Transaction Monitoring System (TMS)

What Is a Transaction Monitoring System (TMS)?

A transaction monitoring system (TMS) is software that reviews customer transactions, either as they happen or after the fact, to detect activity that may indicate money laundering, terrorist financing, fraud or sanctions evasion. It compares each transaction and each customer's pattern of activity against rules, thresholds and behavioral models, and generates alerts for compliance analysts to investigate.

Transaction monitoring is how institutions meet the ongoing part of customer due diligence. Onboarding establishes who the customer is and what activity to expect. Monitoring checks, throughout the relationship, whether the actual activity is consistent with that knowledge. When it is not, and the investigation cannot explain the difference, the institution may need to report suspicion to its financial intelligence unit.

A TMS is distinct from sanctions screening of payments, although the two are often run together. Payment screening checks the names and details in each transaction against sanctions lists before it is processed. Transaction monitoring looks for patterns of behavior over time.

Why Transaction Monitoring Matters

Most laundering does not reveal itself in a single payment. It shows up as patterns: many small cash deposits just under a reporting threshold, funds that arrive and leave the same day, a dormant account that suddenly becomes busy, or a network of accounts sending money to one beneficiary. A monitoring system is the main tool institutions have to find those patterns across millions of transactions.

Weak monitoring is one of the most frequently cited failings in AML enforcement actions. Common findings include rules that were never tuned, entire products or channels left out of monitoring, alert backlogs and poor quality investigations.

How a TMS Works

Data

Monitoring is only as good as its data. A TMS typically draws on transaction records from all relevant channels (wires, cards, cash, instant payments, crypto transfers), customer data from KYC, risk ratings, account information and counterparty details. Gaps in data feeds are a common and serious weakness.

Detection methods

• Rules and scenarios: predefined logic, for example cash deposits above a threshold within a set period, or transfers to high-risk jurisdictions above a set value.
• Customer segmentation: grouping customers with similar expected behavior, such as retail, small business or money services businesses, so thresholds fit each group.
• Behavioral profiling: comparing current activity with the customer's own history or with peers, and flagging significant deviations.
• Network analysis: linking accounts through shared counterparties, devices, addresses or identifiers to reveal mule networks and related parties.
• Machine learning models: scoring transactions or alerts on the likelihood of being suspicious, used to detect new patterns or prioritize work.

Alert handling

1. Triage: an analyst reviews the alert, the transactions and the customer profile, and closes alerts with a clear explanation.
2. Investigation: unresolved alerts become cases, with research into source of funds, counterparties and related accounts.
3. Decision and reporting: if suspicion remains, the case is escalated and a suspicious activity report is filed.
4. Feedback: outcomes inform rule tuning, customer risk ratings and decisions on whether to keep the relationship.

Typical Scenarios

• Structuring of cash deposits or withdrawals to stay below reporting thresholds.
• Rapid movement of funds, where money arrives and leaves within a short period.
• Fan-in and fan-out patterns: many senders paying into one account, or one account paying many recipients.
• Activity inconsistent with the customer profile, such as a student account receiving business-scale payments.
• Transactions involving high-risk jurisdictions or sanctioned regions.
• Sudden reactivation of dormant accounts.
• Round-amount transfers and repeated payments of identical values.

Regulatory Expectations

FATF Recommendation 10 requires ongoing due diligence on business relationships, including scrutiny of transactions to ensure they are consistent with the institution's knowledge of the customer, and Recommendation 20 requires reporting of suspicious transactions. The EU AML directives and the AML Regulation (EU) 2024/1624, the UK Money Laundering Regulations 2017 and the US Bank Secrecy Act all build on these obligations. In the United States, suspicious activity reports by banks are generally due within 30 calendar days of initial detection of facts that may constitute a basis for filing. New York's Department of Financial Services requires regulated institutions to maintain transaction monitoring and filtering programs and to certify compliance annually under 23 NYCRR Part 504.

Regulators generally expect monitoring to be risk-based, to cover all relevant products and channels, to be tuned and tested periodically, and to be supported by enough trained staff to clear alerts in a timely way. Where machine learning is used, firms should be able to explain how the model works and validate its performance.

Common Challenges

• False positive volume: poorly tuned rules can produce large numbers of alerts with little value, consuming analyst time.
• Data quality: missing counterparty details or incorrect customer data weaken every scenario.
• Coverage gaps: new products, payment rails or acquired businesses are not always added to monitoring.
• Explainability: alerts need a clear reason that an analyst and a regulator can follow.
• Real-time pressure: instant payments leave little time to intervene before funds move on.

How on8.ai Helps

SmartSanction screens people, companies, vessels, crypto wallets and addresses against sanctions, PEP and risk sources through an API or in batch, so screening results can sit alongside behavioral alerts in a transaction monitoring process. Each customer gets a dedicated deployment, no LLM or external API is involved in the decision path, and every match shows the reasoning behind it.

Related Terms

• Alert Rules
• False Positive
• SAR (Suspicious Activity Report)
• Smurfing
• Ongoing Monitoring
• Customer Risk Rating (CRR)