Alert Rules

What Are Alert Rules?

Alert rules are the configured conditions inside an anti-money laundering or fraud system that decide when an event deserves human attention. Each rule describes a pattern, sets one or more thresholds, and specifies the population it applies to. When a transaction, a customer profile change or a screening result meets the rule's criteria, the system generates an alert that an analyst must review and close with a documented decision.

The term covers several kinds of logic. In transaction monitoring, rules are often called scenarios and look for behavior such as rapid movement of funds, unusual cash activity or payments to higher-risk jurisdictions. In name screening, rules define how closely a name must resemble a listed party before it is raised as a potential match. In onboarding, rules can flag signals such as a mismatch between a customer's stated country and the network location of the device used to apply.

Why Alert Rules Matter

Alert rules are where a firm's risk assessment becomes operational. A risk assessment may conclude that a product is exposed to structuring or to mule activity, but nothing happens until a rule turns that conclusion into a detectable pattern. Poorly designed rules create two opposite failures:

• Missed risk. Thresholds set too high, or scenarios that do not reflect the firm's actual products and customers, let suspicious activity pass without review.
• Alert overload. Rules that are too broad produce large volumes of low-value alerts. Analysts then spend their time clearing noise, backlogs grow, and genuine cases can be closed too quickly.

Both failures carry regulatory consequences. Supervisors reviewing a monitoring program will ask why each rule exists, how its thresholds were chosen, and whether the firm can show that the rule set still matches its risk profile.

How Alert Rules Work in Practice

Common Rule Types

• Threshold rules. Trigger when a single value exceeds a limit, such as a cash deposit above a set amount.
• Aggregation rules. Sum or count activity over a period, for example many small deposits that together exceed a threshold, a pattern associated with structuring.
• Velocity rules. Look at the rate of activity, such as many new beneficiaries added within hours, or many account openings from one device.
• Behavioral or peer rules. Compare a customer's activity with their own history or with a peer group of similar customers and flag significant deviation.
• Geographic rules. Flag transfers to or from jurisdictions the firm considers higher risk.
• Screening rules. Define match thresholds, name variants and secondary identifiers (date of birth, nationality, registration number) used to decide whether a screening hit becomes an alert.

The Rule Lifecycle

1. Design. Link each rule to a specific risk identified in the business-wide risk assessment, and record the rationale.
2. Threshold setting. Use the firm's own data to set initial values, segmenting customers so that a retail account and a corporate treasury account are not measured against the same limits.
3. Testing before launch. Run the rule against historical data to estimate alert volumes and check that it catches known examples of the target behavior.
4. Tuning. Review alert outcomes regularly. Techniques include above-the-line and below-the-line testing, where analysts sample activity just above and just below a threshold to see whether the cut-off is in the right place.
5. Retirement or redesign. Rules that never produce useful alerts, or that duplicate other rules, should be reviewed rather than left running by default.

Linking Alerts to Outcomes

An alert is only the start. Each one should lead to a recorded disposition: closed as not suspicious with a reason, escalated for investigation, or reported to the financial intelligence unit through a suspicious activity report. Feeding these outcomes back into rule tuning is what makes a rule set improve over time.

Regulatory Expectations

Regulators do not prescribe a specific set of rules. Instead, they expect monitoring to be proportionate to the risks a firm has identified, in line with the risk-based approach set out in the FATF Recommendations.

• In the EU, the AML Directives and Regulation (EU) 2024/1624 require obliged entities to monitor business relationships and scrutinize transactions to ensure they are consistent with what the firm knows about the customer.
• In the United States, the Bank Secrecy Act and FinCEN's rules require covered institutions to maintain programs capable of identifying and reporting suspicious activity. The FFIEC BSA/AML Examination Manual describes how examiners assess monitoring systems, including how rules and thresholds are set and reviewed. US banking agencies have also issued guidance on model risk management as it applies to systems supporting BSA/AML compliance.
• In the UK, the Money Laundering Regulations 2017 require ongoing monitoring of business relationships, and supervisors expect firms to be able to explain the logic of their automated controls.

Across jurisdictions, the common theme is explainability: a firm should be able to show what each rule does, why it exists and how it has been validated.

Best Practices

• Map every rule to a named risk and keep that mapping current when products change.
• Segment customers before setting thresholds; one threshold for every customer type rarely works.
• Track alert-to-case and case-to-report conversion rates per rule to identify rules that add noise without value.
• Document every threshold change, who approved it and the evidence behind it.
• Combine rules with screening, customer risk ratings and analyst judgment.

How on8.ai Helps

SmartSanction returns screening matches together with the reasoning behind them, so analysts can see why an alert was raised rather than just a score. Its decisions are explainable and run without any LLM or external API in the decision path. At onboarding, Pre-KYC checks such as velocity control and bot detection can raise early signals before an account is opened.

Related Terms

• Transaction Monitoring System (TMS)
• False Positive
• Fuzzy Matching
• Risk-Based Approach (RBA)
• SAR (Suspicious Activity Report)