AML Transaction Monitoring: Machine Learning Cuts Alerts on Paper, but Proof Is Self-Reported

The use case

Starting point. HSBC reports that it screens more than 1.2 billion transactions a month (operator-reported, November 2023)¹. Transaction monitoring is the control that decides which of those deserve a human look. For decades it has run on fixed rules, such as flagging cash deposits above a threshold, and each rule hit becomes an alert for an investigator. The AI version adds a machine-learning model, which is software that learns patterns from past cases instead of following hand-written thresholds. The product HSBC uses is described by its vendor as scoring risk from transactional patterns, network behaviour and customer-identification (know-your-customer, KYC) data (vendor-reported, June 2023)².

Scope note. Only machine-learning models count as AI here. Rule scenarios, human investigators and extra staffing are older approaches and are kept separate from AI results. One study read for this paper uses a model to suppress false alerts after the rule engine has run, so it is counted as AI applied to alert triage, not to detection³. Sanctions screening and fraud detection are neighbouring uses and are out of scope.

Where it is running

Few deployments are documented with both scale and results. No United States deployment with published results was found; the US material read is regulatory⁶⁷.

Wider adoption. In a Bank of England and FCA survey of 118 firms, 75% reported using AI in some form, and anti-money-laundering and fraud were among the areas with the highest perceived benefits (self-reported, November 2024)⁵. The usage figure covers all AI uses, and the page read gave no separate share for AML⁵. Trade press stated in August 2020 that banks were turning to machine learning but that most still relied on rules-based systems; that statement is older than three years and no newer equivalent was found⁸.

What the evidence shows

None of the evidence below comes from a controlled trial. It is ordered from the closest to live operation to the most general.

Operator-reported production result. HSBC compared the 12 months after go-live with the preceding 12 months of rules-based monitoring, adjusting for seasonality, and reports two to four times as much suspicious activity and 60% fewer alerts (operator-reported, no control group)¹. It also reports twice as much identified financial crime in commercial banking and almost four times as much in retail banking on the same basis¹. The vendor states that the two-to-four-times figure is measured by the number of suspicious activity reports (SARs) filed (vendor-reported)². A SAR count reflects investigators' decisions to report, not confirmed laundering, and the published description does not say whether other changes occurred in the same period. HSBC also reports detecting suspicious accounts within eight days of the first alert, with no baseline stated (operator-reported)¹, and a customer quote in the vendor release says processing time fell from several weeks to a few days (vendor-reported)².

Peer-reviewed retrospective test. A study on data from one unnamed bank tested XGBoost, a common machine-learning method, as a filter on rule-engine alerts. The data held more than 210,000 customers with alerts from 46 rule scenarios; 6,420 were labelled suspected money laundering and 204,576 were false positives (authors, 2024)³. From those counts, about 97% of alerted customers were false positives, which is the same order of magnitude as the "more than 95%" figure cited without a primary source in a vendor release² and unattributed in trade press⁸. In the best configurations the share of false-positive customers removed was 0.71 to 0.76, while recall, the share of true cases kept, was 0.90 to 0.93 (measured on a held-out 30% of historical data, one bank, no external validation)³.

The trade-off is real. With default settings, XGBoost removed 0.95 of false positives but recall fell to 0.79, and a Naive Bayes model wrongly closed 366 of 1,926 money-laundering customers in the test data³. The abstract reports that 11% of money-laundering customers were incorrectly closed for the authors' preferred method, while the body gives 231 of 1,926, about 12%³. Every false alert removed carries a risk of removing a true one.

Expert surveys and regulators. The Financial Action Task Force (FATF) wrote in 2021 that AI and machine learning "can strengthen ongoing monitoring and reporting of suspicious transactions", and also that such solutions "may present significant risks"⁴. It added that "manual review and human input remains very important"⁴. Those views rest on a questionnaire with 188 responses, 54% from the private sector, mainly large banks and technology developers (survey, 2021)⁴. They are informed opinion, not measured performance.

What it takes: cost, integration, governance

Data and integration. The vendor model draws on the bank's own transactions, network behaviour and KYC data². The peer-reviewed model takes the outputs of the bank's existing rule scenarios as its inputs. The authors state that it needs a minimum period of coexistence with a rule-based model and that its data quality depends on the rigour of the predefined scenarios³. A model that ranks alerts can only rank what the rule engine has already raised.³

Cost. No price for the HSBC system was found. The Dutch shared utility was expected to need "tens of millions of euros" (projected, August 2020, per unnamed sources)⁸. The Dutch banking association estimated that 5,500 to 6,000 sector employees worked on AML full time in September 2019 (estimate, older than three years)⁹. FATF reports that the cost-benefit case for new technology remains an obstacle for industry⁴.

Rules and guidance. In December 2018 the US federal banking agencies and FinCEN said innovation can improve the efficiency and effectiveness of AML programmes, that they would not advocate a particular technology, that the statement set no new expectations, and that banks choosing not to innovate would not be penalised or criticised⁶. The statement does not mention AI or machine learning in its body⁶. In the Netherlands, shared monitoring raised questions on data privacy, competition and whether handing monitoring to a utility is outsourcing a critical function under European Banking Authority guidelines¹⁰. Alerts there go only to banks in the payment chain⁸.

EU AI Act. Annex III of the Act lists evaluation of the creditworthiness of natural persons as high-risk, excepting systems used to detect financial fraud, and does not mention anti-money-laundering¹¹. The Act became applicable on 2 August 2026 with exceptions, and Annex III high-risk rules were extended to 2 December 2027 (European Commission, page updated 3 August 2026)¹². Whether a given monitoring system falls under the Act was not assessed.

Where it falls short

The challenge question is what would make this use case look less successful than presented. Four answers emerge.

The design of the evidence. The strongest production result is a before-and-after comparison by the operator, published on a vendor's blog, with no control group¹. Fewer alerts and more SARs can both follow from better ranking, but laundering that neither system sees cannot be counted, so the figures cannot show how much was missed. The peer-reviewed test is one bank, one data split, with non-public data³.

Gains over time and across groups. No source reports whether gains persist beyond the first 12 months, or how effects differ across customer groups. FATF names explainability and interpretability as a key challenge, and a gap in supervisors' and regulators' capacity to adopt these tools⁴.

What the largest penalty shows. TD Bank pleaded guilty in October 2024; court documents showed that 92% of transaction volume, about $18.3 trillion, went unmonitored from 1 January 2018 to 12 April 2024, and that its monitoring programme added no new scenarios from at least 2014 to late 2022⁷. The total penalty was $1,886,945,780.40 and an independent monitor was required for three years⁷. The release does not mention AI⁷. It shows that coverage and maintenance of monitoring can matter more than the detection method, and no result here shows that machine learning would have prevented it.

Searches for failure. Searches for withdrawn programmes, lawsuits and regulator action against machine-learning monitoring models turned up none in the sources read. That is an absence of findings, not evidence of absence. The Dutch utility has no published results after 2021 in the sources read¹⁰.

Phase: In early use — why

The hypothesis was In wide use. One named bank has machine-learning monitoring live in two jurisdictions and intends to extend it¹, and the vendor reports production in several jurisdictions². The share of banks using machine learning for monitoring could not be established: the survey figure covers all AI uses⁵ and the only statement on monitoring is a 2020 report that most banks still relied on rules⁸. The Dutch utility's use of machine learning is unconfirmed⁸. The lower phase is therefore chosen.

What to watch next

• 2 December 2027: extended application date for the AI Act's Annex III high-risk rules¹², against an Annex III text that does not name AML¹¹.
• HSBC's extension of its machine-learning monitoring to other markets, stated as intent in November 2023¹; a published market list or independent assessment would be the trigger.
• The independent compliance monitor at TD Bank, appointed for three years under the October 2024 resolution⁷; any published findings.
• First published detection results from the Dutch shared utility; none were found after 2021¹⁰.

Questions to ask before adopting

• Was the claimed improvement measured against a control group or only against the preceding period, and what else changed in that period?
• Does the headline count reports filed or confirmed cases, and how are missed cases estimated?
• What share of true cases does the model keep when it suppresses alerts, and who approves closing the rest?
• Which rule scenarios feed the model, when were they last reviewed, and which transactions are not monitored at all?
• Can each score be explained to the supervisor, and what does the model cost to run alongside the existing rules?