Review them at least quarterly, and sooner when a regulation changes, a new typology appears or your customer base shifts.
Transaction monitoring systems in AML: How they work and what they catch
What an AML transaction monitoring system does, how it differs from fraud detection and screening, which features matter and why false positives pile up.
By 8 mins readPublished Updated On this page
- What a transaction monitoring system is
- How a transaction monitoring system works
- Anti-fraud versus AML transaction monitoring
- What AML transaction monitoring tools detect
- Transaction screening versus transaction monitoring
- Why transaction monitoring matters
- Who needs a transaction monitoring system
- Features that matter in an AML transaction monitoring system
- Setting up the AML transaction monitoring process
- Where AML transaction monitoring goes wrong
- Where to start
- Frequently asked questions
The United Nations Office on Drugs and Crime (UNODC) estimates that between $800 billion and $2 trillion is laundered each year, around 2% to 5% of global GDP. Banks, fintechs and payment firms have to find that money inside billions of ordinary transactions without stopping the ordinary ones.
That job falls to the AML transaction monitoring system.
It reads transactions as they happen, scores them against what is normal for the customer, and raises the ones a human should look at. Done well, it finds structuring and layering patterns that no analyst would spot by reading statements.
This guide explains what the system is, how it works, how it differs from fraud detection and sanctions screening, and where it goes wrong.
What a transaction monitoring system is
In anti-money laundering (AML), a transaction monitoring system is software that reviews financial transactions in real time or close to it. It looks for patterns that point to money laundering, fraud or other financial crime.
The system combines rules, behavioural analytics and machine learning. It takes in deposits, withdrawals and transfers, compares each one against the customer's history and peer group, and marks the ones that do not fit. Regulated firms run it because the AML rules require it, and because regulators ask to see how it is tuned.
How a transaction monitoring system works
Four stages, repeated for as long as the firm holds accounts:
1. Risk assessment
Everything starts with the firm's own risk assessment: which customers, products, channels and countries carry the most laundering risk.
- From that assessment the firm sets its risk appetite, the level of transaction risk it will accept before it declines or exits a customer.
- It then writes the AML policies and procedures that follow: onboarding checks, activity enquiries, monitoring controls and periodic reviews.
2. Defining suspicious activity
The firm decides what counts as suspicious for each customer type: large transfers, unusual deposit patterns, activity that does not match the stated business. Those definitions become the conditions the system watches for.
The system pulls data from internal and external sources: deposits, withdrawals, transfers, customer records and third-party lists.
It assigns each customer a risk score from their profile, transaction history, location and line of business. Politically exposed persons (PEPs), officials and cash-heavy businesses sit in the high-risk tier and get closer monitoring. Past transactions set the baseline for what is normal for that account.
3. Monitoring and investigating
With the definitions in place, the firm writes rules. A common one watches for repeated deposits just under the reporting threshold, the classic sign of structuring.
When a rule fires, an analyst opens a case. If the investigation supports a laundering suspicion, the firm files a suspicious activity report (SAR) with FinCEN or the equivalent regulator.
4. Maintenance
Rules and thresholds drift out of date as regulations change and criminals adapt. Review the policies on a schedule, retune the rules against recent cases, and keep training the operators at every level so compliance gaps do not open up unnoticed.
Anti-fraud versus AML transaction monitoring
Both protect the institution and its customers, but they look for different things.
1. Fraud detection systems
Fraud detection stops harm to the institution or the customer: unauthorised transactions, account takeovers, identity theft. It decides in milliseconds, per event, usually before the money moves.
2. AML transaction monitoring systems
AML monitoring looks for illegally obtained funds moving through legitimate channels. It exists to meet regulatory requirements and works over longer windows, catching slow, multi-account patterns that a per-transaction fraud engine never sees.
What AML transaction monitoring tools detect
The same engine covers several categories of financial crime:
Financial fraud
Credit card fraud, cheque fraud and wire fraud leave unusual transaction patterns, and AML systems flag those alongside laundering signals.
Money laundering
The main target. The system looks for layered transaction chains, unexplained large deposits and frequent transfers that suggest someone is cleaning dirty money.
Identity theft
Transaction and account patterns show when a stolen identity is being used to move money or open new accounts.
Terrorist financing
Transfers to high-risk regions, odd patterns of small donations, and any link to listed organisations or individuals.
Drug trafficking
Large cash deposits, complex layering of funds and transactions with known high-risk entities.
Bribery and corruption
Unusual payments to government officials, inflated invoices and transactions involving PEPs.
Transaction screening versus transaction monitoring
The two terms get used as if they were the same thing. They are not.
Transaction screening checks a single transaction against sanctions lists, PEP lists and similar, in real time, before the payment goes through.
Transaction monitoring runs over time. It compares current activity against historical behaviour to find patterns that no single transaction reveals.
Why transaction monitoring matters
Transaction monitoring is the part of an AML programme that produces the evidence. Six things depend on it:
1. Finding what people miss
The system reads every transaction and every pattern across accounts. An analyst reading statements cannot.
2. Stopping crime early
An alert raised on the first odd transfer stops the scheme before the funds leave. An alert raised at month end does not.
3. Managing regulatory and reputational risk
Knowing which customers and transactions are high risk lets the firm decide how to handle them before a regulator or a journalist does.
4. Ongoing customer due diligence
Monitoring shows what each customer normally does, so a sudden change stands out and triggers a review.
5. Meeting the regulators' requirements
Regulators everywhere require an AML programme, and transaction monitoring is the control they inspect first. The fines for weak monitoring are large and public.
6. Keeping customer trust
A firm that catches laundering keeps its licence, its banking partners and its customers. One that does not makes the news.
Who needs a transaction monitoring system
Banks were the first, but AML obligations now reach any business that moves money for customers:
- Money services businesses
- Traditional banks
- Money transfer companies
- Financial services firms
- Fintechs
- Lending businesses
- Exchanges
- Cryptocurrency companies
- Brokerages
- Insurance companies
Each regulatory update pulls more industries into scope. If you hold or move customer funds and are not on this list yet, check whether your regulator expects monitoring anyway.
Features that matter in an AML transaction monitoring system
Five things separate a system that works from one that produces paperwork.
1. Real-time monitoring
Scoring a transaction as it happens lets you hold it. Scoring it in a nightly batch lets you write a report about it.
2. A rules engine you control
Your team should be able to write and change detection scenarios for your own risks and your own regulator without a vendor ticket.
3. Proprietary data
Data the vendor has gathered across its customers (device reputation, known mule accounts, shared blocklists) improves detection and cuts false positives.
4. API integrations
The system needs to read from core banking, KYC, payments and case management, and write back to them. Anything that needs a manual export will fall behind.
5. Regulatory reporting
Automated SAR drafting and filing saves analyst hours and removes the transcription errors that regulators pick up on.
Setting up the AML transaction monitoring process
The implementation runs in six steps, and the last one never finishes:
- Risk assessment. Work out the laundering and terrorist financing risks your institution faces.
- Define suspicious behaviour. Translate the assessment into concrete definitions per customer type and transaction category.
- Set thresholds and rules. Build the rules that turn those definitions into alerts.
- Open cases and investigate. Every alert becomes a case for an AML analyst to work.
- File SARs. When the investigation confirms the suspicion, file with the regulator.
- Maintain the system. Retune for new threats and new rules, and keep a record of when and why each threshold changed.
Where AML transaction monitoring goes wrong
Three problems come up again and again.
1. False positives
Most alerts are legitimate transactions that tripped a crude rule. Analysts drown in them, start closing cases on autopilot, and the real one slips through in the noise.
2. Off-the-shelf rules
A generic rule set tuned for nobody in particular misses your risks and alerts on your normal customers. The vendor defaults are a starting point, not a configuration.
3. Schemes that span accounts
Serious laundering spreads across accounts, channels and institutions. Catching it takes analytics that link entities and follow funds across those boundaries, not a per-account threshold.
Where to start
Start with the risk assessment, because every rule and threshold downstream depends on it. Then make the review loop real: pull last quarter's alerts, count the false positives, and retune the two rules producing most of them.
As criminals adapt and regulators tighten, the monitoring system is the control that decides whether your institution finds the problem or reads about it in an enforcement notice.
For the fraud side of the split described above, Sensfrx scores signups, logins and payments in real time from device, network and behaviour signals. The free plan is enough to test it on live traffic.
Frequently asked questions