What does a transaction monitoring analyst do all day?

A transaction monitoring analyst works the first line of a bank's suspicious activity programme: the monitoring system flags transactions that break one of its rules, and the analyst decides, for each alert, whether the activity has an ordinary explanation or must go to an investigator. That decision is short. Getting to it is not: the analyst pulls the customer's profile and expected activity, a year of transactions, every counterparty and its screening result, and the history of earlier alerts, usually from different systems, and then writes down why. Botminds' AML Alert Triage is built around that imbalance. Agents assemble the evidence for each alert and argue both sides, and the Level 1 analyst still closes or escalates every one.

The job matters more than its entry-level label suggests. Most suspicious activity reports a bank files start as an alert or a referral someone chose not to close, and US filers sent FinCEN 4.8 million SARs in fiscal 2025, up from 4.3 million in 2022 (FinCEN, Year in Review FY2025). When the alert desk falls behind, the whole programme does: several of the largest anti-money-laundering penalties of the last five years describe a queue that grew faster than the people working it.

What does a transaction monitoring analyst do?

A transaction monitoring analyst reviews system-generated alerts of unusual activity, researches each one against what the bank knows about the customer, and records a disposition: closed with a reason, or escalated for investigation. In most banks the role is called a Level 1 AML analyst or alert analyst, and it sits inside the financial intelligence unit (FIU) under the BSA Officer.

The examination manual every US bank examiner uses breaks suspicious activity monitoring into five components and expects a bank's procedures to name who is responsible for each: producing the alert, managing it, deciding whether to file, completing and filing the SAR, and monitoring and filing on continuing activity (FFIEC BSA/AML Examination Manual, Suspicious Activity Reporting). The Level 1 analyst owns the second component, managing the alert, and feeds the third. GAO describes the same chain in four steps: identifying unusual activity, reviewing and investigating alerts, deciding whether to file, and completing and filing (GAO-24-106301).

The Department of Labor files the work under fraud examiners, investigators and analysts, whose listed core task is to "conduct in-depth investigations of suspicious financial activity, such as suspected money-laundering efforts" (O*NET 13-2099.04). At Level 1 the investigation is shallow and wide: many alerts, each examined just far enough to know whether it deserves a deeper look.

What are transaction monitoring alerts, and where do they come from?

A transaction monitoring alert is a flag raised when a customer's activity matches a rule, or scenario, in the bank's monitoring system: cash just under the $10,000 reporting line, funds that leave almost as fast as they arrive, wires to a higher-risk country, a dormant account that suddenly moves money. Each alert names the scenario, the customer and the transactions that tripped it. It is a question, not a finding.

Monitoring output is only one source. The FFIEC lists "activity identified by employees during day-to-day operations, law enforcement inquiries, or requests, such as those typically seen in section 314(a) and section 314(b) requests, advisories issued by regulatory or law enforcement agencies, transaction and surveillance monitoring system output, or any combination of these" (FFIEC manual). In large banks the system output dwarfs the rest; in a community bank a teller's referral and a printed large-cash report may still be the main inputs. Which scenarios exist decides which alerts can exist at all, a point the scenarios guide works through product by product.

Alerts arrive in a queue, sorted by due date or risk, with a service-level target per risk band. Take a sample bank as an example throughout this page: Corvane National Bank, a fictional US regional bank with about 42,000 alerts a month and 220 Level 1 analysts, the bank used in Botminds' sample data. Its policy gives high-risk alerts 3 calendar days, moderate 5 and low 10.

One alert, minute by minute: where a Level 1 analyst's time goes

The decision is the smallest part of an alert's time. In the sample bank's time study of 1,150 alerts (fictional, like everything about Corvane), the median alert worked by hand took 38 minutes. Only 6 of them went on deciding and writing the rationale; the rest went on opening systems and copying facts into one place.

Each block in the first lane is a different system. The client lifecycle management system holds the KYC profile and the expected activity the customer declared at onboarding. The core banking system holds twelve months of statements. The payments hub holds wire and ACH counterparties and the sanctions screening result. The case manager holds earlier alerts, cases and quality-control outcomes. An analyst who has done this a thousand times knows where every field lives, and it still takes most of the half hour to collect it.

The time matters because the regulation gives none to spare in aggregate. The FFIEC does not set a minutes-per-alert standard; it says the review must be done within a reasonable period of time, which depends on the facts of each case and, above all, on whether the bank has written procedures for reviewing potentially suspicious activity and actually follows them (FFIEC manual; the guide to AML investigation steps quotes the passage). A queue that ages is the evidence that the procedures are not being followed.

A Level 1 queue sorted by what the agents found, not by arrival

What is required for the purpose of analysing transaction monitoring alerts?

Analysing an alert requires three things: access to what the bank knows about the customer, the tools to research beyond it, and a written conclusion. The FFIEC is explicit on all three. Banks should give alert staff enough internal and external research tools to investigate activity and reach conclusions, including "access to account systems and account information, including CDD and EDD information". It then expects the conclusion, and any recommendation on filing, to be written down (FFIEC manual, Managing Alerts).

The last item is the one new analysts underrate. A closure rationale is read later by a quality-control analyst, by internal audit, by the independent tester and sometimes by an examiner. What a closed alert must show an examiner sets out what that written reason has to carry, item by item.

How many alerts does an AML analyst review per day?

There is no regulatory number, and published enforcement records suggest that a high one is a warning sign rather than a productivity win. At CommunityBank of Texas, three BSA analysts worked the alerts for a bank with six to eight BSA staff, and FinCEN found that the pace left the deposit slips, wire transcripts and check images unread; it fined the bank $8 million (FinCEN, CommunityBank of Texas, 2021).

The opposite failure is a queue nobody reaches. At Shinhan Bank America, "a team of only seven to nine employees was responsible for handling all alerts generated by the Bank's TM system", and the result was "a 17-month backlog of alerts" (FinCEN, Shinhan Bank America, 2023). At TD Bank, the 2018 backlog passed 70,000 detection alerts, with "less than 60% of alerts falling within benchmarks for timely detection", and one senior manager's answer was to "identify opportunities to scale back review or investigative rigor" (FinCEN, TD Bank, 2024).

Between those poles, the honest answer is arithmetic. At a 38-minute median, an analyst with six hours of queue time clears nine or ten alerts, which is exactly what the sample bank's Level 1 analysts reported. The number moves only when the minutes per alert move, or when the bank accepts less care per alert, which is the trade the TD and CommunityBank orders describe.

Those three BSA analysts each reviewed an average of 100 case alerts per day, which meant that BSA analysts often did not review supporting documents, although all of this information was readily available.

FinCEN, In the Matter of CommunityBank of Texas, 2021

What is the difference between Level 1 and Level 2 AML?

Level 1 triages alerts; Level 2 investigates the ones Level 1 escalates, and recommends whether to file a SAR. The split is a staffing convention, not a legal term, and many community banks combine both in one or two people. The FFIEC notes that "smaller banks may use one or more employees to complete several tasks (e.g., review of monitoring reports, research activity, and completion of the actual SAR)" (FFIEC manual).

Where the levels are separate, the hand-off carries a date that matters. The SAR rule gives a bank 30 calendar days from the date it first detects facts that may justify a SAR (31 CFR 1020.320(b)(3)), and the FFIEC says the alert firing is not that date: the clock starts only once a review has been done and someone has determined that the activity is suspicious (FFIEC manual; the guide to the SAR filing process walks through the clock). Banks set their own policy on which hand-off marks that moment. The point is that it is recorded, with a reason, rather than reconstructed when the SAR is late.

What examiners expect from the Level 1 desk

Examiners test the process, not each decision, and they test it by pulling alerts. The FFIEC directs them to judge whether the bank's SAR decision-making process is effective rather than second-guess single calls (FFIEC manual), and the OCC's community bank procedures, in force for examinations from February 2026, name a sample of suspicious activity alerts and a conversation with staff about the investigation process among the tests an examiner may run (OCC Bulletin 2025-37).

Three expectations follow for the analyst's desk. Management must define the escalation path from detection to disposition; staff must have the experience the work needs and training that is thorough and ongoing; and the desk must be staffed in proportion to the bank's overall risk profile and its transaction volume (FFIEC manual). The OCC has also warned that some banks are lending BSA staff to other risk work, such as fraud investigations, in ways that could disrupt the continuity of BSA operations (OCC Semiannual Risk Perspective, Spring 2025).

One expectation was relaxed in October 2025. The interagency SAR FAQs confirm that a bank is not required to document a decision not to file a SAR, and that where it does, a short statement will usually do (FinCEN and the federal banking agencies, SAR FAQs, October 2025). That answer is about the SAR decision. It does not remove the reason on a closed alert, and the sampled alert with no reason is the one an examiner cannot follow.

A Level 1 day with Botminds' AML Alert Triage

Botminds' AML Alert Triage changes where the 38 minutes go, not who decides. Overnight, an alert reader writes one sentence on what fired. An investigating agent answers the same three questions on every alert, each statement cited to the system it came from: is this normal for this customer, who are the counterparties, has it happened before. It drafts a closure or an escalation under one of the bank's reason codes, and proposes a closure only at 85% confidence or more. A separate challenger agent, on a different model family, looks for reasons to escalate, and a closure is proposed only when it finds none.

On the sample bank's Tuesday, Dana Okafor, a Level 1 analyst, opens alert 26-0914-118233: rapid movement of funds on Fenwick Auto Body LLC, a collision repair shop. $48,200 came in by ACH from an insurer on September 9 and $47,900 left for three parts suppliers by September 11. The brief shows the inflow inside the $35,000 to $60,000 a month the profile expects from insurers, four known counterparties paid in at least 11 of the last 12 months, and four earlier alerts on the same pattern, all closed. She closes it under the bank's reason code C-03 in 1 minute 52 seconds, with her attestation on the record.

The alert, read as a short brief with three cited answers

The analyst's judgement still carries the day; it is simply spent on the alerts that need it. In the same queue, the challenger disagrees with closing Pellham Logistics because a counterparty first paid that week received an $18,400 wire into an account opened 41 days earlier. No closure is proposed, and Dana escalates it. Every action, by her and by the agents, is kept with who, what, when and why for five years, the retention period in 31 CFR 1010.430. How the agents divide that work, and what each is never allowed to do, is traced step by step in agentic AI for transaction monitoring. Whether the job itself survives the change is the subject of will AI replace AML analysts.

Questions people ask

What is the AML alert investigation process?

An alert is triaged at Level 1, where an analyst compares the activity with the customer's profile, history and counterparties and either closes it with a reason or escalates it. Escalated alerts become cases that a Level 2 investigator researches and takes to a SAR decision. GAO describes the same flow in four steps: identify, review and investigate, decide, and complete and file.

Does a Level 1 analyst decide whether to file a SAR?

Usually not. The FFIEC expects a named decision maker, a person or a committee, with authority over the final filing decision, which in larger banks usually sits with Level 2, the FIU head or a SAR committee. The Level 1 analyst decides whether an alert deserves that decision.

Does an alert start the 30-day SAR clock?

No. The FFIEC says a system flag is not initial detection; the 30-day period starts once a review determines that the activity is suspicious. Banks still record when that determination was made, because a late SAR is judged against it.

What systems does a transaction monitoring analyst use?

Typically five: the transaction monitoring system that raises the alert, the client lifecycle or KYC system for the profile, the core banking system for statements, the payments hub for wire and ACH counterparties and screening, and a case management system for prior alerts and escalations. Card processors and external research tools are often added.

Is transaction monitoring analyst a good job?

It is a common entry point into financial crime compliance. O*NET groups it with fraud examiners, investigators and analysts, whose broader wage group had a 2025 median of $81,100 a year, and the route leads to investigator, quality-control, FIU management and BSA Officer roles. Entry-level pay is lower than that median, and varies by market.

How long should one AML alert take?

No rule sets a time; the FFIEC asks for a "reasonable period of time" under documented procedures. Speed is not the test. Enforcement orders have criticised both extremes: analysts clearing 100 alerts a day without reading the supporting documents, and queues left for 17 months.