groups

Peer-group analysis compares a customer with reasonably similar customers rather than with the entire population. Useful grouping variables include legal form, industry, annual turnover, geography, product mix, account age and channel. Poorly designed peer groups create misleading comparisons: a cash-intensive retailer should not be compared with a software exporter.

A standardised score may be calculated as:

where x_i is the customer’s measure, μ_g is the peer-group mean, and σ_g is the peer-group standard deviation. This assumes a meaningful peer group and a sufficiently stable distribution. If the distribution is highly skewed, robust statistics such as the median and median absolute deviation may be preferable. A high z-score indicates relative unusualness, not criminality.

Peer analysis is particularly useful for corporate cash deposits, cross-border payments, trade-finance activity and merchant settlement flows. It can reduce false positives caused by large but legitimate businesses while highlighting a modest-sized customer whose activity is extreme for its sector.

3.3 Behavioural indicators

Indicators should be combined rather than interpreted in isolation. Examples include:

• sudden change in transaction volume, value or geography;
• use of products inconsistent with the stated business model;
• rapid movement through newly opened or dormant accounts;
• numerous unrelated counterparties with vague payment references;
• circular transfers or funds returning through linked entities;
• payments involving high-risk jurisdictions without a credible rationale;
• frequent cash deposits followed by international transfers;
• unusual use of personal accounts for commercial activity;
• fragmented transactions apparently designed to evade controls;
• trade payments inconsistent with goods, route, price or counterparties;
• unexplained third-party funding or changes in beneficial ownership.

Indicators must be interpreted with customer context. A university student receiving family support, a seasonal exporter, and a remittance business may each produce activity that appears unusual under a generic rule.

4. Segment-specific monitoring design

Retail banking

Retail scenarios may address cash structuring, rapid cash-in/cash-out, mule accounts, unusual remittances, dormant-account reactivation, third-party payments, funnel accounts and sudden international activity. Segmenting by age, occupation, income, account purpose and customer geography can improve relevance, but sensitive attributes require careful legal and ethical controls.

Monitoring should include linked accounts and devices where permitted, while avoiding the assumption that shared addresses or devices prove common control. Low-value activity deserves attention where velocity, dispersal or network structure is unusual.

Corporate banking

Corporate monitoring should incorporate expected turnover, industry operating cycle, beneficial ownership, payroll patterns, tax payments, suppliers, customers, trade corridors and relationship structure. Scenarios may target unexplained turnover spikes, pass-through flows, round-dollar payments, payments to unrelated industries, circular intra-group transfers and large payments inconsistent with invoices or contracts.

A corporate alert should be investigated against the business model. A construction company may have project-based spikes; a charity may receive international donations; a holding company may have few operating transactions but substantial intra-group movements.

Correspondent banking

Correspondent relationships require monitoring of nested activity, respondent-bank customer flows where information is available, unusual payment corridors, rapid movement through nostro and vostro accounts, high-risk sectors, sanctions-related indicators and unexplained spikes in payment traffic. The correspondent may not know the ultimate originator and beneficiary for every underlying transaction, creating material data and visibility limitations. Information-sharing arrangements, respondent due diligence and escalation protocols are therefore essential.

Payment institutions and remittance

Payment monitoring should examine sender and beneficiary networks, agent concentration, corridor behaviour, rapid account opening, repeated low-value transfers, common devices or identifiers, refunds, chargebacks and unusual cash-out patterns. Thresholds should reflect corridor norms and regulatory requirements. A remittance provider must distinguish legitimate diaspora and family-support activity from structuring or mule networks.

Trade finance

Trade-based money laundering can involve over- or under-invoicing, multiple invoicing, phantom shipments, misdescription of goods, unusual routes, inconsistent quantities, third-party payments, shell companies and complex transshipment. Monitoring should join transaction data with invoices, bills of lading, customs information, letters of credit, counterparties, vessels and beneficial owners.

No single price database proves mispricing. A price anomaly is a prompt for documentary and commercial investigation, taking account of quality, season, freight, insurance, volume and contractual terms. Trade-finance monitoring is strongest when transaction, logistics and open-source intelligence are integrated.

5. Model performance and alert operations

5.1 The alert funnel

A monitoring system converts a large population of transactions into a smaller population of alerts, cases and potentially reportable matters. Let:

• TP = true positives, alerts that identify material suspicious activity;
• FP = false positives, alerts not supported after investigation;
• FN = suspicious activity not detected by the system;
• TN = activity appropriately not alerted.

Two important measures are:

Precision measures the proportion of alerts that are useful; recall measures the proportion of relevant suspicious activity detected. In AML, TP and FN are imperfect because “true suspicion” is not fully observable. A filed report is not equivalent to proven criminal conduct, and a closed alert is not proof that no crime occurred. Metrics should therefore be interpreted alongside quality assurance, thematic reviews, law-enforcement feedback where available and risk coverage assessments.

5.2 Alert quality and capacity

Institutions should monitor alert volumes, ageing, investigator workload, escalation rates, reporting rates, repeat alerts, closure reasons, scenario contribution, data failures and customer-impact events. A high reporting rate may indicate effective targeting, but it may also reflect overly broad escalation. A low reporting rate may reflect good filtering or missed risk.

Threshold tuning should be evidence-based. Changes should be documented with the affected population, rationale, expected risk effect, testing results, approval and post-implementation review. Suppression lists require expiry dates, ownership and periodic challenge; permanent exclusions create blind spots.

5.3 Investigation quality

An investigator should establish:

1. what happened and over what period;
2. who sent, received, owned or controlled the funds;
3. whether activity matches the customer’s profile and stated purpose;
4. whether linked accounts, entities or counterparties alter the interpretation;
5. whether legitimate evidence explains the activity;
6. whether concerns meet the institution’s escalation and reporting standard;
7. what interim controls, if any, are lawful and proportionate.

Case narratives should distinguish facts, customer explanations, corroborated evidence, unresolved contradictions and professional judgement. “No explanation received” is not by itself proof of suspicious activity.

6. Advanced detection models

Rules remain valuable because they are transparent, auditable and easy to explain. Statistical anomaly detection can identify deviations without requiring a complete typology. Network analytics can reveal common ownership, circularity, shared identifiers and layering across accounts. Supervised machine learning may prioritise alerts using labelled historical outcomes, while unsupervised methods can identify clusters or outliers.

However, historical labels are noisy and institution-specific. A model trained on prior alerts may learn investigator habits, reporting practices or data gaps rather than criminal behaviour. Class imbalance is severe: suspicious cases are rare relative to legitimate transactions. Model outputs should therefore be treated as risk signals, not adjudications.

Useful safeguards include:

• clear purpose limitation and documented feature definitions;
• independent validation before deployment and after material change;
• out-of-time and out-of-sample testing;
• stability testing across customer segments and jurisdictions;
• explainable alert reasons available to investigators;
• human review and override controls;
• monitoring for drift in data, behaviour and typologies;
• access control, privacy protection and retention discipline;
• challenge testing for discriminatory or proxy effects.

Artificial intelligence can assist entity resolution, narrative summarisation, typology discovery and alert prioritisation. It should not autonomously file reports, terminate relationships or infer criminality without accountable human governance. Generative systems introduce risks of fabricated explanations, leakage of confidential information and untraceable decisions; controlled environments, validation and audit trails are necessary.

7. Governance, regulation and ethics

The board and senior management should approve the monitoring risk appetite, resources and reporting framework. A three-lines model is useful: operational compliance and investigations form the first line; financial-crime compliance and model-risk oversight form the second; internal audit provides independent assurance.

Governance should cover data lineage, scenario ownership, change control, validation, issue management, training, vendor oversight and regulatory examination readiness. Outsourcing technology does not outsource accountability.

Monitoring creates tension between privacy and prevention, efficiency and completeness, and secrecy obligations and customer fairness. Institutions should collect relevant data, restrict access, avoid unlawful profiling, document adverse decisions and provide appropriate review mechanisms. Confidentiality of suspicious-activity reporting must be preserved, while customers should not be treated as criminals merely because an alert was generated.

8. Illustrative case: a corporate pass-through network

Background

This fictional case concerns Meridian Bank, which monitors small and medium-sized enterprises. A newly incorporated trading company, Northbridge Supplies Ltd, states that it imports office equipment. Its expected monthly turnover is equivalent to 200,000 currency units, with suppliers in one neighbouring country.

Problem

Within three months, the company receives 2.4 million from 37 unrelated domestic businesses. It sends 91% onward within 24 to 72 hours, including 1.1 million to two companies in a jurisdiction not listed in its stated business plan. Several senders share phone numbers or directors with other accounts, and payment references are generic. The company also makes small cash withdrawals and has no payroll or ordinary operating expenses.

Analysis

The absolute value is notable, but the stronger indicators are the discrepancy with expected turnover, many unrelated originators, rapid onward movement, common identifiers and unexplained geography. The 91% pass-through ratio is calculated as:

This calculation is descriptive and does not establish laundering. Investigators obtain incorporation records, invoices, shipping documents, customer contracts, beneficial-owner information and explanations for the foreign payments. They compare counterparties with the bank’s network data and review whether goods actually moved.

Approach and solution

The case is escalated from a velocity scenario and a peer-group anomaly scenario. The bank links Northbridge to six other companies through shared directors, addresses and devices, but treats those links as investigative leads rather than conclusive proof. Documentary evidence is inconsistent: invoices describe high-value equipment, while available shipping records show no corresponding consignments. The customer’s explanation changes during review.

Compliance prepares a factual case narrative, considers applicable reporting obligations, preserves records, and refers the matter to senior financial-crime compliance. Any account restrictions are based on documented legal and risk considerations, not on the alert alone.

Outcome

For this illustrative case, the bank files the required report after reasonable investigation, reviews the linked network, and initiates a thematic review of newly incorporated importers. It also tunes the scenario to combine pass-through behaviour with expectation variance and network links, rather than lowering a single value threshold.

Learning points

1. Multiple moderate indicators may be more informative than one extreme transaction.
2. Peer and expectation analysis can identify risk without relying on arbitrary amounts.
3. Network links require corroboration and careful handling of innocent associations.
4. Trade documentation must be tested against independent logistics evidence.
5. Alert generation, suspicion formation and regulatory reporting are distinct decisions.

9. Best-practice design principles

An advanced monitoring programme should:

• begin with documented typologies and a risk assessment;
• use layered rules, behavioural analysis and network intelligence;
• segment thresholds by meaningful customer and product characteristics;
• maintain a reliable expected-activity profile;
• integrate customer, transaction, ownership and external data;
• measure both alert usefulness and residual risk;
• validate models and monitor drift;
• preserve investigator judgement and clear audit trails;
• conduct thematic reviews beyond individual alerts;
• test coverage for low-value, cross-border, trade and emerging risks;
• involve legal, privacy, data, technology, operations and business experts;
• review scenarios after regulatory changes, typology developments or control failures.

Chapter Summary

Transaction monitoring is a risk-based detection and investigation capability, not a mechanical search for large payments. Effective design combines typology-led rules, scenario logic, customer baselines, peer-group analysis, behavioural indicators and network relationships. Thresholds must be segmented, documented and tested; absolute values alone are vulnerable to evasion and false positives. Retail, corporate, correspondent, payment and trade-finance activities require different data, expectations and investigative questions.

Performance must be evaluated through alert quality, operational capacity, coverage and residual risk, recognising that true positives and false negatives are imperfectly observable. Advanced analytics and AI can improve prioritisation and discovery, but they require validation, explainability, privacy controls and accountable human oversight. Strong governance links data quality, model change, investigation standards, reporting obligations and ethical treatment of customers.

Key Terms

Transaction monitoring: Ongoing analysis of customer and transaction activity for financial-crime risk.

Scenario: A defined combination of conditions designed to represent a risk typology.

Threshold: A boundary that triggers review or changes monitoring treatment.

Typology: A recognised pattern or method associated with financial crime.

Expected activity: Documented prediction of a customer’s normal products, values, counterparties and behaviour.

Peer group: A set of reasonably comparable customers used for relative analysis.

Behavioural indicator: An observable activity feature that may signal unusual or risky conduct.

Velocity: The speed or frequency with which transactions occur.

Pass-through account: An account through which funds move rapidly with limited apparent economic purpose.

Structuring: Fragmenting activity to avoid detection or reporting controls.

Network analysis: Examination of relationships among accounts, people, entities and transactions.

False positive: An alert not supported as suspicious after investigation.

False negative: Relevant suspicious activity not detected by the system.

Precision: The proportion of alerts classified as useful or positive that are true positives.

Recall: The proportion of relevant positive activity detected by the system.

Model validation: Independent assessment of a model’s conceptual soundness, performance and limitations.

Model drift: Deterioration or change in model performance as data, behaviour or environments change.

Trade-based money laundering: Use of trade transactions or documentation to move or disguise illicit value.

Risk-based approach: Allocation of control intensity in proportion to assessed risk.

Alert disposition: The documented conclusion and action taken after investigation.

Review Questions

Short Answer Questions

1. How does transaction monitoring differ from customer due diligence and sanctions screening?
2. Why are customer baselines and peer groups useful in threshold design?
3. Define a scenario and identify four elements it should contain.
4. What is the difference between precision and recall?
5. Why should a high pass-through ratio not automatically be treated as proof of money laundering?

Long Answer Questions

1. Explain how a bank should design a risk-based monitoring framework covering retail, corporate and payment activities.
2. Critically evaluate the strengths and weaknesses of absolute, relative, behavioural and network-based thresholds.
3. Discuss the data, investigative and governance challenges of correspondent-banking monitoring.
4. Explain how statistical anomaly detection and machine learning can complement, but not replace, rules-based monitoring.
5. Analyse the ethical, privacy and accountability issues arising from automated transaction-monitoring systems.

Analytical / Application Questions

1. A small retailer’s monthly deposits rise from 10,000 to 80,000 currency units, but the business has entered its peak seasonal period. Design an investigation that distinguishes legitimate seasonality from suspicious activity.
2. A remittance customer sends 25 low-value payments to recipients sharing device identifiers and receiving funds in a high-risk corridor. Propose a scenario, relevant data, investigative questions and escalation criteria.
3. Design a trade-finance monitoring approach for a company whose invoices, shipping routes, counterparties and beneficial ownership are inconsistent. Explain how you would avoid treating a price anomaly alone as conclusive evidence.

Multiple Choice Questions with Answers

Question 1

Which statement best describes the purpose of transaction monitoring?

A. To prove that every alerted customer has committed a crime

B. To identify activity that may be inconsistent with a customer’s risk profile and merit investigation

C. To replace customer due diligence at onboarding

D. To prevent all transactions above a statutory reporting threshold

Correct Answer: B. To identify activity that may be inconsistent with a customer’s risk profile and merit investigation

Question 2

Which threshold type compares a customer’s activity with similar customers?

A. Absolute threshold

B. Calendar threshold

C. Peer-relative threshold

D. Sanctions threshold

Correct Answer: C. Peer-relative threshold

Question 3

In the pass-through ratio P = O ÷ I, what do O and I represent?

A. Outlier count and income

B. Outbound value and inbound value

C. Opening balance and interest

D. Originator count and issuer value

Correct Answer: B. Outbound value and inbound value

Question 4

A high z-score in peer-group analysis indicates that activity is:

A. Proven to be criminal

B. Relatively unusual within the selected peer group

C. Automatically reportable in every jurisdiction

D. Below the peer-group average

Correct Answer: B. Relatively unusual within the selected peer group

Question 5

Which is a significant limitation of historical machine-learning labels in AML monitoring?

A. They always contain too many true positives

B. They may reproduce past investigator or reporting biases

C. They cannot process numerical data

D. They eliminate the need for model validation

Correct Answer: B. They may reproduce past investigator or reporting biases

Question 6

If TP = 30 and FP = 70, what is precision?

A. 3%

B. 30%

C. 43%

D. 70%

Correct Answer: B. 30%

Question 7

Which activity is especially relevant to trade-based money-laundering monitoring?

A. Comparing shipping and invoice information for consistency

B. Checking only whether an account has a positive balance

C. Ignoring beneficial ownership because goods are physical

D. Using one universal price threshold for all commodities

Correct Answer: A. Comparing shipping and invoice information for consistency

Question 8

Why should a single absolute transaction threshold not be the sole monitoring method?

A. It makes all transactions illegal

B. It can generate false positives and can be evaded through structuring

C. It cannot be programmed into any system

D. It measures peer-group dispersion perfectly

Correct Answer: B. It can generate false positives and can be evaded through structuring

Question 9

Which governance practice is most appropriate after changing a detection scenario?

A. Delete the previous version and retain no rationale

B. Document the change, test its effect, approve it and conduct post-implementation review

C. Allow investigators to change it individually without oversight

D. Disable quality assurance to increase alert volume

Correct Answer: B. Document the change, test its effect, approve it and conduct post-implementation review

Question 10

Why is a high pass-through ratio not conclusive evidence of laundering?

A. Legitimate intermediaries may naturally move most funds onward

B. The ratio can only be calculated for cash transactions

C. Outbound transactions are never relevant to AML

D. A ratio above one is always required for suspicion

Correct Answer: A. Legitimate intermediaries may naturally move most funds onward