Transaction Monitoring: Building a Framework That Actually Works

Transaction monitoring is the engine of any AML/CFT programme. It is also, for many businesses, the component most likely to be poorly calibrated, poorly governed, and poorly understood.

The concept is simple: monitor customer transactions against expected behaviour, flag anomalies, investigate alerts, and report genuine suspicion. The execution is anything but. Traditional rule-based systems operate on static thresholds — transactions above a certain amount, certain frequencies, certain patterns. These rules catch the obvious cases but miss sophisticated laundering that operates below thresholds or mimics legitimate behaviour. Worse, they generate false positive rates that routinely exceed 90%, overwhelming compliance teams with alerts that are not suspicious and draining resources from genuine investigations.

The industry consensus in 2026 is that rule-based systems alone are no longer sufficient. The hybrid approach — combining rules for known typologies with AI and machine learning for pattern recognition, anomaly detection, and false positive reduction — is now the expected standard. AI does not replace rules; it enhances them. Rules provide regulatory clarity and auditability. AI provides adaptability and efficiency.

But technology is only part of the answer. A framework that actually works requires four things beyond the monitoring system itself.

First, a genuine understanding of the business's risk profile. The monitoring rules must reflect the specific risks the business faces — the customer types it serves, the products it offers, the jurisdictions it operates in, and the typologies most relevant to its sector. Generic, industry-standard rule sets are a starting point, not a destination.

Second, calibration discipline. Rules and thresholds must be regularly reviewed and adjusted based on emerging risks, investigation outcomes, and regulatory feedback. A threshold that was appropriate two years ago may be generating noise today. Calibration is not a one-time exercise — it is an ongoing governance function.

Third, investigation quality. An alert is only as valuable as the investigation it triggers. The investigation process must be structured, documented, and timely. Investigators need access to the right data, the right tools, and the right training. A backlog of uninvestigated alerts is not just an operational problem — it is a regulatory exposure.

Fourth, governance and documentation. Every element of the monitoring framework — from rule design to threshold calibration to investigation outcomes — must be documented, auditable, and defensible. Regulators expect to see not just that monitoring exists, but that it is governed by a clear risk appetite, tested regularly, and refined based on outcomes.

Blockchain analytics add a further dimension for businesses operating in digital assets. On-chain transaction monitoring — tracking the flow of funds across blockchain addresses — is essential for crypto exchanges and VASPs. The same principles apply: monitoring must be risk-informed, calibrated, investigated, and documented.

At Kybri Consulting Limited, we help regulated businesses design and implement transaction monitoring frameworks that work — from risk-informed rule design and AI integration through to investigation workflows, governance structures, and regulatory demonstration.