AML threshold tuning under capacity pressure
A digital bank's AML transaction-monitoring system generates 18,000 alerts per month; 92% are closed as false positives. The team has 15 analysts, and average time-to-close is 27 days, above the 21-day internal target. A proposed rule change would raise the cash-deposit threshold from $10,000 to $15,000 and remove a velocity rule on peer-to-peer transfers. The vendor estimates a 40% alert reduction. The bank has a large gig-economy customer base with frequent small transfers. Last year, a consent order cited ineffective monitoring at another bank using similar thresholds. The chief compliance officer wants to implement the change in 30 days without a backtest; the head of financial crime wants a three-month parallel run. The bank is under no current enforcement action, but its regulator has requested a monitoring update next quarter.
1. Evaluate the proposed threshold and velocity-rule changes. What are the risks and what analysis is required?
Read the worked answer
The 40% alert reduction is attractive but not sufficient justification. Raising the cash-deposit threshold creates a blind spot between $10,000 and $15,000 and may encourage structuring just below the new threshold. The existing 92% false-positive rate shows tuning is needed, but across-the-board threshold changes can suppress genuine alerts. Removing the peer-to-peer velocity rule is especially risky for a gig-economy customer base, where high-frequency small transfers can be normal income or mule activity. The consent-order precedent shows regulators will challenge threshold changes without evidence.
Required analysis: backtest 12-24 months of alerts and closed cases; compare SAR conversion rates by rule; sample suppressed alerts to estimate missed suspicious activity; segment by customer type; test structuring scenarios; and run a champion-challenger parallel period. Do not implement in 30 days without a backtest.
2. Design the validation and parallel-run approach, including success and stop criteria.
Read the worked answer
Use a three-month parallel run: keep the current rules live, run the proposed rules in shadow mode, and compare alert volumes, disposition outcomes, and SAR yields. Predefine metrics: false-positive rate, SAR conversion, time-to-close, missed-alert rate from a stratified sample of suppressed alerts, and customer-impact measures. Include red-team scenarios for structuring, mule accounts, and gig-economy income patterns.
Success criteria could be at least a 30% alert reduction, SAR conversion not lower than baseline, no material missed alerts in the sample, and time-to-close under 21 days. Stop criteria should include any confirmed missed suspicious activity linked to a suppressed rule, a rise in structuring alerts, or inability to investigate the sample. Keep the velocity rule until the evidence supports removal. If capacity is the driver, redeploy the saved effort into alert quality and investigations rather than cutting headcount.
3. What governance, documentation, and regulatory communication should accompany the change?
Read the worked answer
Treat the tuning as a material change to the financial-crime control framework. Require rule validation, independent review, and approval by the financial-crime committee and board risk committee. Document the rationale, data, testing, limitations, and residual risk. Update the AML risk assessment and monitoring procedures.
Notify or engage the regulator proactively, especially given the consent-order precedent and the upcoming monitoring update; do not wait for the regulator to discover the change. Maintain an audit trail of rule versions, thresholds, and approvals. After implementation, monitor alert volumes, SARs, and missed cases monthly and report to the board. Reject the CCO's 30-day timeline without a backtest; the head of financial crime's three-month parallel run is proportionate. If the bank cannot resource validation, phase the change rather than skip it.