AML transaction monitoring is the ongoing review of customers’ transactions to spot activity that may be linked to money laundering or other financial crime. Banks, payment companies, brokers, crypto exchanges and other financial firms use it to compare what a customer actually does with what they would expect from that customer.
Most of the time the answer is “nothing unusual”. When something doesn’t fit, such as a sudden flood of incoming transfers, cash deposits kept just under a reporting threshold or money that arrives and leaves the same day, the system raises an alert. A person then investigates. An alert is a question, not an accusation, and many turn out to have an ordinary explanation.
In short:
- Transaction monitoring watches the flow of money through accounts, looking for patterns that don’t fit the customer.
- Software raises alerts; trained analysts decide what they mean.
- If the suspicion holds up, the firm reports it to the authorities, for example through a suspicious activity report (SAR) in the United States.
- Regulators treat monitoring as a core legal duty. Weak monitoring has cost banks billions of dollars in penalties.
What is money laundering, and where does monitoring fit?
Money laundering is the process of making criminal money look legitimate. The Financial Action Task Force (FATF), the international body that sets anti-money laundering (AML) standards, describes it as processing criminal proceeds “to disguise their illegal origin”.
Nobody knows exactly how much money is laundered, because successful laundering is by definition hidden. The most widely quoted figure comes from the United Nations Office on Drugs and Crime, which estimates it at 2–5% of global GDP, or $800 billion to $2 trillion a year. It is an old, rough estimate, but it gives a sense of scale.
Laundering is traditionally described in three stages: placement (criminal money enters the financial system), layering (it is moved around to hide where it came from) and integration (it returns to the legitimate economy looking clean). Real cases may skip, combine or repeat these stages, but each one leaves traces in transaction data. Transaction monitoring is one of the main ways financial firms try to catch money at any of them.
- 1
Placement
Dirty cash enters the financial system.
StructuringUnusual cashProfile mismatch
- 2
Layering
Money is moved around to hide its source.
Pass-throughMoney mulesCircular flowsHigh-risk countries
- 3
Integration
It returns to the economy looking clean.
Big purchasesIncome doesn’t fit
What monitoring looks for at each stage
Why AML transaction monitoring matters
Checking a customer’s identity when an account is opened, known as KYC (know your customer), is only the start. A person can pass every onboarding check and later use the account in ways that don’t match anything they said. Watching transactions is usually how that comes to light.
Monitoring is also a legal requirement. In the United States, the Bank Secrecy Act (BSA) requires banks and many other financial institutions to report suspicious activity to FinCEN, the Treasury’s financial-intelligence unit. FinCEN’s 2016 customer due diligence rule spells it out: banks, securities brokers and certain other firms must “conduct ongoing monitoring to identify and report suspicious transactions”. The EU, the UK and most other countries have similar rules based on the FATF standards.
The cost of getting it wrong can be enormous. In October 2024, TD Bank pleaded guilty to Bank Secrecy Act and money laundering conspiracy charges. According to the US Department of Justice:
- 92% of the bank’s total transaction volume, about $18.3 trillion between January 2018 and April 2024, went unmonitored.
- The bank deliberately left entire transaction types, including all domestic ACH transfers (the electronic payments used for direct deposits and bills) and most check activity, out of automated monitoring.
- From at least 2014 to late 2022, it added no new monitoring scenarios and made no material changes to existing ones.
- Three money laundering networks moved more than $670 million through the bank between 2019 and 2023.
FinCEN imposed a $1.3 billion penalty, the largest it has ever imposed on a bank. Across the Justice Department, FinCEN and the two federal banking regulators, TD agreed to pay about $3.1 billion.
Who has to monitor transactions?
AML rules apply to much more than banks. Depending on the country, firms that must monitor their customers’ activity usually include:
- banks, credit unions and building societies
- payment companies, money-transfer services and currency exchanges
- brokers, investment firms and fund managers
- crypto exchanges and other crypto service providers
- insurers, for some life and investment products
In many countries, the rules also cover businesses and professionals outside finance that can be used to move or hide money, which the FATF calls designated non-financial businesses and professions. These include casinos, real-estate agents, dealers in precious metals and stones, lawyers, notaries, accountants and firms that set up companies and trusts.
The scale differs hugely. A large bank monitors millions of payments a day with specialized software. A small law firm may review a handful of client transactions by hand. The duty to notice and report what doesn’t fit is the same.
How does AML transaction monitoring work?
Most monitoring programs follow the same five steps.
1. Collect customer and transaction data
Monitoring needs more than an amount and a date. Useful inputs include:
- Customer profile: identity, occupation or business type, expected account use and risk rating, which is the firm’s own assessment of how likely the customer is to be involved in financial crime.
- Transactions: deposits, withdrawals, transfers, card payments, currencies and counterparties, meaning the people or businesses on the other side of each payment.
- Context: countries involved, channels used (cash, wire, card, crypto), and whether a payment was completed, rejected or reversed.
- History: previous alerts, the explanations given and the decisions made.
The data has to be complete. A gap in coverage is the most dangerous kind of error, because nothing looks wrong: a transaction type that never reaches the system simply produces no alerts. That is exactly what happened at TD Bank.
2. Detect unusual activity
Systems use two broad approaches, often together:
- Rules (scenarios) flag specific patterns, such as several cash deposits just under a reporting threshold within a week, or incoming and outgoing transfers of similar size within 24 hours.
- Behavioral analytics and machine learning flag activity that is unusual compared with the customer’s own history or with similar customers. Network analysis, which maps how accounts are connected through shared payments, addresses, devices or other details, can also reveal links between accounts that look unrelated.
Rules are easy to explain but rigid, and criminals can learn to stay just below them. Machine-learning models can spot new patterns but need careful validation, and their alerts must still be explainable to an investigator and a regulator.
Good monitoring is risk-based: customers, products and countries with higher risk get closer scrutiny. A “low-risk” label never means no monitoring at all.
3. Investigate the alert
An analyst first checks whether the data behind the alert is correct. Then they compare the activity with everything the firm knows about the customer: their profile, past behavior and any documents on file. Where appropriate, the firm may ask the customer for an explanation or evidence, such as an invoice, a contract or proof of where the money came from.
The analyst’s job is to decide whether the explanation is actually supported by evidence, not just whether one was given.
4. Decide and report
If the activity is explained, the alert is closed with a written reason. If it isn’t, the case is escalated to a senior compliance officer, such as the BSA officer in a US bank or the money laundering reporting officer (MLRO) in the UK, who decides whether the firm must report it.
Reports go to the country’s financial intelligence unit (FIU), the government agency that receives and analyzes them. In the United States, that is FinCEN. Banks generally must file a suspicious activity report for suspicious transactions of $5,000 or more. For money services businesses, such as money-transfer companies, the threshold is $2,000, and other types of firms have their own rules. The deadline is generally 30 days from when the firm first identifies facts that may make the activity reportable, which is usually during its review rather than the moment an alert fires. For banks, it can be extended to 60 days if no suspect has been identified. Other countries use different names, such as suspicious transaction reports (STRs) or, in Australia, suspicious matter reports (SMRs).
Filing a report does not mean the customer is guilty. It passes information to the authorities, who decide whether to investigate. The firm also may not reveal that a report exists to the customer or anyone else involved. In the US, this falls under SAR confidentiality rules; in the UK and the EU, disclosing it is prohibited as “tipping off”, and in the UK it is a criminal offense.
5. Keep records and improve
Every decision is documented so that an auditor or regulator can later understand why it was made. Investigation results also feed back into the system. Too many pointless alerts from one rule mean it needs tuning. A suspicious pattern found by accident, outside the alert system, means a scenario is missing.
AML red flags: what triggers an alert
These are some of the best-known money laundering patterns that monitoring systems look for:
| Pattern | What it looks like | Why it’s suspicious |
|---|---|---|
| Structuring (called smurfing when several people are used) | Several cash deposits of, say, $9,500 on consecutive days | Keeping each deposit under a reporting threshold, such as the US $10,000 threshold for cash |
| Pass-through or rapid movement | Money arrives and leaves again within hours or days | The account is a stopover, not a place where the customer actually uses money |
| Money mule activity | Many small transfers from unrelated people, forwarded in one payment | The account holder may be moving criminal money for someone else, often for a fee |
| Funnel accounts | Cash deposited into one account in one region, quickly withdrawn in another | Criminal cash is gathered in one place and moved to where it is needed (FinCEN advisory) |
| Round-tripping | Money sent abroad comes back disguised as a loan, investment or payment | The same funds circle back to look like legitimate income |
| Profile mismatch | A student’s account suddenly handles business-sized volumes | The activity doesn’t fit what the customer said about themselves |
| High-risk jurisdictions | Frequent transfers to or from countries with weak AML controls | Higher risk of links to crime, sanctions evasion or corruption |
| Dormant account reactivation | An unused account suddenly receives and sends large sums | The account may have been sold, taken over or recruited for laundering |
Business accounts have red flags of their own: shell companies with no real staff, premises or activity; invoices priced far above or below the market value of the goods, which can move money across borders disguised as trade; and cash takings far higher than a similar business would normally make, which can mean criminal cash is being mixed with genuine income.
In the United States, banks must file a currency transaction report (CTR) for cash transactions of more than $10,000 in one business day. Several smaller cash transactions on the same day are added together when the bank knows they were made by or for the same person. A CTR is routine paperwork, not an accusation: depositing more than $10,000 in cash is perfectly legal. What is illegal is structuring, deliberately splitting cash to avoid the report, even if the money itself is legitimate.
No single red flag proves anything. Context matters, and several small, ordinary-looking transactions can form a pattern that none of them shows on its own.
Example: one alert, two possible outcomes
Here is a hypothetical example. Anna is a freelance designer whose account usually receives two or three client payments a month. In one week, she receives 14 transfers of about $900 each, roughly $12,600 in total, from people who have never paid her before. The next day, she sends $12,000 to an account abroad.
The pattern triggers two rules at once: an unusual number of new senders, and money that passes straight through the account. An analyst reviews the case and asks Anna about the payments. What happens next depends on her answer and, above all, on what she can show.
AlertNew senders + money passing straight through
Version 1
A group trip
Friends paid their share. Tour operator invoice on file.
✓ Alert closed
Version 2
A “payment assistant” job
Strangers’ money, forwarded for a commission.
! Escalated, SAR considered
In the second version, Anna may not have realized it, but she has been acting as a money mule. Fake “payment assistant” or “money transfer agent” jobs are one of the most common ways people become money mules. Mules can have their accounts closed, find it hard to open new ones and face prosecution, even if they didn’t know the money was criminal.
Transaction monitoring vs KYC, screening and fraud monitoring
These controls share data, but each answers a different question:
| Control | Main question |
|---|---|
| KYC and customer due diligence | Who is this customer, and what do we expect them to do? |
| AML transaction monitoring | Does the customer’s actual activity suggest money laundering? |
| Sanctions screening | Does a person or payment involve a sanctioned party or country? |
| Fraud monitoring | Is someone being deceived, or is an account being used without permission? |
| Trade surveillance | Are orders or trades being used for market manipulation or insider trading? |
KYC doesn’t end when an account is opened. Monitoring often shows that customer information needs updating or that closer checks are needed. The lines between these areas also blur in practice. A fraud case can uncover laundering, and a money mule is often both a fraud victim and part of a laundering chain.
How crypto transactions are monitored
Crypto exchanges and other crypto service providers are covered by AML rules in most major jurisdictions and monitor their customers much as banks do. Crypto also adds one extra tool and one extra obligation.
Blockchain analytics. Most blockchains are public, so a firm can trace where coins came from and where they go, across many wallet addresses. Analytics tools flag funds with links to scams, hacks, darknet markets, sanctioned addresses or mixing services, which pool coins from many users to hide their trail.
The Travel Rule. Under the FATF standards, crypto service providers must obtain, hold and transmit information about the sender and recipient of a transfer, just as banks do for wire transfers. In the EU, this has applied to crypto transfers made through crypto service providers since 30 December 2024, with no minimum amount.
Typical crypto red flags include deposits from wallets linked to mixers or scams, rapid swaps between different coins with no obvious purpose and many small deposits followed by one large withdrawal.
Real-time vs batch monitoring
Real-time monitoring checks transactions as they happen, so a payment can be stopped or held before the money leaves. It is standard for fraud prevention and sanctions screening, where a payment has to be blocked before it goes through.
Batch monitoring analyzes transactions in groups after they have happened, often overnight. Most AML scenario monitoring still works this way, because laundering patterns such as structuring or layering across several accounts only become visible over days or weeks.
Firms increasingly combine the two, adding real-time AML checks for instant payments and crypto transfers, where money can be gone within seconds. Smaller firms with simple products may also rely partly on manual review, as long as it is documented and consistent.
The false-positive problem
Most transaction monitoring alerts turn out to be legitimate activity: a bonus, a house sale, a family transfer. McKinsey estimated in 2017 that up to 90% of the alerts generated by traditional rules can be false positives. Every one takes an analyst’s time, and a backlog of unreviewed alerts is a risk in itself. FinCEN specifically criticized TD Bank for allowing “significant backlogs of potentially suspicious activity to persist”.
Reducing false positives is not just about generating fewer alerts, though. A system that stays quiet because its thresholds are set too high simply misses crime. Better data, rules tuned to each customer segment, machine learning that ranks alerts by risk and regular testing for missed cases are what actually improve results.
What makes transaction monitoring effective?
Regulators and experienced compliance teams tend to look for the same qualities:
- Full coverage. Every relevant product, account and payment channel feeds the system, and missing data is flagged immediately.
- Risk-based design. Rules and models reflect the firm’s actual customers, products and countries, not a generic template.
- Explainable alerts. Each alert shows what triggered it and which transactions it concerns.
- Good investigations. Analysts have the full customer history in one place, clear ownership of each case and enough staff to keep up.
- Documentation. Every decision and every change to the rules is recorded with a reason.
- Regular testing. The system is checked for missed patterns and tuned, instead of being left unchanged for years.
AI is increasingly used to rank alerts and uncover hidden links between accounts. It helps, but it doesn’t remove the firm’s responsibility to understand, test and explain how its monitoring works.
What to do if your payment is held or your account is restricted
For most people, monitoring is invisible. Occasionally, though, it becomes very visible: a transfer is held, the bank asks where money came from, or an account is frozen or closed. Here is what is usually going on and how to respond.
Why it happens. A firm may hold a payment while it reviews an alert, or restrict an account while it waits for information. In the UK, a firm that suspects laundering may need permission from the National Crime Agency before it can go ahead with a transaction, which can hold a payment for days or longer. Some firms also close accounts not because of anything a customer did, but because they have decided a whole category of customers or countries is too risky to serve. This is known as de-risking, and the FATF has warned that it can shut legitimate people out of the financial system.
Why they may not explain. If a firm has reported, or is considering reporting, suspicious activity, the law usually forbids it from saying so. A vague answer is often a legal constraint, not a brush-off.
How to respond:
- Reply promptly and completely to any request for information, through the firm’s official channels.
- Provide documents that show where the money came from: payslips, invoices, contracts, a property sale agreement or a tax return.
- Keep copies of everything you send and receive, and ask in writing what else is needed.
- Don’t try to route money around a restriction, for example by splitting it into smaller amounts or moving it through a friend’s account. That can make things much worse.
- Never let anyone else use your account to receive or forward money, whatever you are offered for it.
If you think the decision is wrong, use the firm’s formal complaints process first. If that doesn’t resolve it, you can usually take it further. In the UK, the Financial Ombudsman Service can rule on the complaint. In the US, you can file a complaint with the Consumer Financial Protection Bureau, which passes it to the firm for a response. Most countries have a similar ombudsman or regulator complaint service.
How AML rules differ around the world
Most countries base their rules on the FATF Recommendations, the global AML standard. The details differ:
- United States: the Bank Secrecy Act, enforced by FinCEN and banking regulators. It covers SARs, currency transaction reports for cash over $10,000 and the ban on structuring.
- European Union: a new EU AML regulation, applying directly in every member state from 10 July 2027, will replace much of today’s patchwork of national rules. A separate directive covers national supervisors and FIUs, and a new EU authority, AMLA, based in Frankfurt, is due to start directly supervising up to 40 of the riskiest cross-border financial firms from 2028.
- United Kingdom: suspicious activity reports go to the National Crime Agency. The Financial Conduct Authority supervises most financial firms, while HM Revenue & Customs and professional bodies supervise other businesses, such as estate agents, lawyers and accountants.
- Australia: AUSTRAC acts as both regulator and financial intelligence unit, and firms file suspicious matter reports.
The principle is the same everywhere: know your customer, watch the activity, investigate what doesn’t fit, and report genuine suspicion.
FAQ
What does AML stand for?
AML stands for anti-money laundering: the laws, controls and processes that financial firms use to prevent, detect and report money laundering. Transaction monitoring is one part of it, alongside customer checks, sanctions screening, staff training and reporting.
What happens if my transaction is flagged?
Usually nothing you will notice. Most alerts are reviewed and closed without contacting the customer. Sometimes the bank or payment provider will ask you to explain a transaction or show documents, and the payment may be delayed while it is reviewed. Answering clearly and promptly is the fastest way to resolve it.
Will my bank tell me if it files a suspicious activity report?
No. In most countries, the firm is legally prohibited from telling you, or anyone else involved, that a report has been filed or is being considered.
Is structuring illegal even if my money is legal?
In the United States, yes. Deliberately splitting cash deposits or withdrawals to avoid the $10,000 reporting requirement is a federal offense in itself, regardless of where the money came from. Simply depositing a large amount of cash is not.
Does every alert lead to a suspicious activity report?
No. An alert is an internal signal to take a closer look. A report is filed only when the review supports a genuine suspicion under the applicable legal test. Most alerts are closed with a documented explanation.
What is the difference between transaction monitoring and transaction screening?
Screening checks a single person or payment against lists, such as sanctions lists, usually before the payment goes through. Monitoring looks at behavior and patterns over time. Many firms use both.
Can transaction monitoring be fully automated?
Data collection, detection and alert ranking can be largely automated. Decisions about whether activity is truly suspicious, and whether to report it, still need trained people and accountable oversight.
