Transaction monitoring is the continuous review of customer transactions against rules and models to detect activity that may indicate money laundering, terrorist financing or fraud, such as unusual amounts, patterns or counterparties. It produces alerts for analysts to investigate. AI agents can explain and enrich those alerts; deciding whether activity is suspicious stays with a person.
Why does transaction monitoring matter once agents act?
Monitoring systems are good at spotting deviations and poor at explaining them. An alert says "inbound volume three times the 90-day average"; it does not say that the customer is a retailer heading into its busiest season. An analyst has to find that out, usually by opening several systems.
An agent can do that gathering and draft the explanation. It can also point to why the system fired, which helps when an AI agent explains why it flagged a transaction. The boundary is the disposition. An agent that closes alerts is deciding what counts as suspicious, which is the judgement the regime expects a person to own.
How does transaction monitoring work in practice?
The system compares each customer's activity with rules, such as thresholds, velocity and high-risk destinations, and sometimes with models of expected behaviour. Hits become alerts. Analysts review them, close those with an innocent explanation and escalate the rest to investigation, which may end in a suspicious activity report.
Agents usually sit beside the monitoring system rather than inside it. Guides cover connecting an AI agent to your transaction monitoring system and letting it summarise alerts, with read access to alerts and customer data and draft access to case notes only.
An example from a payments firm
Take a payments firm whose system flags a sole trader's account: many small inbound payments from different senders, each followed within hours by an outbound transfer abroad. The agent pulls the customer's stated business, a tutoring service, and finds the inbound payments carry references that look like names, not invoices. It compares the pattern with the firm's typology library and notes a resemblance to money mule activity.
It drafts a summary with the payment flows, the mismatch with the stated business and the typology reference. The analyst reads it and escalates for investigation. Whether an AI agent can do transaction monitoring is answered here: it prepared every fact, and a person made the call.
How is transaction monitoring different from sanctions screening?
Sanctions screening checks who: whether a party to a transaction is on an official list. It runs before a payment goes, and a confirmed hit stops it.
Transaction monitoring checks how: whether the pattern of a customer's activity is unusual for them. It usually runs after transactions have happened, across days or months, and its alerts lead to investigation rather than an immediate stop. A payment can pass screening and still be part of a laundering pattern that only monitoring would see.
Which terms sit next to transaction monitoring?
- Typology: a known pattern of laundering or fraud that rules are designed to catch.
- Tuning: adjusting rules and thresholds to balance missed cases against false alerts.
- Compliance monitoring is different: the second line's testing of whether controls, including monitoring, work.
- Compliance agents work in the second line; a monitoring agent is a first-line tool with the same limits on decisions.
Questions people ask
Can an agent replace the monitoring rules?
Not by itself. Rules and models generate alerts consistently and auditably; agents are better at explaining them. Any change to what triggers an alert is a tuning decision that needs testing and sign-off.
Should an agent see the customer's whole history?
It should see what an analyst would need: profile, expected activity, past alerts and relevant transactions. Limit access to what the job requires, and record what the agent read on each alert.