Transaction Monitoring & Alert Triage

Transaction monitoring is the review of activity against a customer profile, rules, scenarios and risk indicators. Alert triage is the first disciplined review of whether an alert can be cleared, needs more information or should be escalated.

1. Alert does not mean suspicion #

An alert is a signal generated by a rule, model, list, scenario or manual observation. It is not automatically suspicious activity. The analyst must understand why the alert triggered and whether the activity is consistent with the customer profile and available evidence.

2. Basic triage flow #

Alert triggered
→ understand the rule or scenario
→ identify the customer and expected activity
→ review transaction context
→ compare with prior behaviour and risk profile
→ check supporting evidence
→ clear, request information or escalate

3. What the analyst should compare #

4. Common triage outcomes #

5. Strong vs weak closure rationale #

Weak closure:

No issue. Customer is known.

Stronger closure:

Alert triggered due to transaction size. Activity is consistent with the customer’s stated business model and historical monthly volume. Counterparty is an existing supplier; invoice and contract reviewed. No new sanctions, PEP or adverse media concerns identified. Alert cleared with evidence references.

6. When to escalate #

Escalation should be considered when:

• the activity has no clear economic or lawful purpose;
• customer explanation conflicts with documents or behaviour;
• sanctions, PEP or adverse media concerns remain unresolved;
• transaction routes, counterparties or goods create higher-risk exposure;
• the customer avoids information requests or provides inconsistent evidence;
• the alert forms part of a repeated pattern.

7. Suspicion Is a Reasoned Analytical Conclusion #

Suspicion is not a keyword match, a single red flag or an automatically generated alert. It is a reasoned analytical conclusion formed after comparing activity, customer profile, source evidence, explanations, unresolved discrepancies and applicable escalation rules.

Safe wording should separate:

A strong case note explains why an issue was cleared, why more information is needed or why it was escalated. It should not rely on vague wording such as “looks fine” or “customer is known”.

8. Source basis #

• FATF Recommendations for ongoing due diligence, STR/SAR and internal-control concepts.
• FFIEC BSA/AML Examination Manual for transaction monitoring and suspicious activity review concepts.
• FinCEN SAR Narrative Guidance for narrative quality and evidence-focused escalation writing.

Monitoring effectiveness and modernisation#

Wolfsberg's monitoring statements (SRC-WOLF-006 and SRC-WOLF-007) support a broader view of suspicious-activity monitoring that combines transactions, customer behaviour, attributes, typologies and feedback.

When rules or models change, the control file should document:

• intended risk coverage and expected outcomes;
• data and product scope;
• validation approach;
• precision, recall and quality considerations where applicable;
• explainability for investigators and reviewers;
• transition risks and governance approval;
• downstream impact on case investigation and SAR/STR quality.

Innovation does not remove the need for reviewable evidence and accountable escalation.