Threshold Tuning at a Remittance MSB
QuickTransfer MSB processes about 18,000 outbound remittances a month, average USD 850, across 12 corridors. Its automated monitoring generates roughly 300 alerts monthly; 92% are closed as false positives, often in under four minutes. In the last 30 days, 31 alerts flagged six customers sending 9–14 transfers each to three shared beneficiaries in the same corridor, each transfer between USD 2,850 and USD 2,980-just below the MSB's internal USD 3,000 enhanced-review trigger and below the USD 10,000 reporting threshold. The six customers opened accounts within eight weeks of each other and share two device fingerprints and one IP address. The transaction monitoring analyst proposes raising the internal threshold to USD 4,500 and adding a rule exception for 'known salary remitters' to cut alert volume by half. The MLRO asks for your view before the model change is submitted to the risk committee.
1. Assess the analyst's threshold proposal using risk-based principles. What is wrong with the reasoning, and what evidence would you require before any tuning?
Read the worked answer
The proposal uses false-positive rate as the only metric. A 92% false-positive rate is not automatically bad; it depends on detection coverage, risk segmentation and the cost of missed activity. Raising the threshold to USD 4,500 would place the observed USD 2,850–2,980 pattern outside the rule, which is exactly the behavior that needs review. The 'known salary remitters' exception is also risky because salary status is not a stable risk indicator and can be used as cover.
Before tuning, require segmentation by corridor, customer type, product and tenure; alert-to-case and case-to-SAR conversion; backtesting against known typologies and prior SARs; analysis of the six-customer cluster; data-quality checks; and a lookback to see what the proposed threshold would have missed. Tuning should be a documented model change with independent review, not an analyst workaround.
2. How should the six-customer cluster be investigated and dispositioned, and what typology indicators matter?
Read the worked answer
Treat it as a potential structuring or smurfing network. Indicators include transfers kept just below the internal and reporting thresholds; multiple customers onboarded in a short window; shared beneficiaries, devices and IP; and similar amounts and cadence. Investigate the beneficial ownership and KYC for all six customers; the relationships among them; the ownership and activity of the three beneficiaries; source of funds; adverse media and sanctions; device and IP attribution; and whether one person controls multiple accounts. Interview customers separately and review prior alerts. Disposition may be escalation to investigation, account restriction, and filing an STR/SAR if the activity is not explained. Do not close the alerts individually without a network view.
3. What governance and documentation should accompany a threshold change, including validation and monitoring?
Read the worked answer
Follow the model risk policy: change request, rationale, risk assessment, independent validation, risk committee approval, and a documented rollback plan. Validation should include threshold sensitivity, backtesting, coverage analysis, and impact on SAR volumes. Post-implementation monitoring should track alert volume, conversion, SAR yield, missed-case sampling, and segment-level effects. Run the old rule in parallel or use a shadow period. Document who approved the change, what data was used, and the residual risk. Regulator communication may be needed if the change materially affects detection.