What is a False Positive in AML?
Last updated: 26 October 2026
What Is a False Positive in AML?
A false positive is an alert that flags legitimate activity, or an innocent customer, as suspicious. In anti-money laundering, it happens when a monitoring or screening system raises a case that investigation then shows to be harmless, such as a customer receiving a large payment before buying a house, or a name that resembles someone on a sanctions list. False positives are the main source of wasted effort in financial crime compliance, because every alert has to be reviewed even when nothing is wrong.
How do false positives differ from other alert outcomes?
The aim is to reduce false positives without creating false negatives, since a missed case carries far greater risk than an unnecessary alert.
Where do false positives occur?
- Transaction monitoring. Rules or models flag unusual but legitimate activity.
- Sanctions screening and name screening. Common names, aliases and transliterations produce near-matches to listed parties.
- KYC and adverse media checks. Stories about someone with the same name, or irrelevant coverage, trigger review.
- Fraud detection. Genuine customer behavior is treated as fraud, which also frustrates customers.
Why do false positives matter?
- Cost and capacity. Analysts spend most of their time clearing alerts that lead nowhere.
- Delay and customer friction. Legitimate payments and onboarding can be held up.
- Alert fatigue. Reviewers handling very large volumes can miss genuine risk.
- Regulatory risk. Backlogs and weak tuning evidence can attract supervisory criticism.
SymphonyAI’s FinCrime Frontier 2026-27 survey found that 37% of respondents report false-positive rates above 50%, including 25.2% above 75%, while only 20.5% keep them below 25%. It also found that 70.8% say 5% or fewer alerts result in escalation or SAR/STR filing, and 21.3% do not track their false-positive rate at all. The report notes that findings are indicators of industry direction, not a statistically representative measure of the market.
What causes false positives?
- Rules and thresholds that are too broad or out of date
- Customers grouped into generic scenarios, instead of segments reflecting how they behave
- Poor or incomplete customer and list data
- Loose fuzzy matching and common or transliterated names
- Duplicate entries across lists and providers
- A lack of context, such as ownership, history or related accounts
- Limited tuning, testing and feedback from investigators
How can false positives be reduced?
- Improve data quality. Clean, complete customer and list data removes avoidable matches, supported by watchlist management.
- Segment and tune. Match scenarios and thresholds to customer behavior, and test changes before and after deployment, including below-the-line testing to confirm nothing important is missed.
- Add context. Use entity resolution and ownership data so the system understands who is behind an alert.
- Use good guy lists. Suppress repeat matches that have already been reviewed and cleared, and review them periodically.
- Prioritize with AI. Machine learning can score alerts, rank them by likelihood of risk and hibernate known false positives.
- Learn from outcomes. Feed investigator decisions back into detection logic.
- Measure it. Track false-positive rate, alert-to-SAR conversion and investigation time, and document the reasons for tuning decisions.
How does AI help reduce false positives?
AI can learn what normal looks like for each customer, enrich alerts with context and triage them so analysts see the most important cases first. Agentic AI can resolve low-risk alerts and prepare cases for review, with human oversight and an audit trail. For example, Absa Group was able to reduce false positive alerts by 77% while still capturing the suspicious activity found by its existing system. See how SymphonyAI transaction monitoring supports this, or read our guide to the best AML transaction monitoring software.
FAQs
What is a good false positive rate in AML?
There is no universal benchmark. Rates depend on the product, customer base and detection approach, so firms should set targets, measure against them and justify their tuning.
What is the difference between a false positive and a false negative?
A false positive is an unnecessary alert on legitimate activity. A false negative is suspicious activity the system fails to flag, which is the more serious risk.
Can false positives be eliminated?
No. Some will always occur, because detection has to be cautious. The goal is to reduce unnecessary alerts without missing real risk.
Does reducing false positives increase regulatory risk?
It can if done carelessly. Regulators expect firms to test and document tuning changes, and to show that coverage has not been weakened.
For more, see anti-money laundering (AML) and suspicious activity reports (SARs).