Transaction Monitoring for Payment Businesses: Building Systems That Detect What Matters
Transaction monitoring for payment businesses is the ongoing surveillance of financial transactions to detect patterns that may indicate money laundering, terrorist financing, sanctions evasion, or fraud. It is a core BSA/AML obligation for banks, MSBs, and fintech operators, and one of the most practically complex to implement well. A transaction monitoring system that generates too many false positives wastes compliance resources and delays legitimate customer activity. A system calibrated too loosely misses genuine suspicious activity and creates SAR filing deficiencies that attract regulatory attention. Getting transaction monitoring right, for the specific risk profile of a specific payment business, is where the difference between a functional and a dysfunctional compliance program is made. Faisal Khan LLC advises MSBs, fintechs, and crypto businesses on transaction monitoring system selection and program design, and connects businesses to monitoring technology vendors and compliance consultants with calibration experience.
Why Transaction Monitoring Is Required
The BSA requires covered financial institutions to detect and report suspicious activity. Transaction monitoring is the operational mechanism that makes that possible at scale. Without systematic monitoring, an MSB or payment business that processes thousands of transactions per day cannot reliably identify the patterns of structuring, layering, and placement that are the hallmarks of money laundering.
FinCEN enforcement actions against financial institutions consistently cite failures in transaction monitoring as a primary finding: rules that were not calibrated to the actual business, alert queues that were not being investigated, investigation records that were not maintained, and SAR filing rates that were suspiciously low for the volume and risk profile of the business.
Banking partners treat transaction monitoring as a threshold requirement. A payment business seeking a banking relationship is routinely asked to describe its transaction monitoring program, the rules it uses, the volume of alerts generated and investigated, the SAR filing rate, and the staffing dedicated to alert investigation. A business that cannot answer these questions credibly will not be onboarded.
Rule-Based vs. AI-Powered Monitoring
Transaction monitoring systems come in two broad categories, and most mature operations use elements of both:
Rule-based monitoring: Static thresholds and behavioral rules that generate alerts when a transaction or a pattern of transactions meets defined criteria. Examples include: structuring detection (multiple cash transactions just below USD 10,000 within a short window), velocity alerts (a customer conducting an unusually high number of transactions in a short period), round-dollar alerts (transactions in exactly round dollar amounts, which can indicate programmatic activity), geographic risk rules (transactions involving jurisdictions on the business's high-risk country list), and product-specific rules (e.g., for a remittance operator, a customer sending to multiple different unrelated beneficiaries in a high-risk corridor).
Rule-based monitoring is transparent, auditable, and easy to explain to regulators. The weakness is high false positive rates: rules that are set too broadly generate enormous volumes of alerts, most of which are legitimate activity. Alert review fatigue can cause investigators to miss genuine suspicious activity buried in a queue of false positives.
AI and machine learning-based monitoring: Behavioral analytics systems that learn what normal activity looks like for each customer (peer group analysis) and flag deviations from that baseline. Network analytics that map transaction relationships between accounts and identify clusters of connected accounts that may be operating as a coordinated group. Anomaly detection that identifies transactions that are statistically unusual given the customer's history.
AI-powered monitoring generally produces fewer false positives and better detection of complex, layered money laundering schemes. The tradeoff is explainability: regulators and courts want to understand why a transaction was flagged, and "the model said so" is not an adequate explanation. AI-assisted monitoring should be paired with rule-based explainability frameworks.
Transaction Monitoring for MSBs
MSBs have specific monitoring requirements that differ from banks:
Cash-heavy operations: For remittance operators and currency exchangers that handle significant cash, structuring detection is a priority. The USD 10,000 CTR threshold makes cash transactions just below USD 10,000 a specific pattern to monitor. Rapid succession small-denomination cash transactions to the same or related beneficiary are a classic structuring red flag.
Agent network monitoring: MSBs that operate through agents must monitor agent-level transaction patterns, not just aggregate flows. An agent whose transaction volumes suddenly spike, whose customer base is geographically inconsistent with their location, or whose transactions have unusual corridor patterns warrants investigation at the agent level.
Corridor-specific rules: Different payment corridors carry different AML risks. High-risk corridors (e.g., sending to conflict zones, sanctioned countries, or jurisdictions with known narcotics trafficking routes) warrant tighter monitoring thresholds and more aggressive SAR review.
Frequent remitters: Customers who use remittance services at high frequency, particularly to multiple beneficiaries, may be operating as informal value transfer operators (hawala) or structuring payments for third parties. These patterns require EDD and potentially SAR investigation.
Transaction Monitoring for Crypto Businesses
Crypto and stablecoin businesses require a hybrid monitoring approach that combines traditional fiat transaction monitoring with on-chain analytics:
On-chain monitoring: Blockchain analytics tools (Chainalysis Reactor, Elliptic Lens, TRM Labs) enable post-transaction review of on-chain flows: where did funds come from before they arrived in the business's wallet, where did they go after leaving, and what risk flags are associated with the wallet addresses in the transaction chain.
Fiat transaction monitoring: The fiat legs of a crypto payment (customer bank deposits, payout bank transfers) must be monitored using conventional transaction monitoring rules as they would be for any MSB.
Integration between fiat and on-chain monitoring: The most sophisticated crypto compliance programs link on-chain analytics to fiat transaction monitoring so that a high-risk on-chain profile for a customer's wallet can automatically elevate the risk rating applied to that customer's fiat transactions and vice versa.
SAR filing for crypto businesses follows the same FinCEN deadlines and procedures as for traditional MSBs: 30 days from detection (or 60 days if the subject cannot be identified). FinCEN's SAR form has specific fields for virtual currency reporting.
Frequently Asked Questions
How many transaction monitoring alerts is normal for an MSB? There is no universal benchmark; the right alert volume depends on the business's size, risk profile, and monitoring rule calibration. What matters is that the alert rate is consistent with the risk profile of the business, that alerts are reviewed within a defined timeframe, and that investigation decisions are documented. An MSB with very few alerts relative to its transaction volume should be prepared to explain its calibration methodology to examiners; a rate that is too low looks like inadequate monitoring rather than a low-risk book of business.
Do I need a dedicated compliance team to run transaction monitoring? For smaller MSBs with limited transaction volumes, transaction monitoring can be conducted by a part-time compliance function. For businesses processing tens of thousands of transactions per day, dedicated alert investigation staff are required. The staffing level must be proportionate to the alert volume and investigation complexity. Underfunded compliance teams that cannot clear alert queues are a common finding in enforcement actions.
How do I document my alert investigation decisions? Each alert should have a documented investigation record that includes: the alert details, the investigation steps taken, the evidence reviewed, the conclusion (cleared or escalated to SAR), the investigator identity, and the date of disposition. The investigation records must be maintained for five years and be available for examiner review. We advise on alert management workflows and documentation standards.
What makes a good SAR? A well-prepared SAR includes: a clear narrative that answers who, what, when, where, why, and how; a specific description of the suspicious activity including dates, amounts, and account details; a description of the investigation conducted and why the activity cannot be explained by legitimate means; and a clear statement of what law may have been violated. Vague or narrative-free SARs are a common deficiency finding.
Build Transaction Monitoring That Catches What Matters
Transaction monitoring for payment businesses that works is calibrated to the actual risk profile of the business, generates an alert volume that a real compliance team can investigate, produces investigation records that document the decision-making process, and results in SAR filings that are timely, accurate, and useful to law enforcement. Faisal Khan LLC advises on transaction monitoring system selection, rule design, and program structure for MSBs and crypto businesses, connects businesses to transaction monitoring technology vendors, calibration consultants, and compliance staffing solutions, and helps build the operational monitoring program that regulators and banking partners expect to see. If your transaction monitoring needs to be built or substantially improved, we can help.