Transaction Monitoring Rules Template

Transaction monitoring focuses on detecting suspicious activity that may indicate money laundering, terrorist financing, or sanctions violations. It is driven by regulatory requirements (BSA, AML Directives) and results in regulatory reports (SARs, CTRs). Fraud detection focuses on protecting the platform and its users from financial theft. The two overlap significantly in technique (rules, ML models, alert workflows) but differ in purpose and regulatory treatment. Many fintech products operate both systems. See the [fraud detection requirements template](/templates/fraud-detection-requirements-template) for the fraud-focused specification.

Start with regulatory guidance and industry benchmarks. FinCEN advisories and FFIEC examination procedures provide threshold ranges for common typologies. Then calibrate against your own data: run proposed rules against 90 days of historical transactions to estimate alert volume and productive rate. Set thresholds conservatively at first (lower thresholds, more alerts) and tune upward as you gather data on false positives. Document your calibration rationale for examiners.

Industry benchmarks range from 15-30 alerts per analyst per day, depending on case complexity. High-priority alerts (potential SARs) take 45-90 minutes each. Low-priority alerts take 10-20 minutes. If your alert volume exceeds analyst capacity, either hire more analysts, tune rules to reduce false positives, or implement tiered automation (auto-clear obvious false positives, route only ambiguous cases to humans). Use the [AI ROI Calculator](/tools/ai-roi-calculator) to model the cost savings of automating low-risk alert triage.

Regulators expect a written record of every rule change: what was changed, why, the supporting analysis, who approved it, and the before/after impact on detection and false positive rates. Maintain a rule changelog with these fields. If you reduce coverage (raise thresholds, remove a rule), document the risk-based rationale clearly. Examiners may challenge any change that appears to reduce monitoring sensitivity without adequate justification.

Usually yes, though the scope depends on your partnership model. Most BaaS providers (e.g., Unit, Treasury Prime, Synapse) handle CTR filing and some baseline monitoring, but the fintech partner typically retains responsibility for its own risk-based monitoring program. Your regulatory counsel should clarify the division of responsibilities in the BaaS agreement. At minimum, you need visibility into your transaction data and the ability to file SARs for activity your own systems detect. ---