AML Transaction Monitoring: How Banks Watch Accounts

What AML transaction monitoring is, how the systems and rules work, and what happens from the first alert to a possible SAR filing.

Published	14 October 2026

A bank cannot read every transaction by hand. So a machine watches. People judge what it finds. That is AML transaction monitoring. It is the systems and steps a bank uses to watch accounts. It looks for activity that may be suspicious. That activity may need to be reported.

The FFIEC manual ties the monitoring system to the bank's risk. It says the bank's risk profile should dictate how sophisticated its monitoring systems are. A bank with less risk needs a simpler system. The AML risk assessment is what tells the bank which one it is.

How the pipeline works

Monitoring runs in stages, and each stage feeds the next.

First, capture. The FFIEC manual says surveillance monitoring systems can capture a wide range of account activity directly from the bank's core data processing system. It sees the same data the bank uses to run the accounts.

Second, filter. The bank sets criteria and thresholds. The FFIEC manual says thresholds selected by management for the production of transaction reports should enable management to detect unusual activity. A threshold is a line. Cross it, and the system flags it.

Third, alert. When activity crosses a rule, the system makes an alert. A person reads it.

Fourth, a person reviews the alert and investigates. A person decides whether the alert means anything.

Fifth, decision. The bank decides whether the activity is a reportable transaction for a SAR.

Manual filtering, rule-based systems, and intelligent systems

The FFIEC manual describes a basic manual system. It also describes two kinds of surveillance monitoring system.

The simplest is manual filtering. The FFIEC manual says a basic manual system filters on only one rule. One rule sees one thing.

Next are rule-based systems. The FFIEC manual says rule-based systems flag transactions that fall outside set rules. It says they are more advanced than a manual system that filters on only one rule. Many rules run at once.

Last are intelligent systems. The FFIEC manual says surveillance monitoring systems include rule-based and intelligent systems. It says a surveillance system can cover many types of transactions. It can use various rules to spot activity that may be suspicious.

The FFIEC manual says banks that are large, operate in many locations, or have many higher-risk customers typically use surveillance monitoring systems. The FFIEC manual says most vendor software systems include standard suspicious activity filter reports.

How banks set the rules and thresholds

The FFIEC manual describes thresholds selected by management. It also describes filtering criteria each bank establishes for itself.

The FFIEC manual says system filtering criteria should be developed through a review of specific higher-risk products and services, customers and entities, and geographies.

The FFIEC manual says each bank should establish its own filtering criteria for both individuals and businesses. It also says each bank should set its own filtering criteria for funds transfer activity. The BSA also sets a recordkeeping amount. The FFIEC manual says the BSA requires banks to maintain records of funds transfer in amounts of $3,000 and above.

Some sales records count too. The FFIEC manual says records for monetary instrument sales are required by the BSA. It says a periodic review of these records can help. It can help identify frequent purchasers and common payees.

Setting rules is not a one-time job. The FFIEC manual says banks should review and test system capabilities and thresholds on a periodic basis after they are established. The FFIEC manual also says the programming of the bank's monitoring systems should be independently reviewed. The review checks for reasonable filtering criteria. Someone outside the tuning team checks the math.

From alert to investigation

An alert is a question, not an answer. The investigation is where the bank answers it.

The FFIEC manual says reviews for suspicious activity should cover an extended period of time, such as 30, 60, or 90 days.

Some deals with people who are not customers get a look too. The FFIEC manual says noncustomer funds transfer transactions and payable upon proper identification transactions should be reviewed for unusual activity.

The review may need to be wider. The FFIEC manual says banks may need to conduct a global relationship review to determine if a SAR is warranted when inconsistencies are identified.

When monitoring leads to a SAR

If the bank finds one it must report, it files a SAR. § 1020.320 says reporting may not be delayed more than 60 calendar days after the date of initial detection of a reportable transaction.

The narrative matters. The FFIEC manual says the SAR narrative is the only section that sums up the suspicious activity and is called critical. FinCEN asks for care here. The FFIEC manual says FinCEN asks banks to check the right boxes and put key terms in the SAR narrative to help law enforcement. FinCEN also sends out red flags. These help banks report suspected money laundering, terrorist financing, and fraud. The FFIEC manual says examiners generally should not criticize a bank's reading of the facts because SAR narratives are subjective.

Attachments are possible but limited. The FFIEC manual says the BSAR accepts one Excel compatible csv file attachment up to one megabyte. It says a csv attachment counts as part of the narrative and cannot replace it.

Then comes silence. The FFIEC manual says a bank and its people may not tell anyone involved in a reported transaction that it was reported. It says a SAR and anything revealing a SAR exists are confidential. They are confidential except to meet BSA duties. The FFIEC manual says a SAR attachment is supporting documentation and must be kept confidential to the extent it shows a SAR exists.

The paper trail stays. The FFIEC manual says banks must keep copies of SARs and supporting documents for five years from the filing date. The FFIEC manual says banks must give all documents supporting a SAR filing to FinCEN, law enforcement, or a federal banking agency when asked. It says no legal process is needed to share them. The bank does tell its own leadership. The FFIEC manual says banks must tell the board of directors or a board committee that SARs have been filed.

A separate rule covers named suspects. § 1010.520 says a financial institution must search for transactions by or for a named suspect during the preceding six months.

Where monitoring fits in the program

Monitoring is one working part, not the whole machine. § 1020.210 says customer due diligence includes ongoing monitoring to identify and report suspicious transactions and to update customer information on a risk basis. Monitoring is where that ongoing work happens day to day.

It sits inside the wider AML program, which the BSA anti money laundering rules require of banks. The risk assessment shapes it. The program runs it. Its findings go to the SAR rule.