Anomaly detection
Also called outlier detection, unsupervised monitoring
Anomaly detection is a monitoring technique that flags activity departing from an expected pattern. Instead of fixed rules, it learns what normal looks like for a customer or peer group and scores deviations. Banks use it to find laundering, fraud and mule activity that predefined scenarios would miss.
How it works
The model builds a baseline from historical data, such as typical amounts, counterparties, channels and timing for each customer segment. New activity is scored against that baseline. Transactions with high anomaly scores become alerts for analysts. Most firms run it alongside rules-based scenarios, so known typologies and new patterns are both covered.
Anomaly detection can catch novel behaviour and cut false positives, but it adds model risk. Supervisors expect the model to be validated, explainable to investigators and monitored for drift. In the US, Federal Reserve guidance SR 26-2 sets model risk management expectations and replaced SR 21-8, the earlier statement on BSA/AML models.
The rules
Revised model risk management guidance superseding SR 11-7 and SR 21-8, the interagency statement on models supporting BSA/AML compliance.
Banking organisations supervised by the Federal ReserveUS agencies encouraged banks to test innovative approaches, including AI, to meet BSA/AML obligations.
US banks and credit unionsCommon questions
How is anomaly detection different from rules-based monitoring?
Rules fire when set conditions are met, such as a cash deposit above a threshold. Anomaly detection learns normal behaviour from data and flags deviations, so it can catch patterns nobody wrote a rule for.
Does anomaly detection replace rules?
Usually not. Most firms combine both. Rules cover known typologies and regulatory expectations, while anomaly models find unusual activity outside existing scenarios. Together they give wider coverage than either alone.
How do regulators view anomaly detection models?
They accept them where the firm can show validation, documentation, explainable alerts and ongoing performance monitoring. Model governance rules such as SR 26-2 in the US apply.
Our coverage
News and analysis on transaction monitoring from RegTech Post.
Read the coverage →RegTech PostReal-Time vs Batch AML Monitoring: Key Differences for Compliance TeamsRead the article →RegTech PostBanks Turn to AI Agents for AML, Fraud Detection and Risk MonitoringRead the article →
