Transaction Monitoring Source Map

Transaction monitoring detects unusual or potentially suspicious activity by comparing transactions against expected behaviour, risk factors, rules, scenarios and typology indicators. This page maps source materials only; it does not define institution-specific monitoring rules.

1. Source categories #

2. Why public rules are risky #

Static public thresholds can be misleading. They depend on product type, customer profile, jurisdiction, transaction corridor, institution size, risk appetite and local legal obligations.

3. Safe approach in AML Bible #

AML Bible should explain concepts:

• expected vs unexpected activity;
• customer profile and purpose;
• transaction corridor;
• source and destination of funds;
• unusual frequency, size or pattern;
• link to typologies;
• evidence and escalation boundaries.

It should avoid publishing private institution thresholds or evasion-sensitive detection logic.

4. Evidence to describe #

• alert reason;
• customer profile;
• transaction chronology;
• counterparties;
• source documents;
• typology link;
• explanation and reviewer assessment;
• escalation or closure rationale.

5. Source basis #

• SRC-FFIEC-001: FFIEC BSA/AML Examination Manual.
• SRC-FATF-001: FATF Recommendations.
• SRC-WOLF-001: Wolfsberg resources.

Effectiveness and typology source layers#

The Wolfsberg monitoring statements distinguish effective monitoring for suspicious activity from a narrow reliance on static transaction rules:

• SRC-WOLF-006: Part I, moving beyond automated transaction monitoring.
• SRC-WOLF-007: Part II, transition, validation, model-risk balance and explainability.
• SRC-FINCEN-ADVISORIES-001: United States typology and red-flag examples.

FinCEN advisories are jurisdiction-specific and should not be converted into universal thresholds. Monitoring design must remain linked to the institution's risk assessment, customer profile, products, data and applicable law.