Ongoing Monitoring and Transaction Surveillance
Domain 5 tests ongoing monitoring and transaction surveillance: how a firm keeps the customer profile current, how alerts are generated and triaged, and when an alert becomes a suspicious transaction report. The exam favours scenario questions where you must decide the next action after an alert fires.
What ongoing monitoring means
Monitoring has two limbs: scrutinising transactions against the expected profile, and keeping customer information up to date, including sanctions, PEP, and adverse media rescreening. Triggers for review include a transaction outside the expected pattern, a change of ownership or address, a sanctions hit, a law enforcement enquiry, or a periodic review date set by risk rating. Higher-risk customers are reviewed more often.
Surveillance mechanics
Transaction monitoring systems apply rules or scenarios - structuring, rapid movement of funds, activity inconsistent with the stated business, high-risk geography - or behavioural analytics. Thresholds must be tuned: too low and analysts drown in false positives; too high and genuine activity passes. Alerts are triaged, investigated, and closed with a documented rationale. Escalation leads to an STR decision. The system supports the analyst; it does not replace judgement.
Worked example
A small retail customer with a declared monthly income of USD 2,000 and expected deposits of USD 1,500 receives three incoming wires of USD 9,800 each within four days from unrelated third parties, followed by an outbound transfer to a high-risk jurisdiction. Correct reasoning: the activity is inconsistent with the profile in amount, counterparty, and destination. The analyst should review the customer's history, check whether the wires are explained by a documented event, and request information on the source of funds. If the explanation is absent or implausible, escalate for an STR decision. The alert should not be closed simply because each amount falls below a fixed reporting threshold.
Traps that cost marks
Assuming monitoring ends at onboarding; closing alerts without rationale; relying only on fixed thresholds; and failing to update risk ratings after unusual activity.