Rules-based monitoring
Also called rule-based transaction monitoring, scenario-based monitoring
Rules-based monitoring is transaction monitoring that generates alerts when activity meets fixed conditions set by the firm. Examples include cash deposits above a threshold, rapid movement of funds in and out, or payments to high-risk countries. Each rule maps to a known money laundering typology and produces an alert for review.
How it works
Compliance teams write scenarios from typologies and their own risk assessment, then set thresholds for each customer segment. The system runs the rules against transactions, often overnight, and creates alerts when conditions are met. Teams test the rules above and below the line, tune thresholds and document why each scenario exists and what it covers.
Rules are transparent and easy to explain to supervisors, which keeps them central to most programmes. Their weakness is rigidity. Static thresholds produce high false positive rates and criminals learn to stay just under them. Many banks now add machine learning to score or suppress rule alerts. New York regulators require covered institutions to certify their monitoring programme each year.
The rules
Requires a risk-based transaction monitoring programme with documented and tested detection scenarios and thresholds, certified to the regulator each year by 15 April.
New York chartered or licensed banks, branches, money transmitters and cheque cashersRequires ongoing monitoring of business relationships, including scrutiny of transactions to check they fit the firm's knowledge of the customer.
Firms in the UK regulated sectorReplaced SR 11-7 and SR 21-8, the earlier guidance on model risk including BSA/AML monitoring systems.
Banking organisations supervised by the Federal ReserveCommon questions
Why do rules-based systems create so many false positives?
Thresholds are set broadly to avoid missing real cases, and rules cannot see context such as a customer's normal pattern. Many legitimate transactions therefore meet the conditions and need manual review.
Are rules-based systems still acceptable to regulators?
Yes. Supervisors focus on whether monitoring fits the firm's risks and is tested, tuned and documented. Rules remain the core of most programmes, often combined with machine learning.
What is threshold tuning?
Tuning adjusts rule limits using data. Teams test alerts just below and above current thresholds to see whether productive alerts are missed or unproductive ones can be removed.
What is the difference between rules-based and behavioural monitoring?
Rules flag activity that meets fixed conditions set in advance. Behavioural monitoring compares activity with each customer's or peer group's normal pattern and flags deviations from it.
Our coverage
News and analysis on transaction monitoring from RegTech Post.
Read the coverage →RegTech PostCommerzbank adopts Hawk AI to strengthen AML controlsRead the article →RegTech PostAML in the Digital Age: Building Resilience Across Financial SystemsRead the article →
