Transaction monitoring software for banks is the system that runs a bank's scenarios over its transactions, raises alerts on activity that may be suspicious, and records what happened to each alert. Buyers usually compare engines: rules, machine-learning scores, data coverage. Yet the cost a BSA Officer feels, and the failures regulators punish, mostly sit after the alert, in the minutes and the judgement each one takes. That gives a bank two different purchases to weigh: replacing the monitoring system, or keeping its tuned scenarios and changing how alerts are worked. This guide compares the two honestly, with the migration failures in the public record, and says where Botminds' AML Alert Triage fits: agents that prepare and challenge every alert on the queue an existing engine produces, with a Level 1 analyst deciding each one.
Two ways to spend a monitoring budget, and what each changes
Replace the monitoring system: Detection engine, scenarios, thresholds, data feeds and the hand-off to case management.
Keep the engine, add agents to the alert queue: Nothing in detection. Agents read each alert and the systems behind it; decisions and reason codes are written back.
Replace the monitoring system: Scenarios are rebuilt on a new data model and tested above and below the line again.
Keep the engine, add agents to the alert queue: The existing scenarios, thresholds and their documentation stand as they are.
Replace the monitoring system: Alerts the old system raised and the new one does not; a flood of alerts the new one raises.
Keep the engine, add agents to the alert queue: No change to what alerts. The new risk is a wrong rationale, checked by a challenger agent and QC.
Replace the monitoring system: Coverage gaps, outdated rules, missing transaction types.
Keep the engine, add agents to the alert queue: Minutes per alert, consistency of reasons, documentation, backlog.
Replace the monitoring system: The work of deciding each alert, which may grow with better coverage.
Keep the engine, add agents to the alert queue: Missing scenarios or transaction types: no agent can work an alert that never fires.
What is a transaction monitoring system?
A transaction monitoring system is software that applies rules or statistical models to a bank's transactions to identify activity that may need review for suspicious activity reporting. The FFIEC examination manual distinguishes manual systems, which produce reports such as large cash and funds-transfer listings for staff to review, from surveillance systems, which "can cover multiple types of transactions and use various rules to identify potentially suspicious activity" (FFIEC BSA/AML Examination Manual).
Surveillance systems come in two families. "Rule-based systems detect unusual transactions that are outside of system-developed or management-established 'rules'"; intelligent systems adapt to each customer's history or peer group. The manual notes that "banks that are large, operate in many locations, or have a large volume of higher-risk customers typically use surveillance monitoring systems", and that "the sophistication of monitoring systems should be dictated by the bank's risk profile". A community bank with a few thousand customers may run its programme on vendor reports from its core processor; a large bank runs hundreds of scenarios across every payment channel.
What transaction monitoring software for banks does, and what it leaves to people
The software decides which transactions become alerts. People decide what each alert means. Everything in between, finding the customer's profile, a year of statements, the counterparties and the earlier alerts, has historically been people's work too, and it is most of the time an alert takes. In Botminds' sample data, Corvane National Bank, a fictional regional bank, measured a 38-minute median per alert by hand, of which six minutes were the decision and the written reason.
The industry's own standard-setters have noticed where the investment goes. The Wolfsberg Group observed in 2024 that "investments tend to focus primarily on the analytics used in detection, but other areas are ripe for improvement, such as optimising case management systems, leveraging external data sources, improving control oversight mechanisms, and creating tools to support exploratory analytics" (Wolfsberg Statement on Effective Monitoring, 2024). For a bank whose scenarios have been tuned and validated over years, that observation is the buying decision.
Should a bank replace its transaction monitoring system?
Replace it when it cannot see the transactions the bank's risks require, cannot be tuned, or cannot be supported. Do not replace it to fix a backlog: a new engine usually raises more alerts, not fewer, and the migration itself is where two of the most expensive recent failures began.
USAA Federal Savings Bank replaced its legacy system in the first quarter of 2021 "after only two months of parallel testing with the legacy system despite significant failures identified during that two-month period", failures FinCEN spelled out in the sentence quoted further down this page. The bank then reported "that the new system is too sensitive and creates an unmanageable number of alerts and cases" (FinCEN, USAA FSB consent order, 2022). It was fined $140 million.
TD Bank's upgrade began in late 2016 with a target of October 2017, ran to the end of 2019, and was followed by a move to a new system whose "phased implementation" only began in August 2024. While transitioning, the bank "limited changes to its existing transaction monitoring system, including not adding any new scenarios, for four years". When it compared coverage, one presentation showed the new system capturing "$220 billion of transactions (123% increase)" a month more, and the bank "estimated that it would need to almost triple its AML staff to handle the projected volumes" (FinCEN, TD Bank consent order, 2024).
What two monitoring-system migrations cost, in the enforcement record
1,300+
cases the legacy system flagged that USAA’s new system missed, after two months of parallel testing
FinCEN, 2022
160
SARs, at least, that would not have been filed using USAA’s new system
FinCEN, 2022
4years
TD Bank added no new scenarios to its existing system while it transitioned
FinCEN, 2024
~3×
the AML staff TD Bank estimated the new system’s volumes would need
FinCEN, 2024
The Wolfsberg Group goes further and asks regulators to "reject the concept of parallel processing in the transition of monitoring capabilities", noting that "innovation is a journey which can take multiple years before benefits can be realised". Whatever one thinks of that request, the USAA order shows the cost of cutting a parallel run short, and the TD order shows the cost of freezing the old system while waiting for the new.
Is a transaction monitoring system a model?
Under the model risk guidance revised in April 2026, a deterministic rule-based scenario engine is generally not a "model", because the guidance excludes rule-based processes and software with no statistical, economic or financial theory behind them; a machine-learning score generally would be (OCC Bulletin 2026-13, also Federal Reserve SR 26-2). The guidance is aimed mainly at banks with more than $30 billion in assets, and the 2021 interagency statement on model risk for BSA/AML systems was rescinded the same day.
That does not take a rule-based engine out of review. The FFIEC manual still expects the system's programming methodology and effectiveness to be independently validated, and its filtering criteria and thresholds to be documented and explained against the bank's risks (FFIEC manual). A new engine resets that documentation; keeping the engine keeps it. How a bank tests and records its thresholds is covered in transaction monitoring threshold tuning.
Agents on the queue sit outside both categories: the 2026 guidance puts agentic AI out of its scope altogether. That is why, in Botminds' AML Alert Triage, the agents never change a customer record, scenario or threshold, never close an alert, and leave a trace of every step for the bank's own testing. Agentic AI for transaction monitoring follows one alert through that trace.
What are transaction monitoring tools for banks? Four kinds, and what each is for
Four kinds of product are sold under the label, and a vendor demonstration often blends two or three. Knowing which is which tells a buyer, before the demonstration starts, which problem each can solve.
Four kinds of transaction monitoring tools, and the problem each solves
| Tool | What it does | Solves | Leaves untouched |
|---|---|---|---|
| Rule-based monitoring engine | Runs scenarios and thresholds over transactions and raises alerts | Coverage: which activity is looked at | The work of deciding each alert |
| Machine-learning scoring layer | Scores, ranks, or raises and lowers alerts | Ordering and, in some designs, volume | Explanation; and a score that hides alerts must be tested like any threshold |
| Case management and workflow | Routes alerts and cases, records decisions and deadlines | Tracking, audit trail, hand-offs | Gathering the evidence for each decision |
| Agents on the alert queue | Gather and cite the evidence, argue for escalation, draft the rationale | Minutes per alert, consistency, documentation | Detection: which transactions alert in the first place |
The scoring layer deserves a warning of its own. Bank of America built a system to score and group alerts because there were not enough investigators to work them, and FinCEN's 2026 order found its weights untested and its rescoring rules able to keep reportable activity from ever reaching an investigator (FinCEN, Bank of America consent order, 2026). AI in AML transaction monitoring takes that case apart.
What does a transaction monitoring system cost?
List prices are rarely published, and the licence is the smaller part. The larger cost is people: the analysts who work alerts, the investigators who work cases, and the tuning and validation staff behind the engine. Public data gives the scale, if not a price.
What BSA monitoring costs, in the public data
$14K–$21M
direct BSA compliance costs in 2018 across 11 banks GAO studied
GAO-20-574; not generalizable
28%
of those banks’ BSA costs went on suspicious activity reporting, second only to identity verification
GAO-20-574
25%
of community banks’ total compliance expense goes on anti-money laundering
CSBS 2025 survey
750
additional staff Bank of America estimated it needed when it lowered its review line
FinCEN, 2026
GAO found the costs heavier for small banks: about 2% of operating expenses at each of the three smallest banks in its sample, against less than 1% at the three largest (GAO-20-574). The Conference of State Bank Supervisors' 2025 survey found that for BSA/AML technology, 34.3% of community banks ran it in-house, 47.8% used a combination and 17.9% outsourced it (CSBS, 2025). And the SAR itself is only the end of the chain: FinCEN's own burden estimate is about 1.98 hours of filer time per SAR, or $326.8 million a year across all filers (FinCEN paperwork notice, 2024); the alerts behind each SAR are not counted in that figure.
The useful way to compare options is therefore in your own hours: alerts a month, minutes per alert by hand, and what share of those minutes each option removes. A new engine changes the first number, often upward. Agents on the queue change the second. In the sample bank's figures, the median fell from 38 minutes by hand to 4.1 with the solution on its sample results; on like alerts signed as a batch, the design target is about 2 minutes. Those are sample results and a target, not a customer's measured outcome, and a pilot on a bank's own closed alerts is the only way to get its own number.
How long does it take to implement transaction monitoring software?
A full engine replacement is measured in years at large banks: TD Bank's upgrade ran from late 2016 to the end of 2019, and its replacement system was still being rolled out in phases into 2025. The time goes on data mapping, rebuilding and testing scenarios, parallel running and validation, and every month of it is a month in which the old system's gaps stay open.
Putting agents on an existing queue is a smaller project because detection does not move. What it needs is read access: the alert feed with its scenario and transactions; the customer profile from the client lifecycle management system; twelve months of activity from the core; counterparties and screening from the payments hub and card processor; and prior alerts and cases from case management. Decisions and reason codes go back to the monitoring system, and escalations open cases. The bank's Level 1 procedure and reason codes become settings that the BSA Officer approves. Testing then runs on past alerts the bank has already decided.
Agents read the systems an alert lives in, and cite each passage
What to look for in transaction monitoring software: questions for the demonstration
Ask questions a vendor can only answer on screen, with one of your alerts. The 2018 joint statement makes clear there is no obligation to buy anything new: "the Agencies will not penalize or criticize banks that maintain effective BSA/AML compliance programs commensurate with their risk profiles but choose not to pursue innovative approaches" (Joint Statement on Innovative Efforts, 2018). The burden of proof is on the product.
Ten questions for any transaction monitoring software demonstration
- Which of our transaction types will it see?
ACH, wires, cash, cards, instant payments, P2P, checks and remote deposit, mapped to our transaction codes.
- What will it stop seeing that we see today?
A parallel run long enough to compare alert by alert, with the misses investigated.
- Can every alert, score and suppression be explained?
A reason a person can read and test, not only a number.
- Can anything remove an alert from human view?
If yes, how it is tested below the line and who approves it.
- Who can change a threshold, and how is it recorded?
Access controls and approval by the BSA Officer, as the FFIEC expects.
- What does it do to minutes per alert?
Measured on our closed alerts, not on the vendor’s data.
- What does a closed alert keep?
Evidence, rationale, reason code, who and when, for at least five years.
- How are dates recorded on escalation?
The detection date behind the 30-day filing period, and who can change it.
- What will the examiner export contain?
Decisions, overrides, QC results, settings changes and their approvals.
- What happens to alert volume?
The staffing a new engine’s volumes will need, before go-live.
The new system failed to flag over 1,300 cases flagged by the legacy system, resulting in at least 160 filed SARs that would not have been filed using the new system.
FinCEN, USAA Federal Savings Bank consent order, 2022
Where Botminds' AML Alert Triage fits, and where it does not
Botminds' AML Alert Triage works on the alerts an existing transaction monitoring system produces. For each one, an alert reader states what fired; an investigating agent answers three questions with citations (is this normal for this customer, who are the counterparties, has it happened before) and drafts a closure or escalation under the bank's reason codes; and a challenger agent on a separate model family argues for escalation before any closure is proposed. The Level 1 analyst closes, escalates, edits or disagrees. Like alerts can be signed as a batch of up to 25, each keeping its own record.
When an analyst escalates, the escalation writer drafts the summary, records the detection date with its reason and opens the Level 2 case in the bank's case management system, with the filing date 30 days out, or 60 if no suspect is identified. It never drafts or files a SAR.
An escalation opens the Level 2 case with its date and summary
What it does not do matters as much for a buyer. It is not a detection engine: it adds no scenarios and changes no thresholds, and a bank with coverage gaps needs engine work, as the guide to scenarios and their gaps shows. It is not a SAR-writing tool and not a Level 2 case manager. Its tuning analyst agent proposes threshold changes with their evidence, but the tuning team and the Head of FIU decide them. If the engine is sound and the desk is behind, it addresses the part of the cost that a new engine would increase.
Questions people ask
What is the best transaction monitoring software for banks?
The one that sees all of your transaction types, can be tuned and explained to an examiner, and leaves your analysts time to decide. For many banks the binding constraint is not the engine but the work per alert, which is why the queue deserves as much scrutiny as detection.
What is the difference between a transaction monitoring system and case management?
The monitoring system decides which activity alerts; case management tracks investigations, decisions and deadlines once an alert is escalated. Many products combine them. Neither gathers the evidence on an alert by itself.
Do community banks need automated transaction monitoring?
Not necessarily. The FFIEC says the sophistication of monitoring should match the bank's risk profile, and many smaller banks use manual reports from their core processor. The 2018 joint statement says banks will not be criticised for choosing not to adopt innovative approaches if their programmes are effective.
How long should a parallel run last when replacing a monitoring system?
No rule sets it. It should last until the bank can explain every alert the old system raised that the new one does not; USAA's two-month parallel run left more than 1,300 such cases unexplained, and FinCEN cited it.
Can agents work alerts from a vendor monitoring system?
Yes, if they can read the alert with its scenario and transactions and the systems behind it. In AML Alert Triage, decisions and reason codes are written back to the monitoring system and escalations open cases in case management.