How it works

A monitoring system ingests transactions and customer data, applies detection logic (thresholds, velocity checks, pattern scenarios, peer-group comparisons or machine learning models), and raises alerts. Alerts are triaged, investigated and either closed with a rationale or escalated to a case and potentially a SAR. Monitoring can run in real time, before a payment settles, or in batches after the fact.

Requirements by jurisdiction

• US: The BSA requires institutions to identify and report suspicious activity, and the CDD Rule requires ongoing monitoring. The FFIEC manual expects filtering criteria and thresholds to be tailored to the bank's risk profile, documented, periodically tested, and independently validated, with changes approved by the BSA officer or senior management. FinCEN's April 2026 proposal would reinforce a risk-based, effectiveness-focused program standard but is not yet final.

• EU: AMLR Article 26 requires ongoing monitoring of business relationships, including scrutiny of transactions for consistency with the customer's profile, from 10 July 2027. AMLA, which will directly supervise selected cross-border institutions from 2028, will issue technical standards in this area.

• UK: Regulation 28(11) of the Money Laundering Regulations 2017 requires ongoing monitoring, including scrutiny of transactions and keeping CDD information up to date.

Common challenges

Rule-based systems tend to produce high false-positive rates and miss new typologies. Poor data quality, siloed customer data and untuned thresholds compound the problem. A common example in the FFIEC manual: a cash rule that alerts only above $10,000 misses structuring just below the CTR threshold. Real-time payment rails leave little time for review.

How teams handle it in practice

Teams tie scenarios to their risk assessment, test thresholds below and above the line, and track alert-to-SAR conversion to tune rules. Many combine rules with behavioral or machine learning models, which FATF notes can reduce false positives and surface complex cases. Model governance and documentation support examiner review. Compliance platforms like Corsa can run real-time rules and AI-assisted investigation in one workflow.