Transaction Monitoring Alerts: Tuning, False Positives and What the FCA Guidance Says

Every transaction monitoring system produces alerts that turn out to be nothing, and every compliance team is tempted to reduce them. Done well, tuning makes the system more accurate. Done badly, it just hides risk. The FCA Handbook still carries a useful piece of guidance on the subject: chapter FCTR 4, Automated Anti-Money Laundering Transaction Monitoring Systems. This guide explains what it says about methodology, effectiveness and oversight, and how to apply it. A caution on age: the chapter reproduces a report the Financial Services Authority published in July 2007, and the Handbook page shows it was last updated on 1 November 2024. It remains a reference point, but your own supervisor's current rules and guidance come first.

Why the 2007 report still matters

The Handbook explains that the report was published before the Money Laundering Regulations 2007 made transaction monitoring compulsory, and that the regulations largely codified existing practice. FCTR 4.1.6 says its contents are reflected in the Financial Crime Guide chapters FCG 2 and FCG 3. The chapter lists examples of good practice under five headings: methodologies, development and implementation, effectiveness, oversight, and reporting and review. It does not present poor practice findings, despite its heading referring to both.

Two monitoring methods

The guidance describes two approaches. Profiling compares current activity with historical or peer-group patterns. Rules-based monitoring compares activity with fixed thresholds. Most systems mix both, and each produces false positives for different reasons. Profiling alerts when behaviour changes without a good reason, while thresholds fire for every transaction above a line however ordinary. Knowing which method generated an alert helps you decide how to tune it. For the wider context, including adverse media, see our guide to transaction monitoring and adverse media screening.

What the guidance says about effectiveness and tuning

• Analyse performance rule by rule. Do not assess the system as one lump. Look at how many alerts each rule produces and how many lead to a suspicion, and monitor that consistently over time.
• Do not cut alerts just to improve the statistics. The guidance warns that reducing alert volumes in order to improve performance figures can inflate the proportion of alerts reported as suspicious without improving alert quality.
• Look for what the rules miss. Firms should deploy analytical tools to catch activity that existing rules do not detect.
• Benchmark against like-for-like peers. Comparisons help you see whether your alert volumes and conversion are reasonable.

Development and implementation

The chapter stresses understanding system constraints and data quality, assessing vendors, maintaining database housekeeping and keeping manual suspicion reporting properly resourced. A system fed with poor or incomplete data will produce poor alerts however well it is tuned. It also notes that expectations depend on the nature and scale of the firm, and that smaller firms may monitor effectively using manual procedures. That is worth remembering for accountancy practices, which rarely run automated systems.

Oversight, review and reporting

Senior management should monitor the performance of monitoring systems, especially where issues arise, and major business and IT stakeholders should be closely involved in implementation. Responsibilities for reviewing, investigating and reporting alerts should be clearly allocated to skilled staff who are subject to quality assurance. Our guide to the MLRO annual report shows how monitoring performance can be reported to the board.

A practical tuning cycle

The steps below are our suggestions for turning the guidance into a routine. They are not requirements from the chapter.

1. Record the purpose of each rule. State what behaviour it is designed to catch and why that matters to your business.
2. Measure each rule. Track alerts, how many were closed as not suspicious, how many led to an internal report, and the time to review.
3. Change one thing at a time. Adjust a threshold or parameter, then watch the results before changing anything else.
4. Test before you switch off. Before removing or loosening a rule, check what it would have caught in the past. A rule that rarely fires but catches the serious cases may be worth keeping.
5. Document the reasoning and approval. A change that reduces alerts needs a recorded rationale and sign-off.
6. Look for gaps. Ask what risky behaviour the current rules would not see, such as patterns that spread across several accounts, which links to money mule activity. See our guide to money mules and account misuse.
7. Feed results back. Use findings to update customer risk profiles and the firm-wide risk assessment.

Signs that tuning has gone wrong

These are our own rules of thumb, not text from the chapter. If alert volumes fall sharply but the number of internal suspicion reports does not, you may have removed noise. If both fall together, you may have removed signal. If the percentage of alerts reported as suspicious rises after a big drop in volume, that echoes the guidance warning that the figure may be flattering rather than meaningful. In each case, go back to rule-by-rule analysis.

Frequently asked questions

Does the FCA set a target false positive rate?

The chapter we reviewed does not. It asks firms to analyse performance, benchmark against peers and avoid cosmetic improvements.

Is FCTR 4 current?

The chapter reproduces a 2007 report and was last updated on the Handbook on 1 November 2024. Its contents are reflected in FCG 2 and FCG 3, so check those too.

Do small firms need an automated system?

Not necessarily. The guidance says smaller firms may monitor effectively using manual procedures, depending on their nature and scale.

Who should review alerts?

Skilled staff with clearly allocated responsibilities and quality assurance, according to the guidance.

Next steps

Pick your three noisiest rules and apply the rule-by-rule measures above before changing anything. To build your team's monitoring skills, explore Learnsignal's CPD courses.