What is Transaction Monitoring?
Last updated: 26 October 2026
What is transaction monitoring in AML?
Transaction monitoring is the ongoing review of customer transactions and activity to detect behavior that may indicate money laundering, terrorist financing or fraud, and to report it where suspicion remains. It is carried out as part of anti-money laundering (AML) regulations, because financial institutions must observe client behavior to abide by laws and regulations in the countries in which they operate.
Transaction monitoring involves assessing customer information, the value of historic and recent deposits, withdrawals and transfers, and customer interactions.
Because so many transactions occur each day, financial institutions use software, the transaction monitoring system (TMS), which typically uses information gleaned from know your customer (KYC) processes that the financial institution already has in place to ascertain the client’s risk to the institution.
The TMS automatically analyzes client data for anomalies, highlighting potential risks that require further manual investigation.
How does an AML transaction monitoring system work?
Traditionally a TMS works using a rules-based system. Should a transaction break a rule, it may be flagged for review. Many systems now also use behavioral and machine learning models, which compare activity with a customer’s own history and with similar customers to find deviations that fixed rules miss. Monitoring can run in real time, reviewing transactions as they happen, or in batches, reviewing activity over a period to find patterns that only emerge over time.
Manually monitoring every transaction is impossible, which means that some questionable movements of money will occur. Financial institutions must therefore decide on their risk level to ensure that they prevent money laundering as best they can while still abiding by regulations and offering their customers the best user experience.
A customer risk score is assigned by looking at everything from their nationality and residency to their profession, and many other categories. Alongside looking at the value of a transaction, monitoring also takes into account customer risk factors such as whether they are PEPs (see PEP – Politically Exposed Persons) or on any sanctions lists, which are identified through screening.
Why is AML transaction monitoring important?
Financial regulators around the world have made transaction monitoring a regulatory requirement. As such, it is now a vital part of meeting AML and counter-terrorist financing (CTF) requirements.
As well as this, the information gleaned from monitoring transactions can be used for filing suspicious activity reports (SARs) and for meeting other legal obligations.
By spotting and stopping questionable transactions with financial crime prevention software, an institution can help prevent illicit funds from moving through the financial system. This has a knock-on effect on illicit activities which might include not just terrorism but also the illegal arms trade, drug smuggling, or sex trafficking.
As might be expected, a low-risk customer won’t need as much monitoring as a high-risk customer, and financial institutions can adjust their monitoring accordingly, in line with a risk-based approach.
Having a good TMS in place gives trust to consumers and regulators. It shows that the financial institution, whether a bank or an insurance company, is doing all it can to meet regulations and prevent criminal activity from occurring.
Is automated or manual transaction monitoring in AML most effective?
Automated transaction monitoring is far more practical than a manual approach at the scale financial institutions operate. It is far faster and cheaper to use anti-financial crime software to monitor transactions, such is the volume of data that financial institutions are dealing with on a day-to-day basis. Manual review is also more prone to inconsistency and error.
Although automated transaction monitoring is better for financial institutions to use, manual monitoring is still required. Because suspicious transactions are discovered using rules, a transaction monitoring system may flag something that is suspicious when it isn’t. For example, a person receiving or spending a lot of money prior to a big life event (getting married, buying a house, etc.). A manual approach from a financial crime investigator is therefore needed to assess whether events have been flagged correctly.
These false positives are the main issue with using automated software. Rules have to be accurate enough to capture suspicious transactions but not so broad that too many false positives occur. This ensures that financial crime investigators aren’t simply spending their time checking obviously non-suspicious transactions when their time could be better spent on genuinely suspicious events.
Thankfully, rules can be customizable depending on the risk level that a financial institution is comfortable with, as well as to follow unique rules for different client types (e.g. somebody working in television who may be paid large sums of money infrequently).
What should you look for in an AML transaction monitoring solution?
An AML transaction monitoring solution should be customizable and scalable for a financial institution to use effectively. This is because it is important for institutions to be able to follow changing regulations as and when they occur.
Alongside this, it is important for anti-financial crime teams to be able to create an audit trail of activity. This is for two reasons: to aid in their own investigations when one team member takes over from another, and also to send on to authorities if suspicious transactions are occurring.
Increasingly, it is also becoming important for transaction monitoring solutions to use AI. If it does, investigators can be a lot more thorough in their searches while also hugely increasing their productivity when it comes to creating a narrative summary for colleagues or writing a suspicious activity report (SAR). Agentic AI goes a step further by gathering evidence, resolving low-risk alerts and preparing cases for investigator review, with human oversight at defined decision points.
What is a suspicious activity report (SAR)?
A suspicious activity report (SAR), also known as a suspicious transaction report (STR) in many jurisdictions, is a key part of the transaction monitoring process. For more information, please see Suspicious Activity Report (SAR).
What is transaction laundering?
Transaction laundering is slightly different from money laundering. Transaction laundering is where criminals create legitimate transactions as a means to launder illicit goods.
Imagine a criminal selling weapons or drugs. They can’t set up an online merchant that advertises the selling of these goods, but they could set up a website that “sells” niche items that appear to be legitimate.
Once the order goes through, the transactions appear to be above board. However, the purchase has actually been placed for the illicit goods sold by the criminal. Because it appears to be a legitimate website to a financial institution, it therefore satisfies the KYC checks they have in place.
The subterfuge works on both sides. The transaction won’t raise alarms for the purchaser or the seller, whose receipt will list the fake website.
Detecting transaction laundering can be difficult but can be made possible through entity resolution as part of customer due diligence (CDD). This allows financial institutions to understand who the beneficial owner of a company is, while they can also analyze the merchant website and connected entities, to better understand the nature of the business.
How does transaction monitoring differ from transaction screening?
Although both processes occur as part of robust anti-money laundering procedures, transaction monitoring identifies suspicious patterns in transactions over time, whereas transaction screening checks the parties and details of individual payments against sanctions and other lists, typically before they are released.
What problems can occur in transaction monitoring?
There are many ways that financial institutions can run into trouble with their AML transaction monitoring if the system isn’t reviewed regularly. Here are just three:
A TMS system may flag too many transactions that do not warrant manual review. These are known as false positives. This slows down investigation teams attempting to catch genuine criminals, increasing operational costs as a result. In most programs, only a small share of flagged transactions result in escalation. As such, an enterprise must regularly review its TMS to address the number of false positives while also making its system robust enough to catch questionable transactions.
AML transaction monitoring can suffer from oversimplification. By wanting to cut down on false positives, a financial institution may group clients and activities into one scenario when this doesn’t solve the issue. In fact, it will eventually lead to more false positives over time when clients behave differently to the scenario in which they’ve been placed. By using greater granularity when segmenting customers, the monitoring is more likely to be accurate and allow for iterations over time.
An institution might have too many rules in place when monitoring transactions with their anti-money laundering software. This can lead to duplication of cases as well as difficulties in managing all of the new scenarios created. This is where a holistic approach to client data can help. By centralizing everything, it is much easier to monitor the transactions and understand what is going on. One such solution is SRI Investigation.
SymphonyAI’s AML transaction monitoring software
SymphonyAI’s transaction monitoring, the next generation of NetReveal, connects the full monitoring lifecycle, from data ingestion to SAR filing, under one adaptive intelligence layer powered by agentic AI. It combines rules with supervised and unsupervised machine learning for detection, uses a triage agent to prioritize alerts, and coordinates investigation agents with human review at critical stages.
Governance is built in, with explainability, audit trails and drift monitoring, so controls stay current and decisions stay defensible to regulators. It runs on Symphony Risk Intelligence (SRI), SymphonyAI’s cloud-native platform for Always-on Compliance. Learn more about Transaction Monitoring.
SRI Augment for Transaction Monitoring
Already have a transaction monitoring system? SRI Augment for Transaction Monitoring adds AI on top of your existing systems, so you can reduce false positives and surface new and hidden risk without replacing what you have. Learn more about SRI Augment for Transaction Monitoring.
FAQs
What is the difference between transaction monitoring and KYC?
KYC establishes who a customer is and how risky they are. Transaction monitoring checks that their activity continues to fit that profile.
How often should transaction monitoring rules be reviewed?
Regularly, and whenever risks, products or typologies change. Many firms review on a set cycle and also when an event suggests the logic is no longer effective.
Does transaction monitoring apply to non-banks?
Yes. Insurers, payment providers, money services businesses, broker-dealers and other regulated firms generally have monitoring obligations suited to their activity.
Where does case management fit in?
Alerts that need investigation move into case management, where analysts record evidence and decide whether to escalate or file a SAR.