What AML Transaction Monitoring Actually Looks Like in Production

You've built the KYC flow. Sanctions screening runs at onboarding and on every transaction. Somewhere in your compliance stack there's a component labeled "transaction monitoring," and it's running.

What does it actually do all day?

The generic answer is "flag suspicious transactions." That's about as useful as saying a hospital "monitors patients." It tells you nothing about what gets measured, what triggers an alert, who investigates, or why a bank that invested billions in monitoring technology still let $5 billion in reportable activity go unreported.

Transaction monitoring is an operational pipeline. Raw transaction data goes in one end, rules and models score it, and alerts come out the other side. Human investigators triage those alerts and decide whether to file a suspicious activity report with FinCEN. In fiscal year 2025, that pipeline produced 4.8 million SARs across the US financial system, 2.8 million from banks alone.

Each SAR sits at the end of an investigation chain that started with a rule firing on a transaction. The distance between "deviated from baseline" and "actually suspicious" is where most of the cost and failure lives.

What the system watches

The monitoring system doesn't evaluate transactions one at a time. A single $50,000 wire to a bank in Singapore only becomes meaningful when you know the customer usually sends $2,000 wires domestically, has never transacted with Singapore, and initiated this transfer at 2am for the first time in 18 months.

So the system builds a behavioral profile for every customer, tracking average transaction size, typical counterparties, geographic patterns, time-of-day distribution, and volume over 7, 30, and 90-day windows. These profiles become the baseline against which every new transaction is measured.

A mail carrier on a regular route knows Mrs. Rodriguez gets two letters a week and one package a month. When she suddenly receives 15 packages in three days, the carrier notices, because it's unusual for her route.

The monitoring system works the same way, except it's tracking baselines across hundreds of thousands of accounts simultaneously. And unlike the carrier, it can't peek inside the packages or ask a follow-up question. All it sees is amounts, counterparties, timestamps, and frequencies.

When the pattern deviates enough, it generates an alert. What happens next depends on humans.

How rules fire

Most production monitoring systems run on a rules engine. Each rule defines a pattern that regulators and compliance officers consider worth investigating.

Structuring rules watch for deposits or withdrawals that cluster just below reporting thresholds. In the US, banks must file a Currency Transaction Report for any cash transaction over $10,000. A customer who makes three deposits of $9,500 in a week triggers a structuring alert. Splitting large amounts into smaller pieces to avoid the reporting threshold is itself a federal crime, even if the underlying money is clean.

Velocity rules track how many transactions hit an account in a given window. A customer who normally runs five transactions a week and suddenly runs forty gets flagged.

Geographic risk rules score transactions against country-level risk ratings. A wire to a correspondent bank in a jurisdiction on FinCEN's advisory list gets flagged regardless of the amount.

Behavioral deviation rules compare current activity against the customer's own historical baseline. These are the most flexible and the noisiest. A customer's transaction pattern can shift for perfectly legitimate reasons: a new business contract, a family event, a relocation, or seasonal spending changes. The rule can't distinguish.

A mid-size bank might run 200 to 400 of these rules across its product lines. Each one fires independently, and when multiple rules trigger on the same customer or transaction, the alerts stack. These rules all work the same way. Each one fires when a number crosses a line, and none of them have any way of knowing why.

What 90% false positives means in practice

When compliance professionals say their false positive rate exceeds 90%, they mean that nine out of every ten alerts will be investigated and closed as legitimate activity. The tenth might warrant a SAR.

Liminal's 2026 banking survey found that 53% of banks run false positive rates above 20%. A SymphonyAI survey found that 37% of respondents report rates above 50%, and 21% don't track their false positive rate at all. Vendor benchmarks for legacy rule-based systems without ML scoring commonly cite rates of 85% to 95%.

Each alert takes a compliance analyst 20 to 40 minutes to investigate, at a cost of roughly $25 to $70 per alert. A bank generating 100,000 alerts per month spends somewhere between $2.5 million and $7 million monthly on investigations, and at a 90% false positive rate, most of that money reviews legitimate activity.

But banks can't stop investigating false positives to save money. Bank of America paid $1.2 billion for failing to report suspicious activity. The only lever is how many false positives you're willing to pay for to avoid missing the real ones.

L1, L2, and the SAR decision

When an alert lands in the queue, a Level 1 analyst picks it up. They see the customer's profile, the transactions that triggered the rule, and the rule's name and parameters. Their job is to decide whether the alert warrants further investigation or can be closed.

The L1 analyst checks the customer's account history for legitimate explanations like a new business contract, a one-time large purchase, seasonal variation, or a documented change in activity. They either close the alert with a written justification or escalate it to Level 2. The justification has to hold up in a regulatory exam, so "looked fine" doesn't work.

Escalated cases go to senior investigators. They pull additional evidence, bank statements, correspondence with the customer, records from relationship managers, external database checks. If the evidence supports suspicious activity, they write the SAR.

A SAR narrative is a written account of what happened, who was involved, when and where the activity occurred, and why the institution considers it suspicious. Writing one well takes about four hours of analyst time. FinCEN received 4.8 million of these in FY2025.

The SAR is confidential. The institution cannot tell the customer they've been reported. The customer receives no notification and has no appeal process, but FinCEN now has a data point in a database that the IRS Criminal Investigation division searched in 94% of its cases in FY2025.

Rules stay, ML scores

If rules generate so many false positives, why not replace them with ML models?

Two constraints keep rules in place. Regulators expect institutions to explain why a specific alert was generated. A rule that says "flagged because the customer made three cash deposits under $10,000 in five days" is auditable. A neural network that outputs "suspicious, confidence 0.87" is harder to defend in an exam.

And ML models need labeled training data. In AML, the positive class, confirmed suspicious activity, is vanishingly small relative to total transaction volume. You're training on the output of a system that's already wrong 90% of the time.

So production systems run both. BMO has migrated 50 to 60% of its rule-based monitoring to ML and advanced analytics, but the rules remain as a baseline.

The hybrid typically works in one of two ways. ML can score the alert queue after rules generate it, ranking alerts by likelihood of being genuine so analysts work from the top. False positives still exist, but they cluster at the bottom of the queue instead of being evenly distributed through it.

ML models can also run alongside rules as an independent detection layer. They watch for patterns that span too many dimensions for a human to encode, like networks of accounts moving money in coordinated bursts across multiple branches, or layered transactions that look clean individually but form a recognizable structure at the graph level.

In either case, the rules persist. They provide the explainable baseline regulators expect, and they catch the textbook patterns, structuring, rapid fund movements, sanctions evasion, and high-risk geographic activity, that don't need a model to detect.

When the pipeline breaks

In October 2026, regulators fined Bank of America $1.2 billion and American Express $350 million for AML failures. A combined $1.55 billion in five days.

Both banks had monitoring systems, compliance departments, and investigation teams.

At Bank of America, the monitoring system existed but wasn't escalating alerts to investigators. The bank admitted to willful BSA violations, failing to file SARs on more than $5 billion in suspicious activity. Treasury found that detection depended heavily on external referrals, law enforcement inquiries and tips from other banks, rather than the bank's own monitoring catching patterns.

BofA had signed a consent order in 2024 committing to fix "longstanding BSA deficiencies." More than a year later, suspicious activity still wasn't reaching the investigation queue.

At American Express, the risk assessment pointed at the wrong product line. Amex's AML program focused on its $153 billion deposit business while its card business processed roughly $1.7 trillion annually. For 11 years, approximately $13 billion in suspected trade-based money laundering flowed through card transactions with insufficient monitoring.

A monitoring pipeline can fail at any stage. If alerts don't escalate, the investigation never starts. If the risk assessment misses an entire product line, the rules never fire on the transactions that matter most. For the full analysis of what broke architecturally at both institutions, see the companion piece.

The 4.8 million SARs filed last year represent the pipeline working, while the $1.55 billion in October fines represent specific stages within it failing. Every institution that runs transaction monitoring operates somewhere between those two outcomes, and the distance between them is measured in risk assessment coverage, alert routing, rule calibration, and investigation staffing.