Most firms believe their Transaction Monitoring framework covers their financial crime risks. Far fewer can demonstrate how financial crime typologies are identified, translated into monitoring controls, supported by complete data and validated through testing.
Coverage gaps rarely appear because a rule is accidentally switched off. More often, they emerge gradually. A new product launches. A payment journey changes. A transaction type is added to a core platform but never reaches the monitoring feed. A rule library remains largely unchanged while the business evolves around it.
Each change appears reasonable in isolation. Over time, however, the connection between the financial crime risk typology the firm faces and the controls intended to detect them becomes increasingly difficult to demonstrate.
This is not simply a governance issue. The Money Laundering Regulations 2017 link each part of that chain. Regulation 18 requires firms to identify and assess their money laundering and terrorist financing risks. Regulation 19 requires policies, controls and procedures that mitigate and manage those risks effectively, including taking account of the risks of new products, practices and technologies before they are introduced. Regulation 28(11) requires ongoing scrutiny of transactions to ensure they are consistent with the firm's knowledge of the customer, their business and their risk profile. A monitoring framework that cannot be traced back to the risk assessment makes all three hard to evidence.
The real question is not, "Do we have transaction monitoring rules?"
It is, "Can we demonstrate that the financial crime risk typologies relevant to our business are understood, appropriately controlled, supported by complete and accurate data, and capable of detecting suspicious activity in practice?"
The four validation steps below provide a practical way to answer that question.
Validation 1: Is your TM risk assessment complete and current?
Everything starts with the TM Risk Assessment (TMRA).
The TMRA should identify the financial crime risk typologies relevant to the firm, assess their inherent risk and document the controls intended to address them.
Before assessing monitoring coverage, confirm the TMRA still reflects the business as it operates today.
Review whether there have been changes to:
- Products and services
- Customer segments
- Payment rails and channels
- Geographic exposure
- Transaction behaviour
- Known financial crime threats
Particular attention should be paid to how products are actually used rather than how they were originally designed.
Personal accounts used for business purposes, savings products used as transactional accounts and newly introduced payment journeys can all create financial crime risks that may not be reflected in product documentation.
Where necessary, update:
- Applicable financial crime risk typologies
- Inherent risk ratings
- Mapped controls
- Coverage assessments
- Priority ratings
The objective is to ensure the TMRA remains the authoritative source of financial crime risk typologies requiring monitoring.
If the TMRA is incomplete or out of date, any subsequent coverage assessment will be unreliable.
Validation 2: Do the documented controls provide the coverage you believe they do?
Once the TMRA has been validated, the next question is whether the documented controls genuinely provide the coverage claimed.
Many firms maintain mappings between financial crime risk typologies and monitoring controls. However, these mappings are often accepted at face value and rarely challenged.
Start with high and medium priority financial crime risk typologies.
For each financial crime risk typology, review the control intended to address it and assess whether its design aligns with the risk being managed.
For TM controls, this means reviewing the underlying rule specifications, including:
- Scenario logic
- Thresholds
- Customer segmentation
- Exclusions
- Aggregation methods
- Lookback periods
The objective is not yet to determine whether the rule works, but whether it is designed to address the financial crime risk typology it claims to cover.
This exercise often identifies situations where coverage exists on paper but is weaker than expected in practice.
For example, a money mule financial crime risk typology may be mapped to a monitoring scenario, but the rule excludes recently opened accounts despite those accounts representing a key risk indicator.
Where gaps are identified, update the documented coverage assessment in the TMRA.
By the end of this step, you should understand the difference between:
- Claimed coverage
- Designed coverage
Validation 3: Can the control actually see the activity it is supposed to monitor?
Even a well-designed rule provides no coverage if the underlying data never reaches it.
This is where many monitoring frameworks fail.
A new transaction type may never be incorporated into a feed. A system migration may introduce mapping issues. A transformation may remove or alter the data required by a scenario.
The objective of this step is to validate the data supporting each monitoring control.
Start by establishing data lineage for the key data elements used by monitoring controls linked to high and medium priority financial crime risk typologies.
For each field, identify:
- Source system
- Transformations applied
- Interfaces traversed
- Data destination within the monitoring platform
Next, perform reconciliation.
Compare transaction volumes and values between source systems and the monitoring platform, broken down by product, channel and processing date.
Investigate:
- Rejected records
- Excluded records
- Missing transaction categories
- Unexpected variances
Finally, assess data quality.
Validate that critical fields relied upon by monitoring scenarios are populated, accurate and consistently available.
A rule designed to identify unusual international activity cannot provide effective coverage if counterparty country information is missing or unreliable.
By the end of this step, you should be able to demonstrate not only that the monitoring logic exists, but that it receives the data required to operate.
Validation 4: Can you prove the control works?
The final step is validating monitoring effectiveness.
At this point, the financial crime risk typology is understood, the control design has been assessed and the supporting data has been validated.
The remaining question is whether the control detects the activity it was designed to identify.
Start with high and medium priority financial crime risk typologies.
Where possible, use historic cases to test scenario performance, including:
- Confirmed suspicious activity
- SAR-driven investigations
- Customer exits
- Internal referrals
- Law enforcement requests
Historical SARs can provide useful test cases, although firms should recognise that many originated from the same monitoring scenarios being tested. Where possible, supplement these with cases identified through other channels.
For new products or emerging financial crime risk typologies where historical cases do not exist, establish initial thresholds based on expected behaviour, run the scenario against live activity, review the resulting alerts and refine the calibration as evidence develops.
Where monitoring is not the primary control, validate the effectiveness of the alternative control and ensure ownership is clearly documented.
A known and accepted gap may represent a conscious risk decision. An unknown gap represents a control failure.
What good looks like
A firm with strong monitoring coverage can select any financial crime risk typology and trace it end to end:
- The TMRA that identified the risk
- The control intended to address it
- The rule specification supporting the control
- The data lineage feeding the rule
- Evidence demonstrating the control operates as intended
Most importantly, it can demonstrate that the monitoring framework reflects the business as it exists today rather than the business that existed when the platform was first implemented.
Coverage assurance is not a one-off exercise or an annual review performed alongside the TMRA. It should form part of ongoing control governance, supported by routine data reconciliation, monitoring change controls and periodic testing.
A more comprehensive review should also be triggered whenever:
- The TMRA changes materially
- A new product launches
- A new payment rail is introduced
- A significant technology change occurs
- New financial crime threats emerge
The firms that maintain that end-to-end traceability are usually the firms that identify coverage gaps before an auditor or regulator identifies them for them.
BeyondFS have a clear view on Transaction Monitoring. If this is something your firm is less than confident about, get in touch.
Sources
- The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, Regulations 18, 19 and 28(11)
