What is AML transaction monitoring?

AML transaction monitoring is the ongoing process of analysing customer activity in order to assess whether their transactions are consistent with the institution’s knowledge of the customer, the nature and scope of their business activity, and the identified money laundering and terrorist financing risk. Transaction monitoring forms part of the broader obligation to conduct ongoing monitoring of business relationships within customer due diligence measures. It is not limited to identifying high-value transfers, frequent transactions, or other deviations from typical parameters.

The key is to compare actual activity with the customer profile built on the basis of information obtained, among other things, during KYC or KYB and throughout the subsequent course of the relationship. If certain activity deviates from the expected profile, an alert requiring analysis may arise. However, an alert does not automatically mean that there is a suspicion of money laundering or terrorist financing or that a notification must be submitted to GIIF.

Monitoring detects a signal. Analysis is intended to determine what that signal means.

What does AML transaction monitoring involve?

The basis for ongoing monitoring of business relationships is set out in Article 34(1)(4) of the AML Act. It includes, among other things:

• analysing transactions carried out within the customer relationship;
• assessing whether they are consistent with the institution’s knowledge of the customer, their business activity, and AML/CFT risk;
• examining the source of funds or other assets where justified by the circumstances;
• ensuring that documents, data, and information concerning the business relationship remain up to date.

Transaction monitoring should therefore not be analysed separately from knowledge of the customer. The reference point is established during KYC or KYB. The institution learns about the customer, their business activity, the purpose of the relationship, the nature of the products used, and other information necessary to assess risk. On this basis, it can determine what type of activity may reasonably be expected within the relationship. Relevant factors may include, among other things:

• transaction value;
• transaction frequency;
• type of transaction;
• parties and counterparties;
• geographic directions;
• the way the product is used;
• changes occurring over time.

Only against this background can actual transactions be assessed. A high-value transfer does not necessarily have to be unusual for a business that regularly makes similar payments. Conversely, a transaction of relatively low value may require analysis if it does not correspond to the customer’s profile, business activity, or previous use of services. A practical model can be simplified as follows:

customer profile → actual activity → deviation → alert or other signal → analysis → decision → update or escalation.

Monitoring does not ask only “is the transaction unusual?”. What matters above all is whether it is unusual for the specific customer and the specific relationship.

Which transactions require additional analysis?

Additional attention may be required primarily for transactions whose nature, value, method of execution, or purpose deviates from the institution’s knowledge of the customer. The AML Act draws particular attention, among other things, to transactions that are:

• complex;
• high-value and not justified by the circumstances;
• carried out in an unusual manner;
• appearing to have no legal or economic justification.

However, there is no universal list of transactions that always indicate suspicion of money laundering. A signal requiring analysis may also include, for example:

• a sudden change in transaction value or frequency;
• the appearance of new geographic directions;
• activity inconsistent with the declared business profile;
• an unusual sequence of incoming and outgoing transactions;
• the appearance of new counterparties or parties to transactions;
• use of a product that differs significantly from previous behaviour;
• the absence of an apparent economic rationale for the transaction.

Unusual activity does not in itself establish money laundering or terrorist financing. It should lead to analysis aimed at understanding the circumstances of the customer’s activity. Depending on the situation, it may be necessary to determine, among other things, the purpose of the transaction, the relationship between the parties, its economic rationale, the source of specific funds or other assets, or whether information previously obtained as part of KYC or KYB remains up to date.

This does not mean that the same set of documents should automatically be requested for every alert or that the source of funds should be examined to the same extent in every case. The scope of the analysis should result from the specific situation and the identified risk. Monitoring may also reveal that the customer’s existing profile no longer reflects reality. In such a case, it may be necessary to supplement the information, update the profile, or reassess the risk.

Unusual activity is a signal requiring clarification, not automatic evidence of money laundering.

What is the difference between transaction monitoring and an AML alert?

Transaction monitoring and an AML alert do not mean the same thing. Transaction monitoring is the continuous process of analysing customer activity. An AML alert, on the other hand, is a signal indicating that certain activity has met criteria requiring review or has otherwise been identified as requiring additional analysis.

An alert may arise, for example, because of:

• transaction value;
• transaction frequency;
• a particular sequence of flows;
• geographic direction;
• a counterparty;
• a change in customer behaviour;
• activity inconsistent with the customer’s profile.

In automated systems, an alert may be generated by a specific rule or scenario. However, a signal requiring analysis may also be identified through a manual process. The mere generation of an alert does not mean that money laundering or terrorist financing has occurred or that a confirmed suspicion already exists.

An alert should be followed by contextual analysis. This may lead to a conclusion that the activity has a rational explanation and the alert can be closed. In other cases, additional information, an update to the customer profile, a change in the risk assessment, enhanced analysis, or escalation may be required.

The correct sequence is therefore:

monitoring → alert or other signal → analysis → findings → decision.

The outcome of the analysis should be appropriately documented together with the rationale for the decision taken.

An alert indicates where to look. It does not determine what the outcome of the analysis will be.

Does transaction monitoring have to be automated?

Not in every case. The AML Act requires ongoing monitoring of business relationships and transaction analysis, but the way in which this process is organised should correspond to the nature, scale, and complexity of the institution’s activities and the risk involved. Where there are only a small number of customers and transactions, part of the monitoring may be performed manually.

The situation is different in an organisation processing significant transaction volumes, where manual review of all transactions may not ensure effective and timely detection of activity requiring analysis. In such cases, appropriately designed IT solutions may form a core element of the monitoring process.

A system may use rules or scenarios designed to identify specific behaviours and deviations. However, they should not operate as a static set of parameters. The effectiveness of monitoring depends, among other things, on:

• data quality;
• an appropriate customer profile;
• proper selection of rules and scenarios;
• their parameterisation;
• updating them as risks and criminal methods evolve;
• timely analysis of generated alerts;
• the quality of decisions made by analysts.

There is no single universal set of rules that would be appropriate for every obliged institution. Different scenarios may be required in a bank, different ones in a payment institution, and still others in an entity serving a small number of business customers.

Effective monitoring is not about generating the largest possible number of alerts. It is about identifying signals that make it possible to properly recognise and analyse risk. Technology supports this process, but it does not replace knowledge of the customer, contextual analysis, or a documented decision.

Does transaction monitoring lead to reporting to GIIF?

It can, but not automatically. Monitoring is primarily intended to identify activity requiring analysis. An alert is one way of highlighting such activity. Only further analysis may lead to findings that trigger a specific obligation towards GIIF.

It is therefore necessary to distinguish between:

monitoring → signal or alert → analysis → findings → potential suspicion → assessment of the applicable reporting obligation.

Not every alert means suspicion of money laundering or terrorist financing. Nor is every unusual transaction automatically a suspicious transaction. The purpose of the analysis is to determine what follows from the available data, whether the activity can be reasonably explained, and whether there are grounds requiring further action under the AML Act.

Transaction monitoring should also be distinguished from obligations to submit information on certain transactions under separate provisions. Exceeding a specific statutory threshold does not in itself mean that there is a suspicion of money laundering. Conversely, activity that may give rise to suspicion may also involve transactions of relatively low value. Monitoring and reporting are therefore related but separate elements of the AML framework.

Monitoring provides the information needed to make a decision. Reporting takes place when the analysis performed leads to grounds requiring specific action under the applicable regulations.

The most important principle is simple:

the purpose of monitoring is not to close an alert. The purpose is to understand the customer’s activity and make a justified, documented, and reproducible decision.