Detection creates volume, not intelligence

Where this pressure most often appears in the customer lifecycle

Onboarding

Ongoing monitoringPrimary

Exit & de-risking

The alerts keep coming. The intelligence doesn’t.

In May 2026, the FCA published findings from its review of firms’ sanctions screening systems and controls. It found that 95% of firms using automated screening had not identified a single true sanctions match against a client since 2022, and 98% had found none in their screened payments over the same period. The FCA’s own conclusion was that firms had materially improved since 2022, with repeated examples of strong controls in practice, but the pattern held: the alerts kept coming and the intelligence did not. Even where a genuine match exists, quality falls away quickly: testing found screening correctly identified an exact name match 90% of the time, dropping to 75% once the name was only a close variant. Fewer than half of firms cleared their name-screening alerts within a single working day, and more than one in five took three to five days to close them.

The Wolfsberg Group made the same point more broadly in July 2024, arguing that the value being derived from an ever-increasing volume of suspicious activity reports is not contributing proportionately to effective outcomes. Firms measure transaction monitoring by alert volume, case volume and alert-to-SAR ratios: metrics that describe how much a system produces, not whether what it produces is any use. Its own illustration: of the suspicious transaction reports filed with Germany’s financial intelligence unit in 2022, only 15.3% were forwarded to law enforcement, and 95% of the cases that were forwarded closed without prosecution.

None of this means the volume is falling. The National Crime Agency received over 800,000 suspicious activity reports in the year to March 2025, level with the year before; banks alone filed the majority of them. The UK Financial Intelligence Unit has said plainly that it is for firms and their supervisors to judge whether that volume is proportionate to the risk it represents. That judgement requires knowing what the alerts are worth, and volume metrics do not show it.

The direction is the same across the EU. AMLA, when it takes direct supervision of selected obliged entities from 2028, will judge monitoring on the intelligence it generates against real risk, not the throughput it produces.

For the team running detection day to day, this doesn’t arrive as a statistic. It arrives as a queue that never empties, filled mostly with alerts closed within minutes because there was never anything to investigate, and occasionally with one that shouldn’t have been closed at all. For whoever has to stand behind the control when a regulator asks, the problem is different but related: a system can be technically compliant, generating alerts, logging dispositions, filing SARs, while still being unable to say with any confidence whether it’s actually catching what it exists to catch.

Clearing the queue is not the same as knowing the risk

A detection rule is built to catch a specific pattern, calibrated against the risk and customer base at the time it’s switched on. Neither stays still. As products, customers and payment patterns change, the rule keeps firing exactly as configured, increasingly against activity it was never really designed to catch, and increasingly at a volume the team was never sized to handle.

Once that happens, the job quietly changes. Clearing the queue becomes the measure of success, not resolving the risk. An alert gets dispositioned because it has to be, not because anyone has established with confidence whether the underlying activity is a problem. Where the picture is genuinely unclear, the safer move is to escalate anyway: a defensive SAR filed to close the file, not because the evidence points somewhere. Both routes, closed or escalated, look the same on paper.

An alert was handled. Neither necessarily means the risk was assessed.

The calibration generating all this noise rarely gets revisited, because revisiting it takes capacity the team doesn’t have while it’s still working through today’s queue. A control built to detect risk starts to run as a machine that manufactures work instead, and detection sits close enough to everything else in the control environment that the effect doesn’t stay contained. Once the alerts a firm produces can’t be trusted, that uncertainty follows the case wherever it goes next, into the file a reviewer reads at onboarding, into the assessment a firm has to stand behind at exit.

The regulator doesn’t see the hours spent clearing the queue. It sees a disposition, and a risk nobody can prove was actually assessed.

How we support you

We work across transaction monitoring, screening and fraud detection to establish where the volume is coming from, what it’s actually worth, and what needs to change.

A typical engagement might involve:

Assess the current position

Profile alert volumes, dispositions and case outcomes across transaction monitoring, screening and fraud detection to see where the noise is actually coming from.

Establish what’s actually required

Map detection rules, scenarios and thresholds against the firm’s real customer base, products and typologies, separating logic that catches genuine risk from logic that just generates work.

Prioritise what needs fixing

Rank the scenarios, thresholds and watchlist issues driving the most volume and the least value, and agree what to recalibrate first.

Redesign the detection logic

Retune rules and thresholds across AML and fraud scenarios, clean up watchlist and reference data, and rebuild alert triage and case management so analysts spend their time on the alerts that matter.

Make it sustainable

Mobilise the change through first and second line teams, embed the recalibrated logic into detection standards, tuning playbooks and analyst procedures, and stand up the model governance, MI and periodic assurance the firm needs to know the calibration is holding, so calibration doesn’t drift back into over-alerting once the immediate backlog is cleared, and the next review finds a system still fit for the risk it’s meant to catch.

We are vendor-agnostic across the monitoring, screening and fraud stacks, so a recalibration lands on what your firm actually runs, not on what a single vendor supports.

The aim is not simply to bring the volume down. It’s to leave the firm with detection that reflects its actual risk, evidence that the calibration was deliberate, and a team spending its time on the alerts that are actually worth investigating.

See our full list of services

Where we’ve done this before

UK challenger bank

Why we were brought on: having already rebuilt onboarding, monitoring and screening procedures following an earlier skilled person review, the bank returned for a second phase focused specifically on the detection layer sitting behind them.

What we did: recalibrated transaction monitoring scenarios and thresholds and re-tuned the screening engine against the bank’s actual risk profile.

Outcome: transaction monitoring and screening optimised as the next phase of the wider enhancement programme.

UK retail bank

Why we were brought on: the bank needed to lead a regulatory-critical re-platform of its adverse media and real-time sanctions screening, spanning onboarding and ongoing monitoring, and needed continuity of programme and systems knowledge its own team couldn’t hold internally.

What we did: embedded a transformation lead to run the re-platform end to end, working across first and second line teams.

Outcome: the engagement has continued across multiple successive extensions, each renewed by the bank’s own leadership as the programme has progressed.

UK asset manager

Why we were brought on: internal audit had identified gaps against financial crime standards spanning AML/CTF, CDD, screening, fraud and transaction monitoring.

What we did: closed the screening and transaction monitoring gaps specifically, as part of the wider standards implementation workstream.

Outcome: screening and transaction monitoring audit gaps closed.

These engagements sit at different points in the same problem: tuning a detection system, leading a re-platform, closing an audit finding. The underlying test is the same. Does the alert reflect a real risk, and can the firm show its working?

50-75%

Our Watchlist Optimisation work has a track record of a 50-75% reduction in low-quality or duplicated list records, the kind of underlying data problem that drives noise regardless of how well the rules themselves are calibrated.

£44m+

FCA fine, December 2025, after ineffective transaction monitoring

£27.3m

24 fraudulent furlough payments over 13 months

£26m

of it within 8 days

A recent industry example shows what’s at stake when detection doesn’t keep pace. In December 2025, the FCA fined a UK building society over £44 million after ineffective transaction monitoring failed to flag a customer using personal accounts to receive fraudulent Covid furlough payments: 24 payments totalling £27.3 million over 13 months, £26 million of it within 8 days, a pattern effective monitoring should have caught. A clear illustration of what happens when a detection system produces activity without producing insight.