Skip to content
Preptima
hardScenarioCase StudySeniorStaffLead

Your transaction monitoring alerts are over ninety per cent false positive. Is that a defect, and what would you do about it?

6 min readUpdated 2026-08-15

Answer

Short answer

It is mostly not a defect. Monitoring is a screening control tuned for recall against a base rate so low that high precision is arithmetically impossible, so the work is measuring the rate honestly, moving volume from rules to models and from analysts to enrichment.

This is an AML transaction monitoring tuning problem. Good AML work separates model threshold, scenario design, data quality, typology coverage, and investigator capacity before lowering alerts. Transaction monitoring is useful only if AML risk remains visible after false positives fall. Weak AML answers celebrate a lower transaction monitoring queue without proving that suspicious behaviour is still being caught.

AML tuning should leave a defensible sample trail for the alerts that disappeared.

Was this answer helpful?

Likely follow-ups

  • How would you evidence to an examiner that raising a threshold did not suppress genuine suspicion?
  • What would you use as a label to train a model, and what is wrong with every option?
  • Two rules alert on the same underlying behaviour for the same customer. What should the analyst see?
  • How does the expected-activity profile captured at onboarding change what your rules need to do?

Related questions

Masterclass guide