Transaction monitoring: finding signal in the noise

High alert volumes don’t equal strong detection. Practical ways to tune monitoring, reduce false positives and focus investigators on real risk.

Many compliance teams know the feeling: thousands of alerts, a handful of analysts and a backlog that grows every week. When nearly every alert turns out to be a false positive, genuine suspicious activity can hide in plain sight.

Start with your risk assessment, not the vendor’s defaults

Out-of-the-box rules are designed for a generic institution. Your scenarios should map directly to the typologies identified in your own risk assessment — the ways your products could realistically be abused.

Segment before you set thresholds

A single threshold across all customers guarantees noise. Segment by customer type, risk rating and product, then calibrate thresholds to each segment’s normal behaviour using historical data.

Tune continuously — and document it

• Analyse alert-to-case and case-to-report conversion rates per scenario.
• Use below-the-line testing to check that raised thresholds don’t miss genuine risk.
• Retire or redesign scenarios that consistently produce no productive alerts.
• Record the rationale for every change so you can explain it to a regulator or auditor.

The goal isn’t fewer alerts. It’s more of the right alerts.

Invest in the investigation workflow

Clear triage guidance, consistent case documentation and quality assurance turn alerts into sound decisions. Well-documented investigations also produce stronger suspicious activity reports — which is ultimately what monitoring is for.