Transaction monitoring is where the risk based approach meets the daily work of a compliance function. It is also where weaknesses are easiest to see. A system that produces thousands of alerts a month, almost none of which lead anywhere, is expensive and gives the board false comfort. A system that produces very few alerts may be quiet for the wrong reasons.
Supervisors no longer ask only whether an institution has a monitoring system. They ask whether it works, whether it reflects the institution's own risks, and whether management can prove it. In our view three disciplines decide the answer. Segmentation defines what normal looks like for each group of customers. Tuning sets the rules and thresholds that separate normal from unusual. Quality assurance checks that the people and systems acting on alerts reach sound decisions. Each depends on the other two, and a weakness in one undermines the rest.
What regulators expect
The starting point is the FATF standard. Recommendation 10 requires ongoing due diligence, including "scrutiny of transactions undertaken throughout the course of that relationship to ensure that the transactions being conducted are consistent with the institution's knowledge of the customer, their business and risk profile". Since February 2025 the FATF Recommendations have required measures to be proportionate, meaning "a measure or action that appropriately corresponds to the level of identified risk and effectively mitigates the risks". When assessors evaluate a country, the FATF methodology looks for an outcome in which "The actions taken by supervisors and by financial institutions and VASPs are commensurate with the risks." Monitoring is one of the clearest tests of that outcome.
In Qatar, the QCB AML/CFT Instructions for Financial Institutions (May 2020 edition) state that "The monitoring systems must be configured to identify significant or abnormal transactions or patterns of activity". The intensity of ongoing monitoring "must be proportionate" to the level of risk posed by the relationship, and monitoring may be based on transaction type, the customer's risk profile or a comparison with peers. The MLRO must assess the effectiveness of controls "at least once a year or when necessary", and the Board approves the policies, procedures, systems and controls.
In the UAE, the CBUAE Guidance for Licensed Financial Institutions on Transaction Monitoring and Sanctions Screening, which took effect in September 2021, is the most detailed statement of expectations in the region. It says that "LFIs should perform risk-based customer and product segmentation", that thresholds should take account of the institution's specific risks, and that institutions with larger volumes should consider "above-the-line and below-the-line testing". It expects systems to be reassessed "On a periodic basis and in the event of material system output or operational irregularities", calls quality assurance "a crucial part in the TM program", and requires senior management to be "regularly updated on the performance and output of their TM program".
In the United States, the federal banking agencies' interagency statement of April 2021 on model risk management for BSA/AML systems notes that "prudent risk management involves periodically reviewing and testing the filtering criteria and thresholds", and that validation is generally performed using a risk based approach. FinCEN's proposed rule of 7 April 2026 points the same way, toward directing more attention and resources to higher risk customers and activities.
Outside the Gulf and the US, the Hong Kong Monetary Authority's Insights for Design, Implementation and Optimisation of Transaction Monitoring Systems (April 2024) is a detailed and practical supervisory paper on the subject, and we refer to it below.
The common thread is clear. Monitoring must reflect the institution's risk assessment. Its settings must be justified with evidence and reviewed. Its outputs must be checked, and senior management must know how well it performs.
Segmentation comes first
A threshold only means something relative to the population it is applied to. A monthly cash deposit of a given size may be routine for a trading company and highly unusual for a salaried individual. If both sit in the same segment, the institution has two poor choices. It can set the threshold low and bury its analysts in alerts on the trading company, or set it high and miss the individual. Neither is defensible.
In the words of the HKMA, "Appropriate customer segmentation reduces noise and improves the quality of alerts." It adds that poor segmentation weakens threshold setting, increases false positives and can leave higher risk activity unmonitored. The QCB Instructions make the same point from a different angle when they allow monitoring by reference to a customer's risk profile or a comparison with peers. Peer comparison only works if the peer group is right.
Good segmentation draws on what the institution already knows. Customer type, products used, expected activity, business sector, geography and risk rating are the usual building blocks. The segments should be tested with data, not assumed. If the activity within a segment varies too widely, it needs to be split. If two segments behave the same way, they can be merged. Too many segments leave each with too little data to set reliable thresholds, so there is a balance to strike.
Segmentation also depends on data quality. A customer recorded with the wrong business type or an outdated risk rating will sit in the wrong segment and be monitored against the wrong benchmark. The CBUAE expects institutions to have adequate processes to ensure that customer and transactional data meet established quality standards, and the HKMA reminds institutions to take particular care with data during system changes. Segments should be reviewed whenever the customer base, the product range or the risk assessment changes materially.
Tuning with evidence
Tuning is often treated as a way to reduce alert volumes. That is part of it, but the real purpose is to make sure each rule detects what it was designed to detect, at a level of sensitivity the institution can justify. Sometimes that means raising a threshold. Sometimes it means lowering one, adding a scenario, or retiring a rule that no longer reflects the risk.
The HKMA states that "AIs should tune threshold settings to align with their individual needs and circumstances", and describes thresholds supported by statistical analysis of historical transactions and of the alerts that led to suspicious transaction reports. Above-the-line and below-the-line testing, which the CBUAE and HKMA both describe, is the core technique. The institution tests what it would have caught, and what it would have missed, if a threshold were moved up or down. Below-the-line samples are particularly important because they show whether suspicious activity is sitting just under the current settings.
Several principles separate tuning that will stand up to scrutiny from tuning that will not.
- Start from the risk assessment. Each scenario should map to a risk or typology the institution has identified, including those in its national risk assessment. A rule that maps to nothing is a candidate for retirement. A material risk with no rule is a gap.
- Use the institution's own data. Vendor default settings are a starting point. They do not reflect any particular institution's customers.
- Document the rationale. Every change should record the analysis, the expected effect, the residual risk accepted and who approved it. Supervisors will ask.
- Review on a cycle and on triggers. The CBUAE expects reassessment periodically and after material irregularities. The HKMA refers to periodic reviews every 12 to 24 months, together with reviews triggered by events such as surges in alert volumes, changes to products and services or emerging typologies.
- Validate independently. The CBUAE expects testing and validation to be carried out by people with sufficient expertise who are independent of model development and use. The US interagency statement takes a risk based approach to how often validation is needed.
One caution. The direction of travel in the FATF standards and in the FinCEN proposal is toward allocating resources to higher risk. That is a reason to tune carefully, not a license to tune aggressively. An institution that cuts alert volumes without evidence that it is still detecting what matters has moved its cost from operations to its risk exposure.
Quality assurance closes the loop
A well tuned system still relies on people to review alerts and decide whether to escalate or close them. If those decisions are inconsistent, poorly documented or wrong, the institution's monitoring is only as good as its weakest analyst. The CBUAE describes quality assurance as a process that validates the accuracy and detail of alert reviews.
Effective quality assurance usually works at three levels. Within the operations team, a risk based sample of closed alerts and cases is reviewed again to check that the right decision was reached, the rationale is recorded and the work was done within the institution's own timelines. The compliance function then tests the program as a whole, including whether scenarios still work as designed. Internal audit provides independent assurance, which the QCB Instructions require through an independent and adequately resourced audit function.
Quality assurance should also test the system itself. The HKMA notes that "Functional testing is a critical aspect of TM system validation". That means confirming that each rule fires when it should, using test cases, and reconciling the data feeding the system with source systems so that no transactions are silently dropped. A rule that is perfectly calibrated is of no use if a product's transactions never reach it.
The findings from quality assurance should feed back into tuning and training. If analysts routinely close a certain type of alert, that rule may need recalibration. If they disagree about the same pattern, the procedures may need to be clearer. This is what turns three separate activities into a single cycle of improvement.
Measuring and governing performance
The board cannot oversee what it cannot see. The CBUAE expects senior management to receive regular updates on the performance and output of the monitoring program, and the QCB Instructions require regular and timely information on the management of ML/TF risk to reach the Board. The HKMA describes institutions tracking indicators such as alert volumes, cases warranting further investigation, false positive rates and suspicious transaction report rates, and reporting them to an oversight committee quarterly. It also stresses that "Management oversight and governance are critical to maintaining an effective and efficient transaction monitoring system."
Useful reporting shows trends over time and by segment and scenario, not just totals. It should also show coverage, meaning which risks in the risk assessment are monitored and which are not, along with the backlog and the results of quality assurance and independent testing. Where deficiencies are found, the QCB Instructions require the Board to prepare or approve an action plan to remedy them promptly.
Machine learning and network analytics can help prioritize alerts and reveal relationships a rules engine will miss. They do not remove the need for segmentation, tuning or quality assurance. The HKMA warns that "Models developed based on past data may not always be well-equipped to deal with emerging threats", and expects senior management to remain accountable for decisions supported by these tools.
Questions for senior management
- Can we show how each monitoring scenario maps to a risk in our institutional risk assessment?
- When were our segments and thresholds last tested against our own data, and what changed as a result?
- Do we know what sits just below our current thresholds?
- Does quality assurance cover alert decisions, scenario performance and data completeness?
- Does the board receive monitoring metrics it can act on, including coverage and quality assurance results?
Transaction monitoring will never be perfect. Criminal behavior changes, customers change and products change. What supervisors look for is an institution that understands its own monitoring, tests it honestly and improves it on evidence. Segmentation, tuning and quality assurance, run as one program and reported clearly, are how an institution shows that. Kompass works with compliance teams to test, calibrate and evidence monitoring programs that meet these expectations.