Transaction Monitoring Source Map

Transaction monitoring detects unusual or potentially suspicious activity by comparing transactions against expected behaviour, risk factors, rules, scenarios and typology indicators. This page maps source materials only; it does not define institution-specific monitoring rules.

1. Source categories #

2. Why public rules are risky #

Static public thresholds can be misleading. They depend on product type, customer profile, jurisdiction, transaction corridor, institution size, risk appetite and local legal obligations.

3. Safe wiki approach #

The public wiki should explain concepts:

• expected vs unexpected activity;
• customer profile and purpose;
• transaction corridor;
• source and destination of funds;
• unusual frequency, size or pattern;
• link to typologies;
• evidence and escalation boundaries.

It should avoid publishing private institution thresholds or evasion-sensitive detection logic.

4. Evidence to describe #

• alert reason;
• customer profile;
• transaction chronology;
• counterparties;
• source documents;
• typology link;
• explanation and reviewer assessment;
• escalation or closure rationale.

5. Source basis #

• SRC-FFIEC-001: FFIEC BSA/AML Examination Manual.
• SRC-FATF-001: FATF Recommendations.
• SRC-WOLF-001: Wolfsberg resources.

6. Related TCAML Framework #

Operation workflows: ongoing monitoring, alert triage, MLRO escalation.

Source workflows: transaction chronology, typology mapping, evidence index.

Evidence outputs: alert review note, chronology table, source limitation note.

Effectiveness and typology source layers#

The Wolfsberg monitoring statements distinguish effective monitoring for suspicious activity from a narrow reliance on static transaction rules:

• SRC-WOLF-006: Part I, moving beyond automated transaction monitoring.
• SRC-WOLF-007: Part II, transition, validation, model-risk balance and explainability.
• SRC-FINCEN-ADVISORIES-001: United States typology and red-flag examples.

FinCEN advisories are jurisdiction-specific and should not be converted into universal thresholds. Monitoring design must remain linked to the institution's risk assessment, customer profile, products, data and applicable law.