Project Name
62% Fewer AML Alerts With Risk-Segmented Threshold Calibration
A large commercial bank operating across 12 Asia-Pacific countries faced a critical compliance crisis: 1,200+ daily AML alerts against 6 FTE analysts capable of reviewing ~40 alerts each, producing a chronic 4,000+ case backlog. Transaction volumes had grown 3x in three years, but system thresholds remained static since go-live, rendering alert parameters misaligned with customer behavior across all risk segments. The bank struggled with a near-zero signal-to-noise ratio, with genuine financial crime buried beneath false positives.
Ksolves delivered a data-driven threshold calibration framework, applying risk segmentation and percentile-based derivation across the bank’s entire AML scenario library. Within two quarters, daily alert volume dropped to 456 (within analyst capacity), backlog cleared, and SAR conversion rate nearly tripled, surfacing previously invisible typologies and freeing ~3 FTE for high-value investigation work.
- Static Thresholds Set at Go-Live: Alert parameters unchanged since system go-live despite 3x transaction volume growth and expanding customer base across multiple risk segments and jurisdictions.
- Alert Volume Far Exceeding Analyst Capacity: 1,200+ daily alerts with 4,000+ unreviewed cases created a chronic bottleneck; 70% of analyst time spent investigating false positives rather than genuine financial crime.
- Near-Zero Discriminative Value of Amount Thresholds: In funds aggregation scenarios, thresholds were set near P5 of the eligible population, nearly every counterparty-count flag also triggered the amount condition, eliminating discriminative power.
- Uniform Thresholds Applied Across All Risk Segments: Single thresholds applied equally to High Risk and Low Risk customers despite 6–8x differences in P70 amounts between segments, diluting high-risk detection sensitivity.
- Missing Counterparty Country Data Undermining Geography Rules: Over 20% of transactions missing counterparty country codes, making them invisible to all geography-based detection scenarios and creating unquantified coverage gaps.
- Known Typologies with No Detection Coverage: Behavioral baseline spikes, per-transaction structuring, and consecutive monthly anomalies had no corresponding detection coverage in production.
- Governing Principle: Raise thresholds only where data demonstrated retention of high-risk population coverage while eliminating low-value noise, precision over volume.
- Percentile-Based Sensitivity Analysis: Extracted candidate thresholds at every percentile (P0–P100) of eligible populations, generating full sensitivity curves per scenario to quantify alert volume, customer coverage, and risk-segment impact trade-offs.
- Risk-Differentiated Framework: Applied segment-specific thresholds across all scenarios, lower for High Risk, higher for Low Risk, achieving 52% alert reduction in low-risk populations with zero erosion of High Risk coverage.
- IBAN-Based Country Enrichment: Extracted ISO 3166-1 alpha-2 country codes embedded in IBAN account numbers, recovering counterparty data for 20%+ of untagged transactions and restoring geography-rule effectiveness.
- Behavioral Baseline Detection: Introduced new scenario comparing corporate monthly transaction totals against trailing six-month averages, immediately surfacing consecutive spike patterns consistent with fund aggregation.
- Per-Transaction Structuring Scenario: Dedicated detection applying amount filters at individual transaction level before window aggregation, identifying high-value transactions routed across multiple counterparties.
- Calibration Workbooks: Packaged full sensitivity outputs into structured Excel workbooks per scenario with percentile tables, cross-segment comparisons, and risk-differentiated recommendations.
Technology Stack
| Category | Technology |
|---|---|
| Processing | Python / pandas |
| Analytics | Jupyter Notebooks |
| Visualization | matplotlib |
| Data Enrichment | IBAN Extraction (regex + ISO 3166-1) |
| Output | openpyxl / Excel |
| Reference Data | Jurisdiction Risk Classification |
- Alert Volume Reduced 62%: From 1,200+ daily alerts exceeding analyst capacity to ~456 within team bandwidth; 4,000+ case backlog cleared within 6 weeks of implementation.
- SAR Conversion Rate Nearly Tripled: Improved from 3.2% (below 8–12% industry benchmark) to 8.7%, with highest-performing scenario reaching 14.3% conversion accuracy.
- High Risk Detection Improved 34%: Risk-differentiated thresholds surfaced 34% more High Risk customer alerts at the same or lower analyst workload; previously buried in low-risk noise.
- Analyst Capacity Freed for Strategic Work: Reduced false positive investigation from 70% to 28% of analyst time (~3 FTE reallocated to enhanced due diligence and SAR quality enhancement).
- Previously Invisible Financial Crime Risk Surfaced: New detection scenarios immediately identified a cohort of previously unmonitored corporate customers engaging in behavioral spike and structuring patterns; several escalated to SAR review within the first month of implementation.
Before: Static, uncalibrated system generating 1,200+ daily alerts with 3.2% SAR conversion, majority of analyst capacity consumed by false positives; known financial crime typologies entirely unmonitored.
After: Fully recalibrated AML detection library with 62% alert reduction, 8.7% SAR conversion, ~3 FTE freed for high-value investigation, and documented evidence base for every threshold. Annual recalibration cycle now embedded in governance framework, positioning the bank to maintain detection quality as customer behavior and typologies evolve.
Is Your AML Transaction Monitoring System Generating More Noise Than Signal?
