AML in the Age of AI: Moving Beyond Rules-Based Transaction Monitoring

10 min read

The global financial system spends an estimated $274 billion annually on anti-money laundering compliance. The return on that investment, by most measures, is poor. Less than 1% of illicit funds are seized and frozen. False positive rates in transaction monitoring systems routinely run at 95% or higher — meaning that for every hundred alerts a compliance team investigates, ninety-five or more turn out to be legitimate transactions. The system is expensive, labour-intensive, and largely ineffective at its stated purpose.

The root cause is the architecture of the systems doing the monitoring. Rules-based transaction monitoring — the dominant approach in financial services for the past two decades — was designed for a world of simpler financial products, lower transaction volumes, and less sophisticated financial crime. It has not kept pace with the environment it is supposed to police.

The Rules-Based Problem

Rules-based transaction monitoring works by defining thresholds and patterns that are associated with suspicious activity — transactions above a certain value, transactions to high-risk jurisdictions, unusual frequency of cash deposits. When a transaction matches a rule, an alert is generated. A compliance analyst investigates the alert and determines whether it warrants a suspicious activity report.

The problem is that the rules are static and the criminals are not. Financial crime typologies evolve continuously. Structuring — breaking large transactions into smaller ones to avoid reporting thresholds — is now so well understood that it is taught in compliance training courses. The criminals have moved on to more sophisticated techniques: layering through multiple jurisdictions, using shell companies and nominee directors, exploiting the gaps between different regulatory regimes.

The false positive problem is a direct consequence of the rules-based approach. Rules are blunt instruments. A rule that flags all cash deposits above a certain threshold will catch some genuine money laundering — and a much larger number of legitimate transactions by small businesses, market traders, and individuals who simply prefer cash. The compliance team spends most of its time investigating the legitimate transactions, which means it has less capacity to investigate the genuine suspicious activity that the rules are also generating.

What Machine Learning Offers

Machine learning approaches to transaction monitoring work differently. Rather than matching transactions against predefined rules, they build statistical models of normal behaviour — for individual customers, for customer segments, for the institution as a whole — and flag transactions that deviate significantly from the expected pattern. The models learn from the data, which means they can adapt to changing behaviour patterns without manual rule updates.

The practical benefits are significant. In institutions that have implemented ML-based transaction monitoring, false positive rates typically fall by 50% to 70% compared to rules-based systems. The alerts that are generated are more likely to represent genuine suspicious activity, which means compliance teams can focus their investigative capacity where it matters most.

Network analysis — examining the relationships between accounts, entities, and transactions rather than individual transactions in isolation — is a particularly powerful application. Money laundering typically involves multiple accounts and entities working in coordination. Rules-based systems, which examine transactions individually, are poorly suited to detecting this kind of coordinated activity. Graph-based ML models can identify suspicious network patterns that would be invisible to a rules-based system.

Unsupervised learning approaches — clustering algorithms that identify unusual patterns without being told in advance what to look for — can surface new typologies that have not yet been codified into rules. This is particularly valuable for detecting novel financial crime techniques before they become widespread enough to attract regulatory attention.

The Governance Challenge

The governance challenges of ML-based AML are real and should not be minimised. Regulators in most jurisdictions have been cautious about ML-based transaction monitoring, for understandable reasons. The explainability problem — the difficulty of explaining why a specific transaction was flagged — is a genuine concern in a regulatory context where institutions may need to defend their monitoring decisions to supervisors, courts, or correspondent banks.

The model validation challenge is also significant. Rules-based systems can be validated by testing them against known typologies. ML models require a different validation approach — one that assesses not just whether the model is detecting known patterns, but whether it is generalizing appropriately to new patterns, and whether it is producing disparate outcomes for different customer segments.

The institutions that are navigating these challenges most effectively are those that have adopted a hybrid approach — using ML to prioritize and enrich the alert queue, while maintaining rules-based systems for the specific typologies where rules are most effective and where regulatory expectations are clearest. The ML system reduces the false positive rate; the rules-based system provides the regulatory defensibility that pure ML approaches currently lack.

The Regulatory Conversation

The regulatory conversation about ML-based AML has matured significantly in the past two years. The Financial Action Task Force has published guidance acknowledging the potential of AI and ML in AML/CFT, while emphasising the importance of governance, explainability, and human oversight. The MAS, the FCA, and FinCEN have all issued guidance or discussion papers on the topic.

The direction of travel is clear: regulators want institutions to use better tools, and they are willing to engage constructively on what “better” means in a regulatory context. The institutions that are engaging proactively with their regulators on ML-based AML — sharing their approaches, seeking feedback, and demonstrating the governance frameworks they have built — are finding a more receptive audience than those that are waiting for explicit regulatory permission before moving.

The status quo is not a safe option. A compliance programme that spends $274 billion globally and seizes less than 1% of illicit funds is not meeting its objectives. The question is not whether to move beyond rules-based transaction monitoring. It is how to do so in a way that satisfies regulatory expectations while delivering meaningfully better outcomes.

← Back to All Insights