Lesson 5 · Advanced · Both · 28 min
Transaction Monitoring, STR/SAR & Case Ops
How rules and typologies generate alerts, how investigators work cases, and how Suspicious Transaction / Activity Reports close the compliance loop.
Objectives
- ▸Describe TM rule families used in retail and SCF-like flows
- ▸Design alert → case → SAR/STR workflows with SLAs
- ▸Avoid ‘alert farming’ that burns ops without risk reduction
- ▸Partner with Compliance on typology updates after incidents
TM systems score or rule-match customer behaviour against expected patterns. Alerts are hypotheses, not guilt. The product goal is high-quality alerts that investigators can resolve with context from KYC, device, and payment metadata.
- Rule-based: thresholds, velocity, geo, structuring (smurfing), mule patterns.
- Scenario / typology packs: mule accounts, APP scam pass-through, trade-based ML indicators.
- ML models: anomaly scores—need explainability and challenger governance for banks.
Key terms
Transaction monitoringTypologySTRSARNo tipping-offStructuring