In plain words
Think of the fraud call you get from your bank when your card is suddenly used in another country at 3am. Someone, or something, noticed that the payment did not look like you. Transaction monitoring is that watchfulness, applied to every payment a financial firm handles.
Software looks at each transaction and at the pattern of transactions over time. It compares them with what is normal for that customer and with known signs of fraud and money laundering. When something stands out, it raises an alert. A trained analyst then reviews the alert and decides: nothing wrong, ask the customer, block the payment, or escalate to the MLRO.
For regulated firms this is not optional. Anti-money laundering (AML) rules require ongoing monitoring of every customer relationship, including the transactions made through it. 1 3
How it works
How transaction monitoring works
From a payment event to a decision someone can defend.
-
1
A transaction happens
A card payment, transfer, top-up or withdrawal is recorded with its amount, parties, country, device and time.
-
2
Rules and models check it
The payment and the recent pattern are compared with rules, risk scores and the customer’s profile from KYC.
-
3
An alert is raised
Anything unusual lands in a review queue, sometimes with the payment held until someone looks at it.
-
4
A person decides and records why
The analyst closes, escalates or reports the case. If there is a real suspicion, the MLRO files a SAR.
Fraud monitoring vs AML monitoring
The two are often confused because they use the same data. They protect against different things, and they work on different clocks.
| Fraud monitoring | AML monitoring | |
|---|---|---|
| Who it protects | The customer and the firm from losing money | The financial system from criminal money |
| Who the bad actor is | Usually someone else: a scammer, a stolen card | Often the customer, or someone using their account |
| Timing | Usually real time, before the money goes | Often after the fact, looking at patterns over days or weeks |
| Typical outcome | Block, challenge or refund | Review, questions, and a report to the authorities if suspicious |
For practical fraud controls, read tips for transaction fraud detection and prevention.
What monitoring usually looks for
Patterns that raise alerts
- Amounts far above the customer’s usual activity
- Many small payments just below a limit
- Money in from many people, straight out to one
- Payments to or from high-risk countries
- Activity that does not match the stated purpose
- Matches against sanctions lists
What it cannot do alone
- Decide whether something is criminal
- Work without accurate customer data
- Fit every product with default rules
- Replace a trained reviewer
- Explain itself to a regulator without records
Rules are easy to explain and audit, but they produce many false alarms. Machine-learning scores can find subtler patterns, but the firm must still be able to explain why a case was flagged. Most firms use both, and tune them over time as they learn what normal looks like for their customers.
Payments are also checked by sanctions screening, which usually runs before money moves. For crypto, the equivalent is KYT, which follows funds on the blockchain.
What to have in place before launch
Clean events
Every transaction with clear states, amounts, parties, countries and timestamps, sent to monitoring as it happens.
Customer context
The risk rating and expected activity from onboarding, so rules can compare behaviour with what was declared.
Rules that fit
A starting rule set agreed with the MLRO and licence holder, with a written reason for each one.
A way to act
Holds, limits and account restrictions the team can apply while a case is reviewed.
A review desk
A queue with the customer’s history in one place, and decisions recorded with reasons.
Testing and tuning
Regular checks that the rules catch what they should, and a record of every change.
Monitoring in the UK, EU and Gulf
The duty to monitor is global, set out in the FATF standards. 2 What differs is the extra pressure each market adds.
| Market | What adds pressure |
|---|---|
| United Kingdom | Ongoing monitoring under the Money Laundering Regulations 2017, plus APP fraud reimbursement rules that make payment firms share the cost of scams, so fraud monitoring on outgoing and incoming payments matters financially too 1 |
| European Union | National AML laws today, and the single EU AML Regulation from July 2027. Instant payment rules have also changed how sanctions checks are done for instant transfers |
| UAE and Saudi Arabia | Federal and Saudi AML laws, with central bank supervision. Remittance corridors and cash-heavy sectors are a common focus |
Example: a wallet tunes its first rules
Sofia leads operations at a new wallet for freelancers. The licence holder requires monitoring from launch day.
- Launch. The team starts with a standard rule set from its monitoring provider. In week one, it raises dozens of alerts, mostly for freelancers receiving their first large invoice payment.
- Tuning. With the MLRO’s approval, Sofia adjusts the rules to compare payments with each customer’s declared income, and documents why.
- A real case. One account starts receiving payments from dozens of strangers and moving them out within minutes. The alert goes to review, the account is restricted and the MLRO files a report.
- Evidence. When the licence holder audits the programme, Sofia shows each rule change, every alert and every decision from the back office.
Common misconceptions
“Buying a monitoring tool means we are compliant.”
The tool raises alerts. Compliance is the reviewing, deciding and recording that follows, and the rules being right for your product.
“Small startups do not need it yet.”
The duty applies from the first customer, and new products with weak controls are attractive to criminals precisely because they are new.
“If no alerts fire, all is well.”
It may mean the rules are too loose. Regulators expect firms to test and tune their monitoring, not just switch it on.
FAQ
What is transaction monitoring in AML?
It is the ongoing review of customers' payments to spot activity that could be money laundering or terrorist financing. Software flags unusual transactions, and trained staff review the alerts and decide whether to report them.
Is transaction monitoring a legal requirement?
Yes, for regulated firms. UK and EU anti-money laundering rules require firms to monitor the business relationship on an ongoing basis, including the transactions customers make, and to look more closely at higher-risk customers.
What is the difference between fraud monitoring and AML monitoring?
Fraud monitoring tries to stop a customer from losing money, often in real time before a payment goes. AML monitoring looks for customers using the account to move criminal money, often by spotting patterns over days or weeks. Many firms run both on the same data.
What triggers a transaction monitoring alert?
Common triggers include payments far above a customer's usual amounts, many small payments in a short time, money that comes in and goes straight out, transfers to high-risk countries, and activity that does not fit what the customer said the account was for.
What happens after an alert?
An analyst reviews it, looks at the customer's history and may ask the customer questions. The alert is then closed with a reason, escalated, or passed to the MLRO, who decides whether to file a suspicious activity report.
Can a startup buy transaction monitoring off the shelf?
Yes. Many firms use a specialist monitoring provider, or the tools of their licence holder. The startup still needs to feed it clean transaction data, set rules that fit its product, and give its team a way to review and record alerts.
Sources
-
1
LG
legislation.gov.uk The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017
https://www.legislation.gov.uk/uksi/2017/692/contents -
2
F
FATF Financial Action Task Force
https://www.fatf-gafi.org/ -
3
J
JMLSG Joint Money Laundering Steering Group guidance
https://www.jmlsg.org.uk/
