AML Transaction Monitoring Effectiveness: What Your Controls Fail to Detect
Transaction-monitoring effectiveness is often measured through what a system produces: alerts, false-positive rates, investigations, suspicious activity reports and other visible outcomes. The harder control question concerns what the system does not produce—relevant activity that remains outside the alert population because of limitations in data, coverage, scenarios, thresholds, time windows, customer context or relationship analysis. For investigators, MLROs and control owners, the challenge is therefore not simply to improve alert quality, but to establish whether the boundary between selected and unselected activity remains defensible.
Key Points
- An alert population shows what a transaction-monitoring control selected; it cannot, by itself, establish whether materially relevant activity remained outside that population.
- False positives are comparatively visible because they enter an investigative workflow, while false negatives may become apparent only through independent testing, another control, subsequent investigation, external intelligence or retrospective review.
- UK, EU and US evidence shows that monitoring weaknesses can arise at different points in the control architecture, including incomplete data, inadequate scenarios, excluded transaction populations, unsuitable parameters and inadequate investigation of generated alerts.
- A missed case does not automatically prove control failure. Practitioners should reconstruct what was observable at the relevant time, determine what the control was reasonably expected to detect and establish why the activity was not selected.
- Completed investigations can become control intelligence when observable features from a case are tested against the monitoring architecture and used to support proportionate remediation and retesting.
Source: Fraud Intelligence Lab (F.I.L.) original analytical illustration. It is not a statutory test, regulatory model or law-enforcement investigation standard.
In This Article
•The Control Problem — Alerts Reveal Selection, Not the Entire Risk Population
•What the Evidence Actually Establishes
•Model 1 — Original F.I.L. Alert/Non-Alert Control Challenge
•False Positives Are Visible; False Negatives Are Harder to See
•UK Case Study — HSBC and the Anatomy of a Detection Gap
•The Missed-Activity Diagnostic
•The Data Boundary — A Control Cannot Analyse What It Does Not Receive
•The Customer-Context Boundary — Monitoring Is Only as Current as Its Baseline
•Thresholds and Time Windows — The Detection Boundary Is a Control Decision
•Relationship Blind Spots — When the Pattern Exists Between Accounts
•EU Case Study — CCV and the Difference Between Detection and Investigation
•US Case Study — TD Bank and the Consequences of Excluded Coverage
•Control Performance Is Not the Same as Control Coverage
•Independent Testing — Challenging the System with Evidence It Did Not Select
•EU Regulatory Development — Transaction and Activity Monitoring Becomes More Explicit
•AI and Network Analytics — Wider Visibility Is Not Proof of Better Detection
•Alternative Explanations — A Missed Alert Is Not Automatically a Control Failure
•Turning Investigations into Control Intelligence
•Model 2 — Original F.I.L. Investigation-to-Control Feedback Test
•Practitioner Implications — What Investigators, MLROs and Control Owners Should Do Differently
Introduction
Transaction monitoring creates a visible population of activity for investigators, but that visibility can distort how effectiveness is understood. An alert establishes that particular data satisfied the selection logic of a rule, scenario, model or other monitoring process; it does not establish that money laundering occurred. That distinction is consistent with the wider Fraud Intelligence Lab proposition that an alert should define an investigative question rather than determine an investigative conclusion. The more difficult control problem begins on the other side of the selection boundary, where activity never becomes an alert and may therefore never reach an investigator. A monitoring system can generate thousands of apparently useful alerts while failing to select a material transaction type, behavioural sequence or network relationship outside its configured field of view. The absence of an alert consequently tells the practitioner little about the legitimacy of underlying activity unless there is evidence that the control was capable of identifying the relevant behaviour in the first place.
The legal and regulatory context reinforces why this is more than a technical systems question. In the United Kingdom, regulation 28 of the Money Laundering Regulations 2017 requires ongoing monitoring of a business relationship, including scrutiny of transactions for consistency with knowledge of the customer, the customer's business and risk profile, together with keeping relevant information up to date. The FCA's Financial Crime Guide similarly addresses transaction-monitoring rules, thresholds, data and the importance of monitoring arrangements appropriate to the risks involved. In the United States, the FFIEC BSA/AML Examination Manual addresses the periodic evaluation of filtering criteria and thresholds and independent review of monitoring-system methodology. These frameworks are not legally interchangeable, but each illustrates why the existence of a monitoring system is not itself evidence that relevant behaviour will be selected. The practitioner question is what behaviour the control can represent, select and place before a competent reviewer.
The central proposition of this article is that transaction-monitoring effectiveness cannot be established solely from the alerts a system generates. Institutions also need evidence about materially relevant activity their controls did not select, why that activity escaped selection and whether investigations or independent testing reveal weaknesses that should change control design. This does not mean that every unalerted transaction should be investigated or that every subsequently discovered case proves the earlier monitoring framework was defective. Information discovered during an investigation may not have been available when the transactions occurred, while some risks may properly be addressed through controls other than automated transaction monitoring. The analytical task is therefore to distinguish a missed transaction from a missed pattern, a missed pattern from a material coverage weakness, and a case-specific limitation from systemic control failure. That distinction is the foundation of defensible monitoring assurance.
The Control Problem — Alerts Reveal Selection, Not the Entire Risk Population
An alert population provides valuable information about how a monitoring control operates, but it remains a selected population. Institutions can measure which scenarios generate alerts, how frequently analysts escalate them, how long reviews take, which explanations recur and how often particular rules produce activity ultimately assessed as non-suspicious. Those measures can expose poor calibration, duplicated detection, excessive investigative workload and scenarios producing limited intelligence value. They can also help determine whether scarce investigative resources are being directed towards activity that warrants further examination. What those measures cannot establish by themselves is how much materially relevant activity remained outside the alert population. The system's own output cannot therefore be treated as a complete test of the adequacy of the process that selected that output.
This creates a fundamental asymmetry in transaction-monitoring assurance. Selected activity becomes observable because an alert is created, a reviewer examines it, information may be enriched, a disposition is recorded and the case may be escalated. Non-selected activity ordinarily produces no equivalent investigative record because the selection decision has occurred without an analyst examining the underlying activity. A transaction can therefore remain outside the case-management environment not because an investigator reviewed it and found it adequately explained, but because the control never presented it for review. That distinction becomes important when management information is interpreted as evidence of control effectiveness. A declining false-positive rate may demonstrate improved alert precision, but it cannot establish that materially relevant activity has not simultaneously moved outside the selection boundary.
The evidential discipline must operate in both directions. Selection does not establish suspiciousness, just as non-selection does not establish legitimacy. The earlier FIL analysis Fraud Indicators Are Not Evidence: How Investigators Turn Red Flags into Defensible Findings makes the first half of this distinction: an indicator acquires evidential significance through investigation, corroboration, refutation and consideration of credible alternative explanations. The same discipline should govern retrospective analysis of activity that monitoring failed to select. Subsequent evidence that a customer participated in criminal conduct may justify reviewing earlier transactions, but it does not retrospectively make every transaction suspicious. A monitoring review should therefore distinguish what is now known about the case from what the control could reasonably have observed at the time.
What the Evidence Actually Establishes
The primary evidence does not support the simplistic proposition that rule-based monitoring is obsolete or that every false negative demonstrates control failure. Instead, it shows that monitoring effectiveness depends on a chain of design and operational conditions that can fail independently or in combination. The FCA's HSBC findings concern scenario coverage, parameter testing and data completeness; US supervisory material addresses filtering criteria, thresholds and independent review; and the TD Bank criminal resolution demonstrates the consequences of leaving substantial transaction populations outside automated monitoring. Recent Dutch enforcement provides another dimension by showing that weaknesses can arise both in the operation of a monitoring system and in the investigation of alerts it generates. These are related control weaknesses, but they are not interchangeable. The practitioner consequence is that “the system missed it” is a starting observation rather than a root-cause diagnosis.
Those cases must also be interpreted within their evidential limits. The HSBC findings relate to HSBC's particular controls during the period examined by the FCA; the CCV action concerns DNB's findings about that payment institution; and the TD Bank material arises from a particular US criminal resolution and admitted facts. None establishes that comparable weaknesses exist across financial institutions generally, nor do the cases prove that any one monitoring technology is inherently ineffective. Their comparative value lies in demonstrating different mechanisms through which relevant activity can remain undetected or inadequately investigated. A practitioner should therefore use enforcement evidence to test control hypotheses, not to substitute another institution's failure for evidence about their own environment. The appropriate question is whether the same failure mechanism is possible in the control being assessed and what evidence would corroborate or refute that possibility.
The distinction matters because different failures require different remedies. If relevant transactions never reach the monitoring environment, changing a scenario threshold will not solve the problem. If data are complete but the scenario cannot represent the behaviour, data remediation alone will not improve detection. If an appropriate alert is generated but inadequately investigated, the initial detection control may have worked while the investigative process failed to convert the signal into a defensible decision. If relevant information becomes available only after external intelligence or a subsequent investigation, it may be unreasonable to characterise the original non-detection as a control failure at all. Effective assurance therefore requires practitioners to identify the point at which visibility, selection or investigative interpretation was lost.
Model 1 — Original F.I.L. Alert/Non-Alert Control Challenge
Source: Fraud Intelligence Lab (F.I.L.) original analytical framework. It is not a statutory test, regulatory model or law-enforcement investigation standard.
The F.I.L. Alert/Non-Alert Control Challenge separates two questions that are often conflated. The first concerns the quality of selected activity: whether alerts are relevant, timely, intelligible and capable of supporting proportionate investigative review. The second concerns the selection boundary itself: whether materially relevant activity can remain outside it and what evidence the institution uses to test that possibility. Both questions matter because a monitoring system could generate high-quality alerts while still failing to cover an important transaction type, customer population, typology or relationship pattern. Conversely, a scenario generating many false positives may still identify some highly relevant activity, meaning that alert volume alone cannot determine whether it should be retained, recalibrated or replaced. The model therefore treats alert quality and detection coverage as related but analytically distinct dimensions of effectiveness.
The model also prevents a common analytical error: treating the non-alert population as though it had already been assessed. It has not. Most non-alert activity may be entirely legitimate, but that conclusion cannot be inferred merely from the fact that existing controls did not select it. Proportionate sampling, below-the-line testing, retrospective case analysis, independent assurance and comparison with activity identified through other controls can provide evidence about what sits outside the selection boundary. The objective is not to investigate the entire non-alert population, which would defeat the purpose of risk-based selection. It is to establish whether the institution has a defensible basis for believing that the boundary remains appropriately positioned.
False Positives Are Visible; False Negatives Are Harder to See
False positives create operational pressure precisely because they are visible. They generate work, consume analyst capacity, extend queues, produce closure decisions and appear in management information, making them comparatively straightforward to quantify. Institutions therefore have strong incentives to tune scenarios producing large volumes of apparently low-value alerts, particularly where analysts repeatedly reach the same credible benign explanation. Such tuning can be justified where evidence shows that revised parameters improve the relationship between useful detection and unnecessary review. The danger arises when reducing alert volume becomes an objective detached from the behaviour the control was designed to identify. A quieter monitoring system is not necessarily a more effective monitoring system.
False negatives are harder because relevant activity may never enter the investigative workflow. They may become visible only when another control identifies the customer, law enforcement supplies information, another institution reports a relationship, a customer makes a disclosure, an investigation uncovers previously unseen connections or retrospective testing examines unalerted transactions. At that point, practitioners have something particularly valuable: an independently discovered example against which the earlier control environment can be tested. The correct response is not automatically to label the earlier outcome a control failure. Investigators should reconstruct what was observable at the relevant time and determine whether the monitoring control had the data, coverage, scenario logic and configuration necessary to identify it. A missed case becomes useful control intelligence only when the reason for the miss is understood.
This distinction sharpens the relationship between false-positive and false-negative analysis. False-positive analysis asks whether the control selected too much irrelevant activity; detection-coverage analysis asks whether materially relevant activity remained outside the selection boundary. Improving the first does not necessarily improve the second. A threshold change can reduce unnecessary alerts while simultaneously excluding behaviour that would have justified investigation. Conversely, widening a scenario can increase coverage while imposing an investigative workload disproportionate to the additional intelligence obtained. Effective calibration is therefore not the minimisation of either false positives or false negatives in isolation, but a reasoned control decision about risk coverage, investigative capacity and evidential value.
UK Case Study — HSBC and the Anatomy of a Detection Gap
The FCA's enforcement action against HSBC demonstrates how apparently identical outcomes—no useful alert—can originate from different weaknesses. In December 2021, the FCA fined HSBC Bank plc £63.9 million for deficiencies in its transaction-monitoring controls covering the period from 31 March 2010 to 31 March 2018. The FCA identified serious weaknesses in scenario coverage, parameter testing and updating, and the accuracy and completeness of data entering monitoring systems. It found that HSBC had failed adequately to consider whether scenarios covered relevant money-laundering and terrorist-financing risk indicators until 2014 and had failed to conduct timely risk assessments for new scenarios after 2016. It also identified deficiencies in testing and updating parameters used to determine whether transactions were indicative of potentially suspicious activity. HSBC did not dispute the findings and undertook a large-scale remediation programme supervised by the FCA.
The case matters because scenario coverage, parameters and data completeness represent different stages of the detection pathway. Scenario coverage asks whether the monitoring framework contains logic capable of addressing the relevant risk. Parameter configuration asks whether that logic is calibrated so that relevant behaviour can actually satisfy the selection conditions. Data completeness asks whether the information required by the scenario reaches the monitoring environment accurately enough for the logic to operate. Failure at any one of those stages can result in the same observable outcome: relevant activity does not become a useful alert. The appropriate remediation, however, depends on where the pathway failed.
The FCA's HSBC Decision Notice also demonstrates why examining only alerts generated by a system is insufficient when evaluating the position of a detection threshold. Testing activity around and below a selection boundary can provide evidence about whether relevant behaviour is being excluded and whether parameter changes are justified. This does not make every below-threshold transaction suspicious, nor should it be interpreted as requiring indiscriminate investigation of unalerted activity. The analytical purpose is to challenge the boundary using proportionate evidence rather than assume that the system has drawn it correctly. Control testing therefore asks not only whether selected activity was appropriate, but whether materially comparable activity was excluded for defensible reasons.
The Missed-Activity Diagnostic
When materially relevant activity is identified outside the original alert population, practitioners should resist jumping directly from “missed” to “control failure”. The first question is data: was the necessary information available, accurate, complete and delivered to the monitoring environment at the relevant time? The second is coverage: were the relevant customers, products, channels and transaction types within the population being monitored? The third is representation: could the control combine the accounts, counterparties, customer attributes, relationships and behavioural features necessary to make the pattern visible? The fourth is scenario, threshold and time: did appropriate detection logic exist, and did its parameters or monitoring period prevent the behaviour from being selected? The final questions concern workflow and materiality: was an alert actually generated but suppressed, delayed or inadequately investigated, and does the weakness represent an isolated case or evidence of a repeatable control gap?
This diagnostic sequence prevents practitioners from attributing every missed case to the monitoring rule itself. If transactions never entered the monitoring environment, changing a threshold will not solve the problem; if data were complete but relevant relationships could not be represented, data reconciliation alone may be insufficient. If an alert was generated but inadequately investigated, the weakness may concern workflow, analyst capability, enrichment or disposition rather than initial detection. If the behaviour became suspicious only after information unavailable at the time was obtained, the original control may not reasonably have been capable of selecting it. Materiality should therefore be assessed only after the causal mechanism has been understood. Discovery of missed activity and diagnosis of control failure are separate analytical stages.
The Data Boundary — A Control Cannot Analyse What It Does Not Receive
Data completeness is one of the most fundamental limits on transaction-monitoring effectiveness. A scenario cannot reliably identify behaviour using transactions or attributes that never reach the monitoring environment, are mapped incorrectly, arrive too late or cannot be associated with the correct customer or account. The monitoring engine may nevertheless continue generating alerts from the information it does receive, creating an appearance of normal operation. This is why technical availability should not be confused with complete monitoring coverage. Data lineage, reconciliation and completeness testing are not merely technology-governance issues; they determine the population against which financial-crime controls can operate. A control's detection capability is necessarily bounded by the accuracy, completeness and accessibility of its inputs.
The problem extends beyond missing transactions. An institution may hold accurate beneficiary information, device identifiers, company ownership data, customer risk information and payment records in different systems without making the relevant relationships available to the monitoring process. Each dataset may be individually correct while the connection that gives the behaviour investigative significance remains analytically invisible. This is particularly important where laundering activity is distributed across accounts, entities or channels precisely because no single observation appears sufficiently unusual. Practitioners should therefore distinguish data possession from analytical availability. The question is not merely whether the institution holds the information, but whether the relevant control can use it at the time, level of aggregation and relationship context necessary to identify the behaviour.
The Customer-Context Boundary — Monitoring Is Only as Current as Its Baseline
Transaction monitoring also depends on the quality of the behavioural context against which activity is assessed. The UK's Money Laundering Regulations 2017 connect ongoing transaction scrutiny with knowledge of the customer, the customer's business and risk profile, while requiring relevant information to remain current. A monitoring system can therefore calculate transaction values and frequencies accurately while comparing them against a customer profile that no longer reflects legitimate business activity. Conversely, a material behavioural change may remain obscured if the expected baseline is defined so broadly that almost any transaction appears consistent. Effective monitoring depends not only on seeing transactions but on maintaining sufficiently reliable context for interpreting them. Customer information is part of the detection environment rather than merely an onboarding record.
Historical behaviour should itself be treated cautiously. The FFIEC suspicious-activity monitoring guidance emphasises the relationship between monitoring criteria, customer activity and the institution's risk profile. The analytical implication extends beyond threshold maintenance because a long-running pattern does not become legitimate merely through repetition. A behavioural baseline is an expectation constructed from data and customer information, not independent evidence that the behaviour is appropriate. Investigators therefore need to distinguish deviation from expected activity from suspiciousness, while control owners need to test whether the expectation itself remains credible. A system can miss risk by failing to recognise change, but it can also miss risk by normalising historically unusual behaviour.
Thresholds and Time Windows — The Detection Boundary Is a Control Decision
Thresholds convert risk judgements into operational selection boundaries. They specify the values, frequencies, combinations or other conditions under which activity is brought into the investigative workflow, which means that moving a threshold changes what investigators are permitted to see through that control. The FFIEC Manual states that management should periodically evaluate the appropriateness of filtering criteria and thresholds and that monitoring-system methodology should be subject to independent review. This does not establish a universal thresholding methodology, particularly outside the United States. It does establish the broader control principle that a numerical boundary requires a reasoned connection to the activity the control is intended to identify. Numerical precision should not be mistaken for evidential justification.
Testing activity around a threshold can expose assumptions concealed by aggregate performance measures. Suppose a scenario generates an alert when a defined combination of transactions exceeds £10,000 within a particular period, while economically comparable activity at £9,800 remains unselected. The analytical question is not whether £9,800 is suspicious, because it may have an entirely legitimate explanation. The question is what evidence demonstrates that the difference between the selected and unselected populations is meaningful for the risk the scenario is intended to address. Repeated activity immediately below a threshold may support a structuring hypothesis, but investigators must still consider alternative explanations and independent corroboration. Testing below the selection boundary is valuable precisely because it challenges the boundary without presuming criminal intent on the other side of it.
Time windows create a related form of visibility. A scenario examining 24-hour activity may miss a pattern distributed across several weeks, while a monthly aggregate may reveal accumulation but lose the sequencing that gives individual transfers investigative significance. Short windows can improve responsiveness while fragmenting longer behaviour; longer windows can reveal accumulation while producing signals too late for meaningful intervention. There is therefore no universally correct monitoring period independent of the behaviour the control is intended to identify. Control owners should be able to explain why a particular period corresponds to the expected manifestation of the risk and how material activity outside that period is addressed. Time is not simply a system parameter; it forms part of the control's theory of how suspicious behaviour becomes observable.
Relationship Blind Spots — When the Pattern Exists Between Accounts
Some suspicious patterns become visible only through relationships rather than individual transactions. Several accounts may receive funds from unrelated originators before transferring smaller amounts over different days to a common beneficiary, while no individual account crosses a relevant threshold. The significance emerges when counterparties, timing and flow are examined together. Even then, the pattern remains an investigative hypothesis because common beneficiaries can arise from legitimate commercial arrangements, shared services, family relationships or other credible circumstances. The monitoring question is narrower: can the control identify the relationship so that an investigator has the opportunity to test those explanations? A control that cannot represent the relationship cannot rely on later analyst judgement to compensate for visibility that never existed.
This is where monitoring architecture intersects with link analysis. The FIL article Link Analysis in Money Laundering Investigations: Uncovering Hidden Financial Networks argues that relational visibility is analytically valuable without being equivalent to attribution. The same principle should govern network-enabled monitoring. Shared devices, beneficiaries, addresses, counterparties or corporate relationships can expose patterns that transaction-level rules miss, but network proximity does not establish common criminal purpose. The value of relational detection lies in creating a better investigative question, not automating the conclusion. Network position and criminal role remain different propositions.
EU Case Study — CCV and the Difference Between Detection and Investigation
A recent Dutch enforcement action demonstrates that transaction-monitoring weakness can extend beyond whether an alert is generated. In July 2026, De Nederlandsche Bank announced a €2.65 million administrative fine against CCV for failures concerning adequate and continuous transaction monitoring. DNB stated that CCV's transaction-monitoring system did not function properly for a prolonged period and that CCV also failed sufficiently to investigate alerts generated by the system. DNB reported that for more than two years the system was not fully and timely fed with all transactions from CCV's merchants and that transaction profiles for approximately 4,200 merchants were not properly loaded for 23 months. It also identified deficiencies in the ongoing monitoring of alerts it reviewed. The case therefore contains analytically distinct weaknesses in data availability, system operation and investigative follow-through.
The distinction is important because an institution can fail at different stages of the same control pathway. If the system does not receive or appropriately monitor relevant activity, investigators may never receive a signal. If the system generates an appropriate alert but subsequent review is superficial, delayed or inadequately evidenced, the detection opportunity exists but is not converted into investigative intelligence. Those are not the same control failure and should not receive the same remediation. One may require changes to data feeds, monitoring logic or system operation; the other may require changes to investigative procedures, staffing, escalation, enrichment or quality assurance. Transaction-monitoring effectiveness therefore extends from the detection boundary through to the quality of the decision made after selection.
The CCV case also prevents transaction-monitoring effectiveness from being reduced to a purely technological question. A sophisticated monitoring engine cannot compensate for weak investigative review, just as excellent investigators cannot examine activity that the system never presents to them. Control effectiveness depends on the interaction between technology, data, scenario design and professional judgement. That relationship is particularly important for MLROs and assurance functions because performance metrics can isolate each component and obscure the end-to-end outcome. A high alert-generation rate says little about review quality, while strong analyst productivity says little about activity excluded upstream. The appropriate unit of analysis is therefore the complete pathway from observable behaviour to defensible disposition.
US Case Study — TD Bank and the Consequences of Excluded Coverage
The TD Bank criminal resolution provides a particularly stark example of coverage risk because substantial categories of activity were outside automated monitoring. According to the US Department of Justice's TD Bank case materials, the bank excluded significant categories of transactions from its automated transaction-monitoring environment. DOJ materials state that between January 2018 and April 2024 the automated system did not monitor 92 per cent of transaction volume, representing more than $18 trillion in transaction activity. The case also concerned monitoring arrangements that remained substantially static while products, services and risks evolved. TD Bank pleaded guilty in October 2024 to Bank Secrecy Act and money-laundering conspiracy violations as part of the criminal resolution. The case should therefore be understood through its admitted facts and specific US legal context rather than used as a general benchmark for monitoring effectiveness.
The case is particularly relevant because it demonstrates the difference between known risk and operational monitoring coverage. The DOJ's account of the TD Bank criminal resolution describes a transaction-monitoring programme that remained effectively static for years despite known deficiencies, emerging money-laundering risks and new products and services. It states that no new transaction-monitoring scenarios were added and no material changes were made to existing scenarios from at least 2014 through late 2022. This illustrates a control problem that calibration of existing alerts cannot solve: activity outside the monitored population cannot generate an alert through those scenarios regardless of analyst competence. Change management is therefore part of monitoring effectiveness because products, payment channels, customer behaviour and criminal methodologies can change while detection architecture remains static. A control that was once proportionate can become progressively less representative of the risk it is intended to manage.
The TD Bank case also demonstrates why operational constraints and detection criteria should remain distinguishable. DOJ described decisions to postpone or cancel necessary AML projects while prioritising a “flat cost paradigm” and customer experience. Those facts belong to a particular US criminal resolution and should not be generalised into an assumption that every institution facing resource constraints has ineffective monitoring. The broader practitioner lesson is that budget, staffing, customer-friction and operational-capacity decisions can alter what the control environment is capable of observing. Where such considerations influence monitoring coverage, the resulting risk acceptance should be explicit and governed rather than silently embedded within technical configuration. Detection architecture is therefore partly a governance decision about which risks an institution has chosen to make visible.
Control Performance Is Not the Same as Control Coverage
A further distinction follows from the evidence: control performance and control coverage should not be treated as synonymous. A control may perform well against the activity it was designed to select while still providing inadequate coverage of the risk it is expected to address. Performance testing asks whether the control operates as designed; coverage testing asks whether what it was designed to detect remains sufficient for the relevant risk. A technically stable scenario can therefore perform consistently while its underlying assumptions become less representative as products, customer behaviour, payment methods or criminal methodologies change. Conversely, a broad control may cover a material risk while performing poorly because its thresholds or data inputs generate excessive irrelevant selection. Effective assurance requires practitioners to understand both dimensions rather than allow strong performance statistics to conceal weak coverage.
This distinction changes the questions asked during control review. A performance review may examine whether data are processed correctly, rules execute as configured, alerts are generated at expected volumes and cases move through workflow appropriately. A coverage review asks whether relevant customer populations, products, channels, transaction types, behaviours and relationships are represented in the first place. It also asks whether known typologies have been translated into observable features that the control can actually evaluate. Neither review can substitute completely for the other because a correctly functioning control can still be aimed at an incomplete representation of risk. Control assurance should therefore establish not only whether the monitoring system works, but whether it is working on the right problem.
Independent Testing — Challenging the System with Evidence It Did Not Select
Independent testing is valuable because it can reverse the ordinary direction of transaction monitoring. Normally, the system selects activity and investigators determine what that activity means; independent assurance can instead identify activity through another method and ask whether the monitoring system would have detected it. The FFIEC framework expects monitoring criteria and thresholds to be periodically evaluated and monitoring methodology to be subject to independent challenge. This is a US supervisory framework rather than a UK or EU legal requirement, and that jurisdictional distinction should be maintained. Its wider analytical value lies in treating detection capability as something capable of challenge rather than something inferred from the mere existence of a monitoring system. An institution cannot establish the effectiveness of its selection boundary solely by analysing cases that the boundary has already selected.
For practitioners, several sources can provide challenger evidence. A known investigation can be reconstructed against the monitoring environment to determine whether features observable at the relevant time would have triggered an applicable scenario. Samples immediately outside a threshold can be examined for behaviour materially comparable to selected cases, while activity identified by another control can be compared with the transaction-monitoring population. Law-enforcement information, customer reports, retrospective network analysis and quality-assurance reviews can similarly reveal relationships or behavioural patterns that were not originally selected. None of these methods should be used to manufacture a predetermined conclusion that the monitoring system failed. Their purpose is to create an independent reference point from which coverage assumptions can be corroborated or refuted.
EU Regulatory Development — Transaction and Activity Monitoring Becomes More Explicit
The developing EU framework makes the relationship between customer understanding and transaction selection increasingly important. Regulation (EU) 2024/1624 places ongoing monitoring within the EU's new AML framework and provides for AMLA guidelines concerning ongoing monitoring of business relationships and transactions carried out in that context. In June 2026, AMLA opened a consultation on draft Guidelines on ongoing monitoring of business relationships. The developing framework addresses the relationship between keeping customer information current and monitoring transactions and activity over time. The consultation closed in September 2026, so the draft material should not be represented as final binding guidance at the time of writing. This distinction between legislation and developing guidance is important because the latter can inform control planning without being presented as a settled legal requirement.
The developing framework also reinforces the broader analytical point that monitoring cannot be separated from the institution's understanding of the business relationship. Customer information, expected activity, transactions and risk assessment interact to determine what behaviour becomes unusual enough to warrant examination. A technically accurate payment feed may still produce poor monitoring if the customer context against which it is assessed is materially outdated or incomplete. Conversely, unusual activity should not be treated as criminal merely because it deviates from a modelled expectation. Detection remains a mechanism for identifying activity requiring analysis rather than a substitute for that analysis. The quality of customer context therefore affects both what becomes visible and how selected activity is interpreted.
AI and Network Analytics — Wider Visibility Is Not Proof of Better Detection
Artificial intelligence and network analytics can expand the range of behaviour a monitoring environment is capable of representing. Models may combine more variables, identify behavioural deviations, detect relationships across accounts and prioritise patterns that would be difficult to express through a small number of fixed rules. That can materially improve visibility where suspicious significance depends on combinations of activity rather than a single transaction threshold. It can also reduce reliance on static assumptions where behaviour changes rapidly or risk emerges through network structure. Yet broader analytical capability does not eliminate the selection boundary; it changes how that boundary is produced. A model still depends on data, features, assumptions, validation, governance and the quality of outcomes used to evaluate it.
This is why “rules versus AI” is the wrong control question. A transparent rule can be effective where the target behaviour is well defined, while a sophisticated model can perform poorly where data are incomplete, outcomes are unrepresentative or the institution cannot explain why activity was selected. The practitioner should instead ask whether the approach improves detection of behaviour material to the institution's risk while remaining sufficiently testable, explainable and governable. More detected relationships do not necessarily mean better detection, just as more alerts do not necessarily mean better monitoring. Technological sophistication is therefore not an effectiveness metric. Effectiveness must be demonstrated through evidence about coverage, selection, investigation and outcomes.
AI also creates a new version of an old assurance problem. With a simple threshold, practitioners can often identify the selection boundary directly; with a complex model, that boundary may be distributed across numerous features and interactions. This can make false-negative analysis more important rather than less important because the reason activity was not selected may be harder to reconstruct. Independent testing, challenger datasets, outcome analysis and investigation-to-control feedback therefore remain necessary even where monitoring architecture becomes more advanced. Explainability should include not only why a model produced a high-risk output, but sufficient understanding of its limitations to challenge materially relevant non-selection. A control that cannot be challenged because it is sophisticated has replaced one governance problem with another.
Alternative Explanations — A Missed Alert Is Not Automatically a Control Failure
Retrospective analysis carries a serious risk of hindsight bias. Once investigators know that a customer participated in criminal conduct, earlier transactions can appear suspicious in ways that were not reasonably apparent when they occurred. Investigators may possess beneficial-ownership information, witness evidence, device data, law-enforcement intelligence or network relationships that were unavailable to the monitoring environment at the relevant time. It would therefore be analytically unsound to treat every later-discovered suspicious transaction as proof that the original control should have detected it. The appropriate counterfactual question is narrower: given the information reasonably available at the time, should the control have been capable of selecting the observable behaviour? Only then can non-detection be evaluated fairly.
There are also legitimate reasons why particular activity may sit outside one monitoring control. A risk may be addressed through customer due diligence, sanctions screening, fraud monitoring, relationship-manager scrutiny, intelligence-led review, network analysis, manual monitoring or another specialist control. A lower-risk population may also be subject to proportionate monitoring consistent with a documented risk assessment rather than the same intensity applied to higher-risk activity. The existence of a boundary is therefore not evidence of weakness; every risk-based control has boundaries. The practitioner question is whether those boundaries are known, justified, tested and appropriately addressed within the wider control framework. An unknown blind spot is analytically different from a consciously assessed residual risk.
Turning Investigations into Control Intelligence
Completed investigations contain information that monitoring teams may not possess when scenarios are originally designed. Investigators may reconstruct transaction sequences, identify counterparties, establish beneficial ownership, connect accounts or devices, obtain explanations and incorporate information from external sources. Once a case is sufficiently developed, those findings can be compared with the behaviour that the monitoring framework was intended to identify. The purpose is not to rewrite history using information discovered later, but to isolate features that were actually observable when the activity occurred. If those features should reasonably have been detectable, practitioners can test whether the necessary data existed, whether an appropriate scenario covered them, whether parameters were defensible and whether an alert was generated. If they were not observable, the case may instead reveal a new typology or feature that should inform future control design.
This feedback process requires evidential discipline. An unresolved allegation, uncorroborated alert or uncertain association should not automatically become a new transaction-monitoring rule as though the underlying typology had been established. Poorly evidenced feedback can institutionalise investigative assumptions, increase false positives and reproduce bias at scale. The strength of a control change should therefore correspond to the evidential weight of the case from which the proposed change was derived. Confirmed or well-supported cases are particularly valuable because they allow control owners to compare known outcomes with the behaviour that was observable before those outcomes were established. Investigation then becomes not merely the end of the alert process but an input into future control intelligence.
Case closures can provide equivalent learning from the other direction. Repeated alerts closed for the same credible legitimate explanation may reveal that a scenario is selecting behaviour with limited investigative value. Conversely, a case identified through another route may expose behaviour that existing monitoring consistently fails to select. Both outcomes can support calibration when dispositions record sufficiently clear reasoning to distinguish scenario weakness from inconsistent analyst judgement. Investigators are therefore not merely downstream consumers of monitoring output; their findings can become evidence about the quality and limits of the controls that generated—or failed to generate—the case. That feedback loop is weakened when dispositions are generic, poorly evidenced or incapable of being translated into control-learning variables.
Model 2 — Original F.I.L. Investigation-to-Control Feedback Test
Source: Fraud Intelligence Lab (F.I.L.) original analytical illustration. It is not a statutory test, regulatory model or law-enforcement investigation standard.
The F.I.L. Investigation-to-Control Feedback Test prevents two opposite errors. The first is failing to learn from a case because the investigation has already reached its customer-level disposition; the second is redesigning controls around a single case without establishing whether the apparent weakness is reproducible or material. Reconstruction should distinguish information available contemporaneously from information discovered later because hindsight can make behaviour appear more detectable than it actually was. Where a control should reasonably have identified the activity, practitioners should locate the reason for non-detection before choosing remediation. Proposed changes should then be tested against relevant known cases and legitimate activity to understand both improved coverage and the likely effect on false positives. A control change becomes defensible when evidence demonstrates that it improves detection of the intended risk without depending on unsupported assumptions about the behaviour being targeted.
Practitioner Implications — What Investigators, MLROs and Control Owners Should Do Differently
Investigators should treat materially missed activity as a potential control-learning event rather than simply an historical curiosity. Where an investigation establishes a material pattern that monitoring did not identify, the investigator should record which elements of that pattern were observable before investigative enrichment occurred. That distinction enables control owners to separate features that the monitoring environment could reasonably have used from information that became available only later. Investigators should also document credible alternative explanations and the evidence that changed the working hypothesis, because those factors help determine whether a new detection rule would identify genuine risk or merely reproduce hindsight. The objective is not to make investigators responsible for model design. It is to preserve enough analytical information for completed cases to become useful inputs into control assurance.
MLROs and financial-crime leaders should challenge monitoring management information that reports only what happened after selection. Alert volumes, closure rates, escalation rates, ageing and false-positive percentages remain operationally useful, but they should not be mistaken for complete measures of detection effectiveness. Governance should also consider data completeness, known monitoring exclusions, testing around selection boundaries, independent assurance, cases identified through other routes and evidence that scenarios remain aligned with current risks. Material limitations should be expressed explicitly rather than hidden within technical documentation. Senior decision-makers cannot make an informed risk decision about a monitoring weakness they do not know exists. Control reporting should therefore distinguish operational efficiency, control performance and detection coverage.
Control owners should be able to explain the detection theory behind material scenarios. That means identifying the risk being addressed, the observable behaviour expected to represent that risk, the data required, the relationship level at which the behaviour becomes meaningful, the time window used and the rationale for relevant thresholds or exclusions. They should also understand which important behaviours the control is not designed to identify and which other controls address those limitations. Where those questions cannot be answered, the problem is deeper than tuning because the institution may lack a coherent explanation of what the control is intended to observe. A scenario should not survive merely because it has existed for years or produces a manageable number of alerts. Control ownership requires an explanation of why the detection logic remains relevant to the current risk.
Independent assurance should deliberately challenge the control with evidence it did not select. Known cases, retrospective investigations, activity identified through other controls, targeted samples outside selection boundaries and risk-based transaction populations can all provide challenger datasets. The purpose is not to force a predetermined failure finding, but to determine whether assumptions about detection coverage withstand independent examination. Testing should distinguish a single anomalous outcome from a repeatable weakness before concluding that remediation is systemic. Where changes are made, retesting should assess both improved detection and unintended effects on legitimate activity. Assurance is strongest when it can explain not merely that a weakness exists, but why it exists and whether the proposed remediation addresses the cause.
Practitioner Guide
A practitioner reviewing transaction-monitoring effectiveness should begin with the behaviour the control claims to detect rather than the alerts it happens to produce. First, what financial-crime risk is the control intended to identify, and what observable behaviour would make that risk detectable? Second, what transaction, customer, counterparty and relationship data are required to represent that behaviour? Third, are those data complete, accurate and available to the monitoring environment at the relevant time? Fourth, can the control combine the information at the transaction, account, customer or network level at which the behaviour becomes meaningful? Fifth, what scenario, model, threshold and time window define the selection boundary? Sixth, what independently identified cases or challenger samples provide evidence about activity on the other side of that boundary?
The review should then move from visibility to diagnosis. Seventh, where relevant activity was not selected, was the cause missing data, excluded coverage, stale customer context, inadequate representation, scenario design, threshold configuration, an unsuitable time window or another identifiable limitation? Eighth, was an alert actually generated but subsequently suppressed, delayed, inadequately enriched or incorrectly disposed of? Ninth, does the evidence support a case-specific explanation or a repeatable weakness capable of affecting other customers or transactions? Tenth, what remediation is proportionate to the identified cause, and what retesting would demonstrate that the change improved coverage without producing unjustified investigative burden? This sequence prevents the control review from jumping from a missed case directly to a new rule. It makes causal diagnosis a prerequisite for remediation.
Practitioners should also challenge apparently favourable performance measures. Falling alert volumes may indicate better calibration, but they may also reflect a narrower detection boundary. A low false-positive rate may indicate precise selection, but it cannot by itself establish adequate coverage. High escalation rates may demonstrate effective targeting, or they may indicate that the control detects only the most obvious manifestations of risk while missing less conventional behaviour. Model-performance statistics require similar scrutiny because their meaning depends on the quality and representativeness of the outcomes used to evaluate the model. No single alert metric can establish transaction-monitoring effectiveness.
The final decision should concern the control environment rather than the individual alert statistic. A known limitation may be acceptable where it is supported by a documented risk assessment and addressed through another appropriate control. A case-specific miss may require no systemic remediation where necessary information was unavailable or the behaviour could not reasonably have been distinguished at the relevant time. A repeatable failure caused by incomplete data, excluded products, unsuitable thresholds, inadequate relationship analysis or obsolete scenarios is different because the same weakness may continue to affect future activity. The disposition rationale should therefore explain both the evidential finding and the control consequence. Effective monitoring assurance ends with a decision about risk, remediation and retesting—not merely with confirmation that an alert was or was not generated.
Conclusion
Transaction-monitoring systems create investigative visibility, but they also create a boundary between activity selected for scrutiny and activity that remains outside that particular control. Alert volumes, escalation rates, false-positive rates and case outcomes can provide valuable evidence about the selected population, yet none establishes by itself whether materially relevant behaviour is escaping detection. The UK HSBC case demonstrates how scenario coverage, parameter configuration and data completeness can alter that boundary; the Dutch CCV case shows that effectiveness can fail both in system operation and in investigation of generated alerts; and the US TD Bank case demonstrates the consequences of leaving substantial transaction populations outside automated monitoring while risks and products evolve. Across those different jurisdictions, the common analytical lesson is not that every institution requires the same technology or threshold structure. It is that monitoring effectiveness must be tested against the behaviour and risks the control is intended to identify, including evidence from outside the population the control selected.
The most important distinction is therefore between discovery and diagnosis. Finding materially relevant activity that did not generate an alert creates a legitimate control question, but it does not automatically establish that the monitoring framework was defective. Investigators and control owners must reconstruct what was observable at the relevant time, identify which control should reasonably have addressed the behaviour, locate where visibility or selection was lost and determine whether the weakness is case-specific or systemic. That analysis can turn completed investigations into reusable control intelligence while preventing hindsight from being mistaken for evidence of prior detectability. It can also create a disciplined feedback loop in which missed activity informs data remediation, scenario design, threshold calibration, relationship analysis, independent testing and governance where the evidence supports change. The alerts a transaction-monitoring system generates show what the control selected; effective challenge begins by establishing what relevant activity it did not select, why it was missed and what that omission actually establishes about the control.
Methodology and Evidential Note
This article draws principally on primary legislation, regulatory guidance, enforcement decisions and supervisory materials from the United Kingdom, European Union and United States. UK legal propositions are grounded in the Money Laundering Regulations 2017 and FCA material; the EU analysis distinguishes existing EU legislation and Dutch enforcement evidence from AMLA's draft 2026 guidance; and US supervisory and enforcement material is used comparatively rather than presented as UK or EU legal requirements. The HSBC discussion reflects FCA findings for the period specified in the enforcement action, the CCV discussion reflects DNB's July 2026 publication concerning the administrative fine, and the TD Bank discussion reflects the US criminal resolution and admitted facts described in Department of Justice materials. References to suspicious activity, alerts, network relationships, missed detection or investigative hypotheses do not establish criminal conduct, and no monitoring output is treated as proof of money laundering. The F.I.L. Alert/Non-Alert Control Challenge and F.I.L. Investigation-to-Control Feedback Test are original Fraud Intelligence Lab analytical constructs and are not statutory, regulatory, law-enforcement or industry-standard models.
Primary References
2. Financial Conduct Authority — Financial Crime Guide, Chapter 3
3. Financial Conduct Authority — HSBC Bank plc Decision Notice
4. Financial Conduct Authority — HSBC transaction-monitoring enforcement announcement
5. Regulation (EU) 2024/1624 — EUR-Lex
6. Anti-Money Laundering Authority — Consultation on draft Guidelines on ongoing monitoring
7. De Nederlandsche Bank — Administrative fine imposed on CCV
8. FFIEC BSA/AML Examination Manual — Suspicious Activity Reporting
9. FFIEC — Suspicious Activity Reporting Examination Procedures
10. FFIEC — Independent Testing Examination Procedures
11. US Department of Justice — United States v. TD Bank US Holding Company
12. US Department of Justice — TD Bank criminal resolution
