Transaction Monitoring, Screening and Detection Scenarios
Domain 5 tests whether you can distinguish monitoring from screening, design and tune detection scenarios, and disposition alerts defensibly using typologies rather than intuition.
Screening versus monitoring
Screening compares customers and payments against lists, at onboarding, on list updates, and on payment processing. Monitoring looks at behaviour over time against a profile and thresholds. Confusing the two is a common failure: a name match is a screening outcome, a sudden change in cash deposits is a monitoring outcome.
Detection design
- Rule-based scenarios use thresholds, counts and time windows, for example structuring below reporting limits.
- Behavioural scenarios compare activity to the expected profile and peer group.
- Typology-driven scenarios target known methods: rapid pass-through, mule accounts, round-sum transfers, dormancy reactivation, third-party funding.
Thresholds need documented rationale, tuning based on alert outcomes, and periodic validation. Alert triage requires a documented disposition: closed as false positive with reasons, escalated to case, or reported.
Worked example
A customer makes six cash deposits of 9,500 each within ten days across two branches, totalling 57,000, against a profile of salary of 4,000 per month. The scenario is structuring: each deposit sits below the reporting threshold, the aggregate does not, and the activity contradicts the profile. Correct reasoning: the alert is not closed because each individual deposit is unremarkable; aggregation, pattern and profile inconsistency create the suspicion, and the case escalates for review of source of funds before any STR decision.
Screening mechanics
Name screening depends on matching logic: exact versus fuzzy, transliteration, date of birth, nationality and country fields. A partial match is not automatically a false positive; it needs investigation and documented reasoning. Re-screening on list changes is a control in its own right.
Traps that cost marks
- Closing alerts as false positives without a recorded rationale.
- Lowering thresholds to cut alert volume without measuring lost detection.
- Ignoring aggregated activity because each transaction is below a threshold.
- Treating a fuzzy name match as either automatically cleared or automatically blocked.
- No coverage analysis showing which products and channels are monitored.