The FCA's shutdown of Euro Exchange Securities UK Limited wasn't just a fine or a warning. It was an operational death sentence. The regulator identified systemic weaknesses in financial crime controls and ordered the firm to stop processing payments entirely. For payment processors handling cross-border flows, cryptocurrency transactions, or merchant services, this case marks a shift: AML failures now trigger business closure, not just penalties.
If your transaction monitoring system can't flag structuring patterns in real time, or if your KYC refresh cycle runs annually instead of continuously, you're operating with the controls regulators deemed insufficient at EES. Here's how to build a monitoring program that survives regulatory scrutiny.
What You Need Before Starting
Regulatory baseline understanding: Review FATF Recommendation 10 (customer due diligence), Recommendation 11 (record-keeping), and Recommendation 16 (wire transfers). If you're UK-regulated, add the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017. US firms need Bank Secrecy Act SAR filing obligations under 31 CFR 1022.320.
Transaction data access: You need query-level access to your payment processing database, including authorization codes, merchant category codes, originating and beneficiary account details, timestamps, and IP geolocation data. If you're using a third-party processor, confirm you can extract this data in near real-time (sub-15-minute latency).
Sanctions screening infrastructure: Deploy OFAC SDN list screening at account opening and transaction time. Download the consolidated XML file from treasury.gov/ofac/downloads/sanctions and integrate it into your onboarding and transaction flow. Refresh it daily.
Baseline metrics: Calculate your current SAR filing rate (SARs filed / total customers) and your alert-to-SAR conversion rate (SARs filed / alerts generated). If you're filing fewer than 0.1% of customer accounts annually or converting fewer than 5% of alerts, your thresholds are likely miscalibrated.
Dedicated compliance headcount: You can't outsource SAR decisions. Assign at least one full-time analyst per 10,000 active accounts for transaction review. For cryptocurrency exposure, double that ratio.
Step-by-Step Implementation
Phase 1: Deploy rule-based transaction monitoring (Weeks 1-4)
Start with velocity rules. Configure alerts for:
- Accounts receiving more than $10,000 in aggregate deposits within 24 hours from multiple sources
- Accounts sending more than five outbound transactions under $3,000 within 48 hours (structuring detection)
- Cross-border transactions exceeding $5,000 to high-risk jurisdictions (reference FATF's list of jurisdictions under increased monitoring)
Use your payment processing platform's native alerting if available. If you're on Stripe, configure Radar rules. For custom stacks, write SQL queries that run hourly against your transaction table and push alerts to a case management system.
Example SQL for basic structuring detection:
SELECT account_id, COUNT(*) as txn_count, SUM(amount) as total_amount
FROM transactions
WHERE created_at > NOW() - INTERVAL '48 hours'
AND amount < 3000
AND direction = 'outbound'
GROUP BY account_id
HAVING COUNT(*) > 5;
Phase 2: Add behavioral anomaly detection (Weeks 5-8)
Calculate baseline transaction patterns for each account:
- Median transaction size
- Typical transaction frequency (transactions per week)
- Geographic distribution of counterparties
Flag deviations exceeding three standard deviations. If an account that normally processes $500 transactions twice weekly suddenly executes fifteen $2,800 transactions in 72 hours, generate an alert.
For cryptocurrency exposure, add wallet address clustering. If multiple customer accounts send funds to the same external wallet within a short timeframe, flag the pattern. Tools like Chainalysis KYT or Elliptic automate this, but you can start with manual address tracking in a spreadsheet for small volumes.
Phase 3: Implement continuous KYC refresh (Weeks 9-12)
Static KYC data expires. Set triggers to re-verify customer information:
- PEP screening every 90 days (query World-Check or Dow Jones Risk & Compliance)
- Beneficial ownership verification annually for business accounts
- Address and identity document refresh when transaction volume increases 300% quarter-over-quarter
Automate PEP screening with API calls. World-Check One offers a REST API that returns match confidence scores. Trigger manual review for any match above 70% confidence.
Phase 4: Build SAR workflow automation (Weeks 13-16)
Create a structured investigation template:
- Alert trigger (which rule fired)
- Customer profile summary (account age, KYC tier, historical transaction volume)
- Transaction narrative (what happened, when, involving which counterparties)
- Red flag checklist (structured deposits, PEP involvement, high-risk jurisdiction, rapid movement of funds)
- Investigator conclusion and SAR filing decision
Use a case management system like Actimize or build a workflow in Jira with custom fields. Track time-to-resolution. Regulations require SAR filing within 30 days of initial detection under BSA rules.
Validation: How to Verify It Works
Test with known patterns: Simulate structuring by creating test accounts that execute multiple sub-threshold transactions. Your system should generate alerts within your configured detection window (hourly or daily).
Measure alert quality: Track your false positive rate weekly. If more than 80% of alerts close as "no action," your thresholds are too sensitive. Adjust velocity limits upward by 20% and re-measure.
Audit SAR completeness: Pull a random sample of 25 filed SARs quarterly. Verify each includes: customer identification, suspicious activity description, transaction details, and a clear narrative. Incomplete SARs create regulatory exposure.
Run regulatory scenario testing: The FATF publishes money laundering typologies annually. Select three scenarios (e.g., trade-based money laundering, cryptocurrency mixing, shell company structuring) and manually trace whether your system would detect them. Document gaps.
External validation: If you're processing more than $100 million annually, engage a third-party AML audit firm. They'll test your system against regulatory expectations and identify blind spots before examiners do.
Maintenance and Ongoing Tasks
Weekly: Review alert queues. Escalate any alerts older than seven days. Update sanctions lists (OFAC publishes emergency updates outside the daily refresh cycle).
Monthly: Analyze alert distribution by rule type. If 60% of alerts come from a single rule, investigate whether that rule needs tuning or whether you're seeing genuine risk concentration.
Quarterly: Recalibrate thresholds based on false positive rates and SAR conversion. Update your risk assessment to reflect new product launches, geographic expansion, or changes in customer mix.
Annually: Conduct independent AML testing under Bank Secrecy Act requirements (if US-regulated) or per MLR 2017 Regulation 19 (if UK-regulated). Document control effectiveness and remediate findings within 90 days.
Continuously: Monitor regulatory enforcement actions. When the FCA shuts down a payment processor or FinCEN assesses a penalty, read the consent order. Extract the specific control failures cited and verify your program addresses them.
Regulators are coordinating across borders, as evidenced by the multi-agency effort that led to EES's closure and the hundreds of criminal investigations involving accounts at other payment firms. Your transaction monitoring program must operate at the same level of sophistication, or you'll be explaining control gaps in an enforcement proceeding instead of a compliance review.
