Not long ago, financial institutions almost solely relied on traditional, rules-based BSA/AML transaction monitoring. Like other areas of banking, the BSA/AML space has evolved in recent years, adopting new technologies to identify potentially suspicious activity more accurately and efficiently. Using leading technology, innovative BSA/AML software providers are harnessing the power of artificial intelligence (AI) and machine learning for behavior-based analysis.
It is important for financial institutions to find a balance between detecting suspicious activity without being so broad that the institution is bogged down with an abundance of false positives. Both types of analysis have pros and cons, and a careful convergence of rules- and behavior-based analytics provides the most coverage for financial institutions.
How to strengthen AML monitoring with rules-based triggers and AI
Rules-based and behavior-based monitoring catch different signals: rules flag activity that meets known risk criteria, while behavior-based tools surface unusual activity based on customer patterns. The right mix depends on an institution’s customers, products, services, and risks.
Rules-based vs. behavior-based AML transaction monitoring
Financial institutions have more options than ever for identifying potentially suspicious activity. Traditional rules-based systems offer traceable alert rationales, quick deployment and refinement, consistent results, and compliance teams’ control over detection logic to address local risks and evolving regulations. More recently, AI-powered behavioral analytics have introduced impressive capabilities such as adaptive anomaly detection and predictive scoring.
Combining rules-based and behavior-based analytics creates a hybrid anti-money laundering (AML) transaction monitoring framework that balances strict regulatory compliance with contextual intelligence. The FFIEC BSA/AML Examination Manual recognizes that using both approaches offers the best of both worlds. It says suspicious activity monitoring systems can include manual transaction monitoring, automated surveillance systems, or a combination, as long as the sophistication of monitoring reflects the bank’s risk profile.
What differentiates rules-based and behavior-based transaction monitoring?
Rules-based transaction monitoring evaluates activity against defined criteria over a specified period. Behavior-based analytics, meanwhile, evaluate activity in the context of a customer’s historical activity, expected activity, or relevant peer behavior.
Rules commonly address activity involving volume or frequency, structuring, or velocity. For example, a rule might identify unusually high transaction volumes or patterns of transactions occurring within parameters established by the financial institution. The FFIEC notes that rule-based surveillance systems can apply multiple or overlapping rules and increasingly refined criteria to different customer or risk segments.
The greatest benefits of a rules-based system are control and transparency. Financial institutions can establish parameters around specific risks and adjust them as those risks change. However, poorly calibrated thresholds can create unnecessary false positives. Rules that are too rigid may also fail to identify activity occurring just outside the predefined criteria.
How behavioral analytics add context
Behavior-based analytics approach the problem differently. Instead of asking only whether a transaction crossed a specific threshold, behavioral monitoring can identify deviations from a customer’s historical activity, expected activity, or an appropriate peer group.
FFIEC guidance notes that understanding the nature and purpose of customer relationships helps institutions determine when transactions may be potentially suspicious. This approach can help financial institutions identify activity that may not be obvious through predetermined rules alone. It can also support more targeted investigations when combined with sound customer due diligence.
Behavioral monitoring has limitations, too. A system looking primarily for deviations from past behavior may have difficulty identifying illicit activity that has appeared normal since the beginning of a relationship. That is one reason behavior-based logic should not automatically replace established rules.
Why a multidimensional approach matters
For financial institutions evaluating rules-based vs. behavior-based AML transaction monitoring, the more useful question may be which analytical method is best suited to a particular risk. Knowing which typologies are relevant to a bank’s customers, products, locations, and transaction channels can help determine how much behavioral, geographical, and customer-context information is needed to evaluate activity against recognizable patterns of illicit behavior.
FFIEC guidance similarly states that monitoring systems should be risk-based and provide additional screening for higher-risk products, services, customers, and geographies. This philosophy also supports a broader risk-based transaction monitoring approach. A financial institution’s risk assessment should help determine where monitoring resources are concentrated and how parameters are set, with the goal of helping investigators focus on alerts that warrant additional review rather than simply generating more alerts.
FinCEN’s April 2026 AML/CFT program proposal further emphasizes effective, risk-based, and reasonably designed programs that enable institutions to focus resources on higher-risk activity. The proposal remains a proposal, so financial institutions should continue monitoring regulatory developments.
Where AI and machine learning fit
Artificial intelligence (AI) and machine learning transaction monitoring adds capabilities to the monitoring toolkit, but AI, machine learning, behavioral analytics, and rules-based monitoring are not interchangeable terms.
Financial institutions should consider how each capability contributes to the broader monitoring process:
- Rules-based monitoring applies predefined criteria, such as transaction monitoring thresholds, frequency, velocity, or other established parameters, to identify activity requiring review.
- Behavioral analytics evaluates activity in the context of historical patterns, expected customer behavior, or relevant peer groups to identify meaningful deviations.
- Anomaly detection can help identify activity that falls outside expected patterns, including activity that may not trigger a traditional rule.
- AI and machine learning can analyze large volumes of data and identify complex patterns or relationships that may be difficult to detect through static rules alone.
- Human oversight and governance remain critical. More sophisticated analytics still require appropriate controls, monitoring, validation, and an understanding of how outputs are generated and used.
The effectiveness of these tools largely depends on the quality and completeness of customer and transactional information, so banks and credit unions must prioritize transaction monitoring data quality. Incomplete or inaccurate data can distort patterns, create unnecessary alerts, or cause potentially suspicious activity to be missed.
Financial institutions also need appropriate governance around more complex analytical models. The federal banking agencies’ 2026 model risk management guidance emphasizes a risk-based approach to model oversight, including understanding model design, performance, limitations, data, and ongoing outcomes.
Deterministic rules without statistical, economic, or financial theories are excluded from that guidance’s definition of a model, although they still require appropriate controls and oversight.
Build monitoring around the institution’s risk
AML software should provide financial institutions with sufficient transparency and flexibility to understand how alerts are generated and to adjust monitoring as risks evolve. A “set it and forget it” approach can become less effective as customer behavior, products, payment channels, and illicit finance methods change.
Ultimately, rules-based vs. behavior-based AML transaction monitoring should not be framed as a choice between the two. Combining transparent rules with behavioral context, appropriate typologies, sound data, and well-governed advanced analytics can give AML/CFT teams multiple ways to identify unusual activity while managing false positives.
The objective is to build a risk-based monitoring process that helps investigators focus their time and expertise where it matters most.
Editor's note: This blog was originally published in July 2020 and has been updated for accuracy and current best practices.
