The Challenge
A financial institution's transaction monitoring system was generating thousands of alerts monthly, yet the compliance team couldn't find a corresponding increase in actual suspicious activity. Analysts spent hours on false positives, risking the oversight of genuine threats. The institution faced a dilemma: hire more analysts or let alerts age out without review.
The issue wasn't just the volume. The institution's transaction scenarios, based on an outdated risk assessment, couldn't keep up with evolving customer behaviors. High-risk customer segments triggered alerts for routine activities, while new transaction patterns went unrecognized. Each false positive consumed 20-45 minutes of analyst time, making the workload unsustainable.
The Environment and Constraints
The institution operated under the Bank Secrecy Act and AML/CFT laws, requiring risk-based monitoring systems. Any changes needed Board approval, creating a bottleneck. The compliance team couldn't simply disable alerts without justifying the mismatch with the institution's risk profile.
The monitoring tool relied on generic industry scenarios, not tailored to the institution's customer mix. Transaction thresholds treated all business accounts the same, ignoring industry-specific transaction velocities. Despite having two years of false positive data, there was no systematic process for analyzing root causes or integrating findings into scenario design.
Regulatory guidance from the FFIEC BSA/AML Examination Manual stresses that monitoring systems must reflect the institution's actual risk profile. The compliance team needed to prove their scenarios aligned with specific customer, channel, and jurisdiction risks.
The Approach Taken
The compliance team launched a structured false positives risk assessment as a dedicated workstream. They identified risk sources, including AML/CFT laws, internal policies, and transaction monitoring procedures. This revealed that many scenarios were inherited from a vendor's default setup and hadn't been validated against the institution's customer base.
They analyzed 18 months of false positive data, documenting root causes for each category. Some scenarios had thresholds too low for the business customer segment, while others flagged normal industry patterns as anomalies. They also reviewed regulator observations and audit findings related to alert quality.
The analysis showed that high-risk customers generated disproportionate false positives because scenarios didn't account for their legitimate business models. For instance, a customer flagged as high-risk due to jurisdiction exposure might conduct frequent international wire transfers, which the system treated as suspicious.
The team mapped identified risks against existing compliance controls to assess residual risk. They prioritized weak controls for mitigation and developed revised transaction scenarios tailored to different customer categories, incorporating risk profiles, channel characteristics, and product types. For business accounts, they segmented thresholds by industry and documented transaction velocity baselines.
The revised policies and procedures underwent management and Board approval. The compliance team documented their risk assessment methodology, data sources, and rationale for each threshold change. This documentation was crucial for demonstrating to regulators that changes were risk-based, not just workload reductions.
Results and Metrics
The false positives risk assessment became an ongoing process. The compliance team established quarterly reviews of false positive data, reporting results to senior management and the compliance committee. This created a feedback loop: analysts documented root causes, the compliance team analyzed patterns, and management approved refinements.
The institution moved from reactive alert review to proactive scenario tuning. When launching new products or expanding customer segments, the compliance team assessed whether existing scenarios covered associated risks or if new thresholds were needed.
What They Would Do Differently
Reflecting on their approach, the compliance team identified areas for improvement. They should've started the false positives risk assessment earlier, before the backlog became unmanageable. Delaying meant making decisions under pressure rather than through deliberate analysis.
Involving frontline analysts earlier in scenario development would have surfaced practical issues faster. Analysts who review alerts daily understand which scenarios consistently produce false positives, but this knowledge wasn't systematically captured until the formal risk assessment began.
They also wished they'd built stronger data infrastructure from the start. Tracking root causes of false positives in a structured database, rather than narrative case notes, would have simplified pattern analysis. They retrofitted this capability, but doing it upfront would have accelerated the assessment.
Finally, they underestimated the governance timeline. Board approval cycles meant even well-documented scenario changes took months to implement. More frequent management touchpoints during the risk assessment would have smoothed the approval process.
Takeaways for Your Team
False positives aren't just an operational nuisance. They're a compliance risk indicator, signaling misalignment between your monitoring system and your institution's actual risk profile. Treat false positive reduction as a risk management exercise, not just tuning.
Start by identifying your risk sources: applicable laws and regulations, internal policies, monitoring procedures, and the scenarios themselves. Don't assume inherited scenarios from vendors match your current risk profile.
Analyze historical false positive data systematically. Document root causes for each category. Look for patterns: Are certain customer segments over-represented? Do specific scenarios trigger disproportionately? Is there a channel or product type that generates noise?
Map identified risks to existing controls and assess residual risk. Prioritize mitigation where controls are weakest and where false positives drain resources or obscure genuine suspicious activity.
Build governance into your timeline from the start. Policy and procedure changes require management and Board approval. Document your risk assessment methodology, data sources, and rationale thoroughly. Regulators will want to see that your changes are risk-based and defensible.
Make false positives risk assessment an ongoing process. Establish regular review cycles with defined metrics reported to senior management. Your customer base, transaction patterns, and risk profile will continue to evolve. Your monitoring scenarios must evolve with them.
