Threshold tuning

Spec sheet // Glossary // THRESHOLD TUNINGRev 2026.10
Glossary / T / Threshold tuning
Glossary · Transaction monitoring

Threshold tuning

Also called scenario tuning, below-the-line testing, alert tuning

Definition

Threshold tuning is the process of setting and adjusting the values that trigger alerts in an AML transaction monitoring system. Examples include the amount, number or frequency of transactions a scenario looks for. The aim is to catch suspicious activity while cutting alerts on legitimate behaviour. Firms test, document and approve each change.

TOO LOWLOWTUNEDHIGHTOO HIGH
Fig. 1 · Threshold tuning
NYDFS Part 504 · SR 26-2
Key rulesNYDFS Part 504 · SR 26-2
Applies toNew York-regulated banks, branches of foreign banks, check cashers and money transmitters
RegionsUS · UK · EU · Global
01

How it works

Tuning starts with data. Analysts study historical alerts and their outcomes, often by customer segment. They then run above-the-line and below-the-line testing: sampling activity just under the current threshold to see whether suspicious cases would be missed. Statistical analysis suggests new values. Each change is documented with its rationale, approved through governance and checked again after it goes live.

Regulators treat thresholds as model settings that need evidence. New York's Part 504 requires firms to document detection scenarios, thresholds and assumptions and to test them before and after implementation. US model risk guidance expects validation and ongoing performance monitoring. Untuned or arbitrarily raised thresholds have been cited in enforcement actions, as they can leave suspicious activity undetected.

Step 1SegmentGroup customers with similar expected behaviour.
Step 2AnalyseStudy alert outcomes and transaction distributions per segment.
Step 3TestRun above-the-line and below-the-line sampling.
Step 4ApproveDocument rationale and obtain governance sign-off.
Step 5ReviewMonitor post-change performance and retune periodically.
02

The rules

US · 1 January 2017NYDFS Part 5043 NYCRR Part 504: Banking Division Transaction Monitoring and Filtering Program Requirements and Certifications

Requires a risk-based transaction monitoring programme with documented scenarios, thresholds and assumptions, pre- and post-implementation testing and an annual compliance certification.

New York-regulated banks, branches of foreign banks, check cashers and money transmitters
US · 17 April 2026SR 26-2Interagency guidance on model risk management (Federal Reserve SR 26-2, OCC Bulletin 2026-13, FDIC FIL-15-2026)

Replaces SR 11-7 and the 2021 BSA/AML model risk statement with principles-based model risk guidance, scaled to each model's materiality.

Banking organisations, most relevant above $30 billion in total assets
03

Common questions

What is below-the-line testing?

Below-the-line testing samples transactions that fall just under a scenario's threshold. Analysts review them to see whether suspicious activity is being missed. It shows whether a threshold can be raised safely or should be lowered.

How often should thresholds be tuned?

Rules do not set a fixed frequency. Many firms review thresholds at least annually and after changes to products, customer base or risk assessment. Part 504 requires programmes to be reviewed and updated periodically.

Is threshold tuning the same as model validation?

No. Tuning sets and adjusts thresholds. Validation is an independent review of whether the system and its settings work as intended. US agencies accept that one independent test can serve both BSA/AML and model validation purposes.