Transaction monitoring scenarios are the rules a bank's monitoring system runs over its transactions to find activity worth an analyst's review: cash just under the reporting line, money that leaves almost as fast as it arrives, a burst of wires to a higher-risk country, a dormant account that suddenly moves a large sum. Each scenario encodes a red flag, and each has thresholds that decide how much of the pattern triggers an alert. The examples below show what common scenarios look for and why. The harder lesson is in the gaps between them: an alert can only exist where a scenario exists, and no amount of good review fixes a product the scenarios never see. Botminds' AML Alert Triage works the alerts scenarios produce, with agents preparing and challenging each one for a Level 1 analyst; this page is about the coverage that has to come first.
Every product needs a scenario: the coverage map, and where TD Bank's had holes
What are transaction monitoring scenarios?
A transaction monitoring scenario is a defined pattern of activity, with thresholds, that the monitoring system checks every customer or account against. A structuring scenario might alert on cash deposits between $7,000 and $10,000; a rapid-movement scenario on accounts where most of an inflow leaves within days. Scenarios are written to find typologies, the known methods of laundering and the crimes behind them, and each alert names the scenario that fired.
The FFIEC examination manual sets the standard for choosing them: "System filtering criteria, including specific profiles and rules, should be based on what is reasonable and expected for each type of account", and "should be developed through a review of specific higher-risk products and services, customers and entities, and geographies" (FFIEC BSA/AML Examination Manual). It warns that history alone can mislead: "Monitoring accounts purely based on historical activity can be misleading if the activity is not actually consistent with similar types of accounts", with the example of "a check-cashing business that deposits large sums of currency versus withdrawing currency to fund the cashing of checks".
Transaction monitoring scenarios examples, with the red flag behind each
The examples below are common scenario families, each with the red flag it encodes and a primary source for it. Thresholds are illustrations: the manual's own figures are examples, not limits the law sets, and a bank sets its own from its risk assessment.
Eleven transaction monitoring scenario examples and the red flags behind them
| Scenario | What it looks for | Red flag and source |
|---|---|---|
| Structuring, near the line | Cash deposits or withdrawals between, say, $7,000 and $10,000, single or several in a day | Breaking cash to avoid a CTR; structuring is a crime in any amount (31 USC 5324) |
| Structuring, aggregated | Smaller cash amounts, such as $3,000, that add up over a window such as 15 days to, say, $30,000 | The FFIEC manual’s own example filter |
| Funnel account | Cash deposited below $10,000 in branches far from where the account is held, withdrawn elsewhere soon after | FinCEN advisory FIN-2014-A005 |
| Rapid movement of funds | Most of an inflow leaving within days, for example 90% out within five days | Pass-through or layering through the account |
| Large cash against profile | Cash well above what the customer’s profile or peers would deposit | Activity inconsistent with the stated business |
| Higher-risk geography | Wires, ATM use or card activity in jurisdictions the bank rates high-risk | The bank’s own country risk ratings and FinCEN priorities |
| Monetary instruments | Cashier’s checks or money orders bought with cash between $3,000 and $10,000, common payees, consecutive numbers | FFIEC manual: structuring through instruments |
| Dormant account reactivated | A quiet account that suddenly receives or sends a large sum | Account takeover, mule or nominee use |
| Velocity in ACH, P2P or instant payments | A jump in count or value of electronic payments against the customer’s history | Mule activity and fraud proceeds moving fast |
| New or unexplained counterparty | A first payment of size to a payee with no history with the customer | Unexplained third-party flows |
| Exempt or cash-intensive customer change | A sharp year-on-year rise in an exempt customer’s cash | Exemptions never switch off SAR duties (31 CFR 1020.315(h)) |
Two of these carry definitions worth knowing. FinCEN describes a funnel account as an individual or business account that takes in many cash deposits in one area, often each below the cash reporting threshold, while the money is withdrawn somewhere else soon after (FinCEN Advisory FIN-2014-A005; the guide to funnel and pass-through accounts quotes it in full and sets it beside the pass-through pattern). And the monetary-instrument scenario comes straight from the FFIEC, which says reviews "should encompass activity for an extended period of time (30, 60, 90 days)" and look for "common payees and purchasers, or consecutively numbered purchased monetary instruments".
What are transaction monitoring red flags?
A red flag is an observable feature of activity that is associated with a crime, and a scenario is a red flag turned into a rule a machine can apply. Most come from regulators' advisories, which list red flags for a typology and usually ask banks to put a key term in the SAR so FinCEN can count them: FinCEN's 2024 alert on deepfake fraud, for example, asks for "FIN-2024-DEEPFAKEFRAUD" in the narrative (FinCEN Alert FIN-2024-Alert004).
No single red flag proves anything, and FinCEN says so: "No one activity by itself is a clear indication of trade-based money laundering" (FIN-2014-A005). That is why a scenario alert is a question and not a finding, and why the analyst's job is to find the context that explains it or does not. The Wolfsberg Group adds a sharper caution about published red flags: illicit actors "are able to access red flags and typology papers which are available in the public domain and can adapt their schemes accordingly to go undetected" (Wolfsberg Statement on Effective Monitoring, 2024).
Priorities shape which red flags a bank should cover first. FinCEN's national AML/CFT priorities, issued in June 2021 and not yet replaced, list corruption, cybercrime, terrorist financing, fraud, transnational criminal organisations, drug trafficking, human trafficking and smuggling, and proliferation financing (FinCEN, 2021). The AML Act of 2020 says SARs are to follow from the institution's compliance program and its risk assessment processes (AML Act of 2020, §6202), which in practice means scenarios mapped to the bank's own risk assessment.
What transactions are monitored for AML?
In principle, every transaction type the bank offers; in practice, every transaction type the monitoring system has a code for. The FFIEC says surveillance systems "can capture a wide range of account activity, such as deposits, withdrawals, funds transfers, automated clearing house (ACH) transactions, and automated teller machine (ATM) transactions, directly from the bank's core data processing system", and lists the manual reports smaller banks use: "currency activity reports, funds transfer reports, monetary instrument sales reports, large item reports, significant balance change reports, ATM transaction reports, and nonsufficient funds (NSF) reports" (FFIEC manual).
The gap between "every type the bank offers" and "every type the system can see" is where TD Bank's failure lived. Newer channels widen it: P2P apps processed as ordinary debit card or direct deposit activity, instant payments, remote deposit capture, card cash advances. Each needs transaction codes the scenarios recognise before any rule can fire on it.
What is an off-the-shelf scenario, and why did TD Bank's fail?
An off-the-shelf scenario is a rule supplied with a vendor's monitoring software and switched on without being tailored to the bank's products, customers and risks. Vendor scenarios are a reasonable starting point. Left as they are, they cover the vendor's idea of a typical bank, not this one.
When TD Bank implemented its monitoring system in 2008, it "applied certain 'off-the-shelf' scenarios provided by its vendor without consideration as to whether such scenarios needed to be tailored for the products and services TD Bank offered or whether they were sufficient to the specific risks the Bank faced". FinCEN found the system "lacked transaction codes necessary to monitor 98% of domestic ACH transactions", that about half of TD Bank's fund transfers were never monitored, and that "in 2023 alone, the coverage gaps applied to several trillion dollars of transactions" (FinCEN, TD Bank consent order, 2024).
What off-the-shelf scenarios left uncovered at TD Bank
98%
of domestic ACH transactions the system had no transaction codes to monitor
FinCEN, 2024
~50%
of the bank’s fund transfers unmonitored, including international debit card purchases
FinCEN, 2024
$100B
of non-Zelle P2P transactions, at least, outside scenario monitoring
FinCEN, 2024
Rejected
a 2012 proposal from AML staff for a domestic ACH scenario, turned down by a senior manager
FinCEN, 2024
The gaps persisted because nobody tested them. Coverage assessments "incorrectly reported that the transaction monitoring system covered ACH payments, even though such coverage was limited to international ACH transactions only", and the inaccurate reporting continued "because the Bank never conducted any mapping or testing to verify which types of transactions were covered by the transaction monitoring system". FinCEN imposed a $1.3 billion penalty and a four-year monitorship.
The Bank never conducted any mapping or testing to verify which types of transactions were covered by the transaction monitoring system.
FinCEN, TD Bank consent order, 2024
How do you know your scenarios cover your products?
Map them, then test the map with real transactions. A coverage assessment that lists scenarios against product names proves little; TD Bank had coverage assessments. The test that works starts from the transaction codes in the core and payment systems and follows each one to the scenarios that can read it.
A scenario coverage test that would have caught TD Bank's gaps
- Start from transaction codes, not product names
Pull every transaction code from the core, payments, card and deposit systems for a month, with counts and values.
- Trace each code to a scenario
For every code, list the scenarios that read it. A code no scenario reads is a gap, whatever the product list says.
- Weigh the gap by value
Rank unmonitored codes by dollars and volume; TD Bank’s were trillions.
- Check the risk assessment against the map
Every product rated medium or high risk needs scenarios; a downgrade needs a written rationale.
- Test with seeded transactions
Run test transactions through each product and confirm the expected scenario alerts.
- Re-run on every change
New products, new payment channels, recoded transactions and system migrations each reopen the map.
- Record paused and retired scenarios
A paused scenario is a gap with a start date; give it an end date and an owner.
How many scenarios should a bank have?
As many as its risk assessment requires, and no regulator gives a number. A community bank running vendor reports from its core may cover its risks with a handful of filters; a large bank with every payment channel may run hundreds of scenarios. The question an examiner asks is not how many, but whether the set reaches the bank's higher-risk products, customers and geographies and is tested.
More is not automatically better. The Wolfsberg Group criticises "demonstrating expanding red flag and typology coverage across the entire customer and product range, even when an FI's data shows that these result in little to no escalations", and urges banks to "prioritise optimising and refining their systems for observed or crystallised risk, while coverage of theoretical risk can be handled using an RBA inclusive of exploratory analytics" (Wolfsberg, 2024). The balance is the one TD Bank got wrong in the other direction: scenarios exist to cover risk the bank actually has, and a scenario that never escalates should be tested before it is retired, not simply left running or switched off.
Near-threshold cash and exempt customers: two scenario traps
Near-threshold cash scenarios remain essential, but since October 2025 their alerts need more than the amount to justify a SAR. The interagency SAR FAQs say that cash at or near $10,000 is not, by itself, enough to require a SAR; the bank must know, suspect or have reason to suspect the transactions were designed to evade reporting (SAR FAQs, October 2025, Q1). Structuring remains a crime in any amount, so the scenario stays; what changes is what the analyst needs to find before escalating.
Customers exempt from currency transaction reports are the opposite trap. The exemption rule says an exemption does nothing to lift or lessen a bank's duty to file SARs, and gives the example of "a sharp increase from one year to the next in the gross total of currency transactions made by an exempt customer" (31 CFR 1020.315(h)). Bank of America's monitoring system rescored structuring alerts to zero for customers on its CTR exemption list; one customer had more than 20 alert groups indicative of potential money laundering from 2018 to 2024, and only three ever reached investigation (FinCEN, Bank of America consent order, 2026).
What alert triage can and cannot fix
Triage works on alerts; it cannot create one. Botminds' AML Alert Triage reads each alert the monitoring system produces overnight and, with its agents, answers the same three questions on every one: is this normal for this customer, who are the counterparties, has it happened before. Each answer is cited to the system it came from, a challenger agent argues for escalation, and a Level 1 analyst decides. It changes how well and how fast each alert is worked. It does not change which transactions alert.
Alerts arrive named by scenario: the analyst's queue at the sample bank
Take one scenario from that list as it plays out. Rapid movement of funds fired on Fenwick Auto Body LLC, a collision repair shop, when $48,200 came in by ACH from an insurer and $47,900, 99% of it, left within two days, above the rule of 90% out within five days. The agents showed it was the shop's normal monthly pattern: insurer payments for repairs passed to the same three parts suppliers. The analyst closed it. The same scenario on Pellham Logistics found a first payment to a counterparty whose account was 41 days old, and the analyst escalated it.
A rapid-movement alert, with what fired drawn as a flow of funds
The solution does feed scenario work. Its tuning analyst agent finds alerts closed again and again for the same reason and writes a proposal, with its evidence and expected effect, for the Head of the financial intelligence unit; it recommends no change where SARs were filed and never changes a scenario. The method for testing those proposals is in transaction monitoring threshold tuning; whether to replace an engine whose coverage is the problem is weighed in transaction monitoring software for banks; and why a scenario's closure rate says less than it seems is in AML false positive rates.
Questions people ask
What is a structuring scenario?
A rule that alerts on cash transactions arranged to stay under the $10,000 currency transaction report threshold, such as several deposits of $7,000 to $10,000, or smaller amounts that add up over days. Structuring is a federal crime in any amount under 31 USC 5324, whether or not any single deposit is near the threshold.
What is the difference between a scenario and a rule?
The terms are often used interchangeably. Strictly, a scenario is the typology being looked for, and the rules and thresholds are how the system detects it; one scenario may run several rules for different customer segments.
Are transaction monitoring scenarios the same in every bank?
The families are similar, but thresholds, segments and transaction codes should not be. The FFIEC expects each bank to "evaluate and identify filtering criteria most appropriate for their bank", which is the opposite of switching on a vendor's defaults.
How often should scenarios be reviewed?
No rule sets a frequency. Review them when products, channels, risk ratings or FinCEN advisories change, and on the bank's independent testing cycle; TD Bank's scenarios were paused for years during a system transition, which FinCEN treated as part of the violation.
Can a scenario be switched off?
Yes, with evidence. Wolfsberg recommends testing against retired monitoring routines to confirm the absence of material risk; without that test, a switched-off scenario is a coverage gap with a start date.