How to Analyse Transaction Patterns for Money-Laundering Risk

Trans­action monitoring does not prove money laundering. It identifies activity that is incon­sistent with a customer, account or business model and therefore needs documented review. A sound analysis combines trans­action data with current customer due diligence, counter­parties, geography and the stated purpose of the relationship.

Start with the customer and the expected activity

Before searching for anomalies, record the customer’s products, expected volumes, source of funds, counter­parties, juris­dic­tions and normal trans­action frequency. The FCA’s financial-crime guidance describes ongoing monitoring as checking whether trans­ac­tions remain consistent with what the firm knows about the customer and keeping due-diligence infor­mation current.

A static threshold is rarely enough. A £50,000 transfer may be normal for one wholesale client and excep­tional for another. Segment customers by compa­rable risk and activity so that alerts reflect genuine deviation rather than arbitrary amounts.

Build a complete transaction view

Bring together account entries, payment instruc­tions, benefi­ciary and origi­nator data, device or access infor­mation where lawful, currency conver­sions, charge­backs, linked accounts and relevant customer-contact records. Normalise names, dates, currencies and identi­fiers before analysis. For cryptoasset activity, the same principle applies, although blockchain analytics must be connected to verified identities and off-chain evidence.

Test patterns, not isolated red flags

Useful tests include rapid movement of recently received funds, repeated payments just below review thresholds, circular flows, unexplained pass-through activity, dormant accounts becoming active, payments involving unrelated third parties, abrupt geographic changes and activity incon­sistent with the customer’s business. None is proof by itself.

Network analysis can reveal shared benefi­ciaries or coordi­nated accounts that trans­action-by-trans­action rules miss. This is especially relevant when reviewing higher-risk financial and gambling relation­ships.

Investigate and document every material alert

For each alert, preserve the triggering data and rule version, recon­struct the flow of funds, review relevant due diligence, request propor­tionate supporting documents and record both supporting and contra­dictory evidence. The decision should explain why the activity is reasonable, why monitoring should change, or why escalation is necessary.

The FCA’s trans­action-monitoring review stresses profiling, timely alert handling, calibrated rules and management oversight. A Malta Media discussion of compliance controls in iGaming provides sector context, but any real decision should rest on primary law, regulator guidance and the insti­tu­tion’s evidence.

Measure whether the system works

Track alert age, inves­ti­gation quality, rule coverage, repeat false positives, escalation outcomes and unresolved backlogs. Test rules against known cases and emerging typologies, document changes and retain independent challenge. Manual monitoring may be credible for a small, simple business; larger or more complex firms will generally need appro­pri­ately governed automation.

Finally, separate detection from reporting. Analysts identify and inves­tigate unusual activity; the legally respon­sible function decides whether the applicable threshold for a suspi­cious activity report has been met. Local law, confi­den­tiality and anti-tipping-off oblig­a­tions must govern that step. A review of compliance-audit evidence and gover­nance shows why documen­tation and oversight matter as much as the monitoring rule itself.