False positive
Also called false alert, false hit
A false positive is an alert that flags legitimate activity or an innocent customer as potentially suspicious. In anti-money laundering and sanctions work, false positives come from transaction monitoring scenarios and name screening matches. Each one needs review before it can be closed, which uses analyst time and can delay customer payments.
How it works
Monitoring systems are tuned to favour catching suspicious activity over avoiding unnecessary alerts. Broad thresholds, poor data quality and weak customer segmentation push alert volumes up. In name screening, common names and loose fuzzy matching create many hits on people who are not the sanctioned party. Analysts review each alert, record why it is not suspicious and close it.
High false positive rates drive cost and backlogs, and can hide genuine risk among noise. Firms reduce them by improving data, segmenting customers, tuning thresholds and adding machine learning to score or rank alerts. Regulators accept such changes when they are tested and documented. A firm cutting alerts must show that it is not missing true suspicious activity, known as false negatives.
The rules
Requires a risk-based transaction monitoring programme with documented scenarios, thresholds and assumptions, pre- and post-implementation testing and an annual compliance certification.
New York-regulated banks, branches of foreign banks, check cashers and money transmittersRequires firms to identify and verify customers and beneficial owners, and to conduct ongoing monitoring including scrutiny of transactions throughout the relationship.
UK banks, payment firms, accountants, lawyers and other relevant personsReplaces SR 11-7 and the 2021 BSA/AML model risk statement with principles-based model risk guidance, scaled to each model's materiality.
Banking organisations, most relevant above $30 billion in total assetsCommon questions
What is a false negative?
A false negative is a genuinely suspicious transaction or sanctioned party that the system fails to flag. False negatives carry the greater regulatory risk, which is why firms test any change that reduces alerts.
What is a typical false positive rate?
Rates vary widely by firm, system and customer base. At many firms, the large majority of transaction monitoring alerts are closed without a suspicious activity report. Firms track this conversion rate as a key measure of effectiveness.
Can AI reduce false positives?
Machine learning can score alerts by risk, group related alerts and filter obvious non-matches. US agencies' 2021 statement on BSA/AML model risk expects such tools to be validated and monitored like other models.
Do regulators penalise high false positive rates?
Regulators focus on effectiveness rather than alert counts. Large unworked alert backlogs and untested tuning have featured in enforcement findings, because they delay the detection and reporting of suspicious activity.
Our coverage
News and analysis on transaction monitoring from RegTech Post.
Read the coverage →RegTech PostRegtech’s Rise in Fighting Financial CrimeRead the article →RegTech PostReal-Time vs Batch AML Monitoring: Key Differences for Compliance TeamsRead the article →
