AML Alert Backlog After a Threshold Change
A digital bank's AML transaction monitoring uses a rules-plus-ML scoring model. The ML model flags the top 2% of transactions by risk score; rules add another 1.5%. At the start of the quarter, the bank lowered the ML threshold from 0.82 to 0.74 to improve detection after a supervisory finding. Alert volume rose from 9,000 to 17,500 per month. The investigations team has 12 FTE analysts; average capacity is 700 alerts per FTE per month, including SAR drafting. The backlog is now 6,200 alerts, and the oldest is 38 days. Regulatory SAR filing deadline is 30 days from detection. The model's precision at the old threshold was 18% (alerts that became SARs); at the new threshold it is 9%. A vendor offers a 'triage model' with 4 months of backtest data and 92% recall on known SARs. The head of financial crime wants to stop using the ML model and revert to rules only.
1. Quantify the capacity gap and backlog risk. What immediate triage options are available?
Read the worked answer
Capacity math. 12 FTE × 700 alerts = 8,400 alerts per month of capacity. Current volume is 17,500, so the monthly gap is 9,100 alerts. The backlog of 6,200 will grow unless volume falls or capacity rises; at current run rates, the team cannot clear it. The oldest alert at 38 days already exceeds the 30-day SAR filing deadline from detection, so there is a live regulatory breach risk.
Immediate options. (1) Triage by risk and age: prioritize alerts with strong SAR indicators, alerts older than 25 days, and high-risk customer/geography/product typologies. (2) Add temporary contract investigators, but require training and quality review; capacity does not appear overnight. (3) Raise the ML threshold back toward 0.78 as a temporary risk-based measure, documented and approved, while keeping rules unchanged. (4) Suspend non-essential alert-generating campaigns or rule expansions. (5) Document all triage decisions and backlog aging for the regulator.
Reasoning. Reverting to rules only or ignoring the backlog are both unsafe. The immediate goal is to stop the deadline breach and preserve evidence of risk-based prioritization.
2. Evaluate the proposal to revert to rules only and the vendor triage model. What do you recommend?
Read the worked answer
Rules only is not a sound response. It may reduce volume, but the supervisory finding was about detection, and rules-only monitoring is easier to evade and may generate more low-value alerts. Reverting would need evidence that detection improves, not just that volume falls.
Vendor triage model. A 92% recall on known SARs is promising, but 4 months of backtest data is short, and recall alone is insufficient: precision, alert reduction, segment coverage, false-negative analysis, explainability, and stability must be tested. The model should be used first as a prioritization layer, not as an automatic closure tool. Keep human review for SAR decisions.
Recommendation. Adopt a hybrid: recalibrate the threshold to a defensible level, use the vendor model in shadow mode to rank alerts, add temporary investigator capacity, and track precision and SAR conversion by segment. Do not stop using the ML model without a validated replacement. Present the plan to the risk committee with a clear statement of residual detection risk.
Reasoning. The objective is effective detection at sustainable volume, not minimum alert count.
3. What model risk management and governance steps are needed before changing thresholds or adopting the triage model?
Read the worked answer
Model risk steps. Independent validation of the threshold change and the vendor model; backtesting on out-of-time data; sensitivity analysis across thresholds; precision/recall and SAR-conversion analysis by customer segment and typology; false-negative review; stability monitoring; and a documented explanation of how the model ranks risk. For the vendor model, obtain the training data lineage, coverage limitations, and performance across the bank's product set.
Governance steps. Risk committee approval for any threshold change, with a documented risk appetite for alert volume and detection. Change management records, audit trail, and quality assurance on triage decisions. Regulatory communication if the backlog has caused late SAR filings. Ongoing monitoring with triggers for precision decay, backlog aging, and volume spikes.
Reasoning. Lowering a threshold is a model change with detection and operational consequences. The bank must show that the change was deliberate, validated, and monitored, not an ad hoc response to a backlog.