AML Transaction Monitoring: Rules vs Machine Learning

Transaction monitoring helps banks identify activity that may be unusual or suspicious under a risk-based Bank Secrecy Act and anti-money laundering program. FFIEC guidance describes multiple sources of information, including employee observations, law-enforcement inquiries, advisories, and transaction-monitoring systems. Automated systems may use rules or filtering models, while staff review reports and customer context. Rules encode explicit thresholds or patterns, such as transactions by amount, geography, timing, or product. Machine-learning models can rank cases or identify patterns that are harder to specify in a fixed rule. Both approaches can produce false alerts or miss activity. A high score does not show that money laundering occurred, and an alert should not be treated as a finding of guilt. Investigators consider customer profile, transaction history, beneficial ownership, and other relevant information. Institutions should design monitoring around products, customers, geographies, and risks, and test whether systems cover higher-risk activity. Track alert quality, investigation workload, missed cases, and changes to data or rules. Human review and documentation remain important. A model does not replace a bank’s compliance program or its legal obligations to investigate and report suspicious activity when required. Alerts are normally generated from activity rather than an independently verified offense, and case decisions require trained staff to review available facts. Customer patterns differ by product and legitimate business purpose, so a generic threshold may produce many unhelpful flags. Institutions should periodically assess whether monitoring coverage matches current risks and whether investigators have enough time and context to resolve alerts.