Advanced: assuring monitoring and screening systems.

What the system has to prove

A transaction monitoring system watches transactions after they happen for signs of money laundering. A filtering or screening system checks names in payments and customer records against sanctions lists, usually before a payment is released. Both are only as good as the evidence that they work.

The clearest legal statement of expectations is New York's Part 504 rule (cited by its regulator as 3 NYCRR Part 504), in effect since 1 January 2017 for banks, branches, money transmitters and cheque cashers licensed in New York. It applies only there, but supervisors elsewhere expect much the same.

A transaction monitoring programme must:

• be based on the institution's own risk assessment and updated as it changes;
• use detection scenarios with thresholds that match the institution's real risks;
• have end-to-end testing before and after implementation, covering the whole chain: governance, how data is mapped and transactions are coded, the logic of each scenario, validation, the data going in and the results coming out;
• document scenarios, assumptions, parameters and thresholds;
• set protocols for investigating alerts and deciding outcomes;
• be analysed on an ongoing basis to check scenarios, rules and thresholds still make sense.

A filtering programme must be risk-based, use matching technology (the rule mentions fuzzy matching but mandates no particular technology), be tested end to end, including data matching, list and threshold mapping and the matching logic, and be documented and analysed on an ongoing basis.

Both must have: an inventory of all data sources; checks that the data reaching the system is complete, correct and of good quality; sound extraction and loading; governance and change management; careful vendor selection; adequate funding; qualified staff; and training.

Personal accountability. Each year, by 15 April, the board or a senior officer must certify compliance for the previous year. Where improvements are needed, they must be documented with a remediation plan.

Data comes first

The most common way for a monitoring or screening system to fail is not a bad rule. It is missing or wrong data: transactions that never reach the system, fields that are empty or mapped wrongly, parties that are never screened.

Supervisors in several countries have found exactly this:

• Part 504 requires institutions to identify every data source, validate data integrity, and ensure extraction and loading processes transfer data completely and accurately.
• The UK Financial Conduct Authority's Financial Crime Guide lists as poor practice data not migrated properly when systems feeding the monitoring tool change, and transactions erroneously left out.
• The FCA's 2023 review of sanctions systems after Russia's invasion of Ukraine, covering more than 90 firms and using its own testing tool, found some screening systems could not generate alerts against certain names on the UK sanctions list, and gaps in customer data meant not all relevant parties were screened.
• The Wolfsberg Group, an association of global banks, says screening testing should check the accuracy and completeness of data, noting that combining data from several systems creates integrity risk.

What good looks like:

• a data lineage map from every source system to the monitoring and screening tools;
• reconciliations that prove the number and value of transactions entering the system match the source;
• checks for empty or defaulted fields, such as a missing country or counterparty name;
• change control, so that a new product, channel or core system cannot go live without the monitoring and screening feeds being updated and tested.

A rule that never fires may be a well-tuned rule, or a rule that never receives the data it needs. Only data testing tells you which.

Tuning and testing

Tuning monitoring rules. The US interagency BSA/AML examination manual expects banks to review rules and thresholds before going live, to find gaps such as a structuring rule that only triggers above the reporting threshold it is meant to detect; to review and test them periodically; to control who can change them; and to be able to document and explain the criteria and thresholds used. The methodology and its effectiveness should be independently validated.

The FCA's guide adds good practice: monitoring at transaction, account, customer and linked-party level; justifying any rule that is switched off; piloting new systems; and documenting the reasons for thresholds. It names as poor practice off-the-shelf rules never calibrated to the firm, and rules whose rationale the firm cannot explain.

Testing screening. The Wolfsberg Group's 2019 guidance on sanctions screening recommends:

• documented, risk-based decisions on which lists to use, what to exclude and how to treat known false matches;
• an independent, risk-based testing regime to confirm the system produces the alerts it should, at the thresholds and rules set, using test names and variations;
• management information, such as alerts by list, jurisdiction and business line;
• careful list management: sourcing, timely updates, exact and fuzzy matching, and screening frequency.

The FCA's guide adds that firms should check whether hit volumes are unexpectedly high or low, and should not rely blindly on third-party systems.

Is the system a model? Many institutions validate monitoring and screening systems as models. The US agencies' April 2026 model risk guidance, SR 26-2, defines models in a way that excludes simple deterministic rules without statistical theory behind them, so a rules-only system may fall outside it, while statistical or machine learning scoring would not. Either way, supervisors still expect testing and documentation.

Testing below the line. Lowering a threshold on a sample of data shows whether real cases are being missed just under it. It is one of the few ways to estimate false negatives: the suspicious activity the system never flags.

Effectiveness, not volume

For years, institutions measured monitoring by volume: more scenarios, more alerts, more reports. The Wolfsberg Group's 2024 statement on effective monitoring for suspicious activity argues that ever-rising numbers of suspicious activity reports are not producing proportionate results for law enforcement.

What it proposes instead:

• risk-based monitoring focused on the risks an institution actually sees, not a checklist of every possible red flag;
• switching off routines that produce no useful results, then testing that nothing important was lost;
• using feedback from financial intelligence units on which reports proved useful;
• assessing false negatives, not just false positives;
• strong data governance and quality control;
• moving away from a "no report left behind" culture towards fewer, better reports.

Its 2025 follow-up on introducing new techniques, such as machine learning, stresses careful transition and validation, balancing model risk against financial crime risk, and explainability.

Useful measures combine:

• coverage: which risks and typologies each rule addresses;
• quality: the share of alerts that lead to investigation or reports, and feedback on report usefulness;
• timeliness: alert backlogs and the age of the oldest open alert;
• data health: reconciliations and field completeness;
• false negatives: results of below-the-line testing and of cases found by other routes that the system missed.

Backlogs are a red flag. The FCA's 2023 sanctions review found significant alert backlogs and management information missing basic metrics. Supervisors treat a growing backlog as a sign the system, its tuning or its staffing is not working.

What enforcement cases reveal

An exchange with a monitoring backlog (New York Department of Financial Services, 2023). A consent order with a crypto-asset exchange found no evidence that its transaction monitoring system had been validated as Part 504 requires, and that by the end of 2021 more than 100,000 monitoring alerts were unreviewed, many months old, with over 14,000 enhanced due diligence cases waiting. The firm hired over 1,000 contractors to clear the backlog, but with weak oversight: in a sample, more than half the alerts closed by some contractors failed quality checks. The firm paid a US$50 million penalty and committed to spend US$50 million more on compliance.

A certification that should not have been signed (New York Department of Financial Services, 2020). A bank's New York branch certified compliance with Part 504 in 2018 while its monitoring system was inadequate. The regulator had made clear that an institution may not certify unless it complies. The penalty was US$35 million.

Payments that were never screened (UK Financial Services Authority, 2010). A bank was fined £5.6 million after failing to screen certain cross-border payments at all, using ineffective fuzzy matching, and not screening the directors and owners of its corporate customers, as recorded in the FCA's Financial Crime Guide.

What they teach:

• Certification is personal and serious. Signing that a system works when it does not is itself a breach.
• Backlogs are not an operational detail. Unreviewed alerts mean unreported suspicion.
• Scope gaps are invisible until tested. A payment type or party never screened produces no alerts and no warnings.
• Quality assurance must cover the people too: contractors and analysts clearing alerts need oversight and sampling.

In Kenya: the Proceeds of Crime and Anti-Money Laundering Regulations, 2023 require reporting institutions to have internal controls that include monitoring programmes for complex, unusual, large or suspicious transactions and independent audit to test that system. The Financial Reporting Centre says suspicious transactions must be reported within two days of the suspicion arising, through its goAML system. Its guidance on targeted financial sanctions, revised in July 2025, expects screening when lists change, at onboarding, when customer data changes and during payment processing, with freezing and reporting within 24 hours. In 2026 the Central Bank published for comment a draft revised anti-money laundering guideline that would require screening systems to be updated promptly when lists change and an independent audit of reporting systems' integrity. Check the current rules.

Your certificate of completion

Enter your name as you want it to appear, then save the certificate as a PDF. In the print window, choose Save as PDF. A certificate is issued once per completion of the course.

Saolix does not record who takes this course, so it cannot verify these certificates. The certificate confirms completion of a free self-paced course and is not an accredited qualification.