Fewer AML Alerts: Better Detection or More Missed Crime?

AML alerts, used in anti-money laundering checks, can fall because a system removes needless work or stops finding risks. A shorter queue alone cannot tell a bank which change it has made.

Consider a hypothetical bank testing a new transaction-monitoring model. Its weekly alert count drops, and review staff clear the remaining queue faster. The dashboard looks better.

However, the team has not yet checked the cases the new model no longer flags. Some may be routine payments. Others may contain patterns that need review.

For anti-money laundering teams, the pilot must test both detection and workload. The case for change depends on what the system finds, what it misses, and what staff do with the time it frees.

Define what fewer AML alerts means

An alert is a signal for review. It is not proof of money laundering, and closing it does not prove that no crime occurred.

Start with clear counts. Track total alerts, cases opened, cases escalated, and the work needed at each stage. Also define what the team means by a false positive.

For example, the bank may use that term for alerts that staff close as not suspicious. That is a working label based on the evidence at hand.

Keep the units separate. One case may combine several alerts about the same customer or network. A change that merges duplicates can reduce alerts without changing how much suspicious activity the system finds.

Without these definitions, two teams can report the same improvement while measuring different things.

Test detection alongside the queue reduction

The Financial Action Task Force’s 2021 report on new technologies for AML/CFT examines how technology can improve the efficiency and effectiveness of financial-crime controls. Those are distinct aims to carry into a pilot.

Compare the current system and the new model on the same historical period. Keep separate cases for development and testing so the team does not tune the model to its final test.

Also inspect cases on which the systems disagree. Why did the old system flag a payment that the new model ignored? What did the new model find that the old rules missed?

Use known suspicious cases, expert review, and tests of relevant crime patterns. None gives a full count of hidden crime, so record what the test can and cannot show.

Then sample activity that neither system flags. This can help reveal blind spots, although a sample cannot establish that all unflagged activity is safe.

Look for the risks behind the average

A strong overall result can hide weak coverage of a customer group or crime pattern. Break the review down by products, channels, and the risks the bank faces.

For instance, a model might work well on common domestic transfers but struggle with a less frequent cross-border pattern. The average queue result would give that weakness little weight.

Also examine the age of the evidence. Criminal behavior and customer activity change, so a model needs checks after the pilot ends.

Set a trigger for review when a key pattern stops appearing, an input feed fails, or case quality drops. Name who can pause the model and restore the earlier controls.

Our guide to selecting agentic banking workflows explains why severity, recovery, and detection deserve separate judgments. The same discipline helps when an alert model feeds an automated workflow.

Calculate workload without counting gains twice

Fewer AML alerts may save review time, but the saving needs a sound baseline. Measure the number of items, the time each type takes, and the cost of handling them.

If the model reduces the total queue, do not apply a second reduction for false positives unless it measures a separate change. Otherwise, the business case may count the same removed alerts twice.

Also check the mix of remaining cases. A shorter queue of difficult cases may take more time per item. Using the old average would then overstate the benefit.

Include new work such as testing, model monitoring, quality checks, and keeping data feeds reliable. Vendor fees alone will not capture the running cost.

Finally, state how the bank will use the freed hours. If staff use those hours to clear a backlog or examine complex cases, the gain is capacity. Cash savings need an actual change in spending.

Test whether review staff make better decisions

An AI tool may also assemble evidence or draft a case summary. Faster drafting helps only if the summary supports a sound review.

Check whether it preserves dates, amounts, relationships, and contrary evidence. Staff need access to the source records so they can inspect a claim before relying on it.

Our human review article explains how to test whether reviewers can spot a plausible wrong answer. Use similar tests for summaries that feed an escalation decision.

Also measure rework. A tool that writes quickly but leaves staff fixing omissions may move effort around without reducing it.

Make the pilot decision with both results visible

Before approving wider use, put the change in AML alerts beside the evidence on what the model detects. Show what changed in coverage, case quality, handling time, and delays for customers.

Keep the limits of the test visible too. If the model has not faced a relevant crime pattern, the team should not present that gap as a successful test.

Agree on stop criteria and a fallback owner before launch. A useful monitoring tool should help review staff find and assess risk while reducing avoidable work.

For more practical financial AI analysis, subscribe to FinTech Briefing.