Transaction monitoring
Transaction monitoring is the ongoing process of examining payments and account activity to detect patterns that may indicate money laundering, terrorist financing, fraud or other financial crime.
How it works. Where customer due diligence checks who a customer is at onboarding, transaction monitoring watches what they actually do afterwards. Systems review transactions — often in large volumes and increasingly in real time — against rules and behavioural models that flag anomalies: transactions that are unusually large, structured to avoid reporting thresholds, sent to high-risk jurisdictions, or simply out of character for the customer. Flagged activity generates an alert that a compliance analyst investigates, deciding whether it is benign or warrants escalation.
Rules and models. Traditional monitoring relies on rules — defined thresholds and scenarios that trigger alerts. More sophisticated programmes add statistical and machine-learning models that learn a customer's normal behaviour and surface deviations, reducing the high false-positive rates that rule-only systems tend to produce. The goal is to catch genuine financial crime without overwhelming analysts with noise, since an alert backlog is itself a compliance risk. Getting the balance right — sensitive enough to catch real crime, precise enough to be workable — is the core challenge of monitoring.
Where it fits. Transaction monitoring is a regulatory expectation for firms handling regulated money movement, and a core input to suspicious activity reporting: where monitoring surfaces genuinely suspicious activity, the firm's compliance function — under the MLRO — decides whether to report it to the authorities. It works alongside sanctions screening (which checks parties against prohibited lists) and customer due diligence as part of a layered defence against financial crime, each catching what the others might miss.