Alert backlog
Also called alert queue backlog, investigation backlog
An alert backlog is the build-up of transaction monitoring or screening alerts that have not been reviewed within a firm's own deadlines. Backlogs grow when alert volumes outrun analyst capacity. They delay suspicious activity reports and can leave criminal funds moving through accounts unchecked.
How it works
Monitoring systems generate alerts that go into work queues for analysts. Firms set service levels for each stage, such as first review within a set number of days. When volumes spike after a new scenario, a merger or a data fix, or when staff are short, the queue ages. Teams then add staff, prioritise by risk score, close duplicate alerts and tune rules that produce mostly false positives.
Late reviews mean late reports. US rules require a suspicious activity report within 30 calendar days of initial detection. UK law requires disclosure as soon as practicable. Supervisors read a large or ageing backlog as a sign of weak systems and controls. Backlogs have featured in enforcement actions and remediation programmes overseen by independent monitors or skilled persons.
The rules
Requires a SAR within 30 calendar days of initial detection, extendable to 60 days if no suspect is identified.
US banksMakes it an offence not to disclose knowledge or suspicion of money laundering as soon as practicable after it arises.
Firms and staff in the UK regulated sectorCommon questions
What causes an alert backlog?
Usually too many alerts for the available analysts. Common triggers are new or badly tuned scenarios, data fixes that release old alerts, business growth and staff turnover. High false positive rates make each of these worse.
Is an alert backlog a breach of the rules?
A backlog itself is not named in the rules. The risk is what it causes. Late reviews can mean suspicious activity reports filed after legal deadlines and weak systems and controls, both of which supervisors act on.
How do firms clear a backlog?
They add temporary capacity, prioritise alerts by risk and age, close duplicates and automate first-level triage. Lasting fixes come from tuning scenarios and thresholds so fewer low-value alerts reach analysts.
