Ask an AML analyst what takes up most of the working day, and the answer is rarely the suspicious cases. It is all the others. The alerts that turn out to be ordinary salary payments, regular transfers to family, or a business customer doing exactly what it has always done. When the queue grows faster than it can be worked, the cases that actually matter become harder to see.
The usual reaction is to look for a better tool. But in most cases the tool is not the problem.
Why false alerts pile up
Transaction monitoring is, at its core, about separating the unusual from the normal. That assumes the system knows what normal looks like for each individual customer. When customer data is thin, the rules have to fall back on generic thresholds that apply to everyone – and a large transfer from a high-turnover business customer ends up assessed the same way as a similar transfer from a student.
Rule sets also tend to grow over time. A new typology, a supervisory finding or an internal incident leads to a new rule. The old ones are rarely removed or adjusted. The result is overlapping rules, thresholds nobody remembers the reasoning behind, and alerts that in practice say the same thing several times over.
The data foundation comes first
Good monitoring rests on three things. The first is customer data: KYC information that is actually up to date, with expected activity, industry, ownership structure and risk classification. The second is transaction data that is complete and consistent across channels, with counterparty, purpose and references intact. The third is entity resolution – the ability to see that the customer in the card system, the online bank and the payment platform is the same person or business, and who they are connected to.
Without this, even an advanced monitoring system is working half blind. Much of the work of reducing false alerts therefore does not lie in the monitoring at all, but in data quality upstream.
Rules, models and explainability
It is tempting to think machine learning solves the problem. Models can be good at catching patterns rules miss, and at prioritising alerts by likely relevance. But in AML it is not enough that something works – it has to be explainable. The investigator needs to understand why a transaction was flagged in order to assess it, and the organisation must be able to show supervisors such as Finanstilsynet that its monitoring is risk-based and targets the risks it is meant to.
In practice, a combination often works best. Clear rules for the known scenarios, and models that support prioritisation and surface what the rules overlook – built so that every outcome can be traced back to concrete factors.
Tuning and the feedback loop from case handling
Case handling is the most valuable data source a monitoring system has, and it is used far too rarely. Every closed alert contains a judgement: was this relevant or not, and why? When outcomes are recorded in a structured way, you can measure which rules actually lead to reported cases and which ones only generate noise.
That turns tuning into a continuous, measurable process rather than an annual review based on gut feeling. Thresholds can be adjusted per customer segment, redundant rules can be phased out, and the effect of each change can be followed over time.
Documentation that stands up to scrutiny
The Norwegian Anti-Money Laundering Act and the EU AML rules require measures to be risk-based and assessments to be documented. That means every rule should have a rationale, every threshold change a history, and every alert a traceable path from transaction to decision. This is not just an obligation – it is also what makes it possible to improve the system without losing control of it.
A pragmatic path forward
Start by measuring. Which rules generate the most alerts, and which of those ever lead to anything? Then look at the customer data behind the noisiest rules – that is often where the room for improvement lies. Make sure case handling records outcomes in a form that can be used, and build tuning in as a regular routine. New models and tools can add a great deal, but they add the most when the foundation beneath them is in place.
At Adventis, we combine domain knowledge of payments, AML and regulatory reporting with building data platforms and integrations. If your monitoring setup creates more work than insight, we are happy to talk about where it makes sense to begin.