Trade-based money laundering transaction monitoring is the screening of a bank's trade activity, its letters of credit, documentary collections, reimbursements and trade payments, against red flags for mispricing, odd routes, unexplained parties and inconsistent documents, followed by an investigation of each alert. Measuring it by how many alerts it raises or how many reports it produces tells a bank very little, because fewer than one in a thousand suspicious activity reports names TBML and most trade alerts have an innocent explanation. The measures that matter are whether every trade was screened with every check working, how long each alert takes to a decision, whether every closure carries a written reason and its proof, how often escalations hold up, and which rules earn their keep. Botminds' Trade-Based Money Laundering Detection is built to report each of them, alert by alert and rule by rule.
The sample values on this page come from a fictional sample bank, Corvane National Bank, as it runs through the solution: sample data, design targets and our own estimates, each labelled. Formulas are ours.
Why counting alerts and SARs misleads in trade monitoring
8,749
SARs filed in 2016–2020 specifically indicated TBML, out of almost 11 million
79%
of those TBML-specific SARs came from banks; the rest from other financial institutions
7 of 10
alerts in one night at the sample bank closed with a written innocent explanation and the document that proved it
What is trade-based money laundering transaction monitoring?
It is two different activities that share a name, and a bank's measures should not mix them. For documentary trade, where the bank finances the transaction and holds the invoice and the bill of lading, monitoring reads those documents for anomalies. For open account trade, where the bank only moves the payment, monitoring looks at payments, accounts and counterparties, because there are no documents to read. GAO's account of what banks told it is a fair summary of the first: "Transactions are screened for red flags, and the banks determine a risk tolerance level based on the number and severity of red flags that are identified" (GAO-22-447).
The industry's own standard warns against importing the second activity's methods into the first. For documentary trade, "it is difficult, if not impossible, to introduce any standard patterning techniques in relation to transaction monitoring processes or systems. This is due to the range of variations which are present even in normal trading patterns" (Wolfsberg Group, ICC and BAFT, 2019). A rule that flags a 30% rise in a customer's monthly volume works on a current account. On a trade book, where a single shipment can be a quarter's business, it mostly flags harvests and seasons.
Why alert counts tell you nothing
Alert counts measure the settings, not the risk. Double the price multiple and the count falls; add a corridor to the high-risk list and it rises; neither change says whether the bank is finding laundering. SAR counts are no better as a target. GAO found that less than a tenth of one per cent of SARs filed from 2016 to 2020 specifically indicated TBML, and the OCC told GAO that banks may have reported trade schemes under other headings, such as suspicious wires or fraudulent documents. A bank whose TBML SAR count rises may simply have started labelling.
The ratio of alerts to SARs has the same flaw, and a deeper one: it rewards fewer alerts, not better decisions. What the alert to SAR ratio measures, and what to track instead, works through that argument for AML monitoring in general. For trade, where most alerts are cleared and the cleared ones are what an examiner can sample, the quality of the closures matters more than their number.
How do you monitor trade transactions for TBML?
You screen every trade transaction the bank handles against cited red flags, work each alert to a written decision, and keep the evidence for each closure as carefully as for each escalation. The FFIEC's examination procedures describe what an examiner checks at the end of that chain: whether the bank "monitors the trade finance portfolio for potential OFAC violations and unusual transactional patterns and conducts and records the results of any due diligence" (FFIEC, Trade Finance Activities, Examination Procedures). The second half of that sentence is the one most programs under-measure.
At the sample bank the screening runs overnight. In one night it read 44 presentations and collections and 61 reimbursements against 86 red flags, raised 10 alerts, and the Challenger agent cleared 7 of them, each with the explanation and the document that proved it. Three reached a person's queue. The same queue reported what it could not check: vessel tracking data had not refreshed since 04:10, so route checks on four alerts were marked unconfirmed, and no alert had been closed on a route flag since.
The queue reports what it could not check, not only what it found
The five KPIs, with a formula for each
Five measures cover the program from screening to filing. Each is computed per period and per rule, and each has a value at the sample bank that shows what the number looks like in practice. The targets in the last column are the bank's choice; ours are suggestions.
Five KPIs for trade-based money laundering transaction monitoring
| KPI | Formula | Sample bank | What it tells you |
|---|---|---|---|
| 1. Screening coverage | Trade transactions screened with every check run ÷ trade transactions handled | 105 read overnight; route checks unconfirmed on 4 alerts while vessel data was stale | Whether a quiet queue means quiet trade or a broken feed |
| 2. Days to decision | Median calendar days from alert to close or escalation; and share decided by the policy deadline | Target 4 days; estimate 19 by hand; escalations due with the BSA Officer by day 25 | Whether the program can meet the reporting clock without rushing the hard cases |
| 3. Documented clearance rate | Closures with a written reason and the proving document ÷ all closures | Every agent clearance carries both, by design | Whether a closure will read as a decision when it is sampled |
| 4. Escalation quality | Escalations returned by the BSA Officer ÷ escalations; and escalations that became cases ÷ escalations | 61 escalations became cases in 12 months | Whether investigators and the checker agree on what is reportable |
| 5. Rule yield | Per rule: escalations ÷ flags raised; and share cleared with an explanation | Third-party payer: 274 flags, 64% cleared; value returning between parties: 97 flags, 41% cleared | Which rules find cases and which mostly find seasons |
Coverage comes first because the other four are meaningless without it. A trade program can show excellent days to decision on alerts it raised while missing a corridor whose payments never reached the screening, or closing route flags with a vessel feed that had stopped. A coverage figure that counts only the checks that actually ran makes those failures visible as a fall in a number, not as a finding.
How many TBML alerts become SARs?
No public figure exists for trade alerts that become suspicious activity reports, at any bank, and the published SAR data cannot supply one. The national counts measure labelling as much as detection: FinCEN's own analysis for its 2010 advisory found that only a quarter of the SAR narratives it treated as trade-related clearly said so, and what the FinCEN advisories and SAR data say about TBML follows that problem through to 2025.
A bank can still measure its own conversion, and should, but per rule rather than in total. At the sample bank 61 escalations became cases over 12 months. The useful question is which rules produced them. In the typology library the rule for value returning between the same parties fired 97 times and was cleared with an explanation 41% of the time, while the rule for goods described differently across documents fired 341 times and was cleared 92% of the time. The first is a rule that finds cases; the second is mostly a data-quality signal, still worth having, but not one to staff an investigation team around.
Share of each rule's flags cleared with a written explanation, 12 months
How are innocent explanations documented?
An innocent explanation is documented when the closure names the explanation, names the document that proves it, and keeps both where an auditor can open them. A reason with no proof is an opinion; a proof with no reason is a file. The Wolfsberg principles ask for exactly this: institutions "are expected to have procedures and processes in place which allow staff to record the basis of their decision in respect of any risk indicators or assessments of transaction risks that arise at any stage of a transaction," with those comments kept in the transaction audit trail (Wolfsberg Group, ICC and BAFT, 2019).
A cleared alert is evidence too: the reason and the proof, side by side
The seven clearances above are the shape a closure should take. Kiln-grade alumina flagged at a price outside its band was quoted per short ton, not per kilogram; normalised, it sat inside the band, and the invoice's unit note proves it. A packing list and a bill of lading disagreed on weight by 1,840 kg; one was net, the other gross, and the difference was the pallets. Each closure is one sentence and one document, and each can be checked by someone who was not there.
"FIs need to be able to demonstrate that they have robust control review processes and procedures for alert management in place. This requires that there are records of the decision making process and the review of those decisions being checked and challenged where appropriate."
The Wolfsberg Group, ICC and BAFT, Trade Finance Principles (2019 amendment)
What is a good time to decision on a trade alert?
A good time to decision leaves the BSA Officer enough of the reporting period to read the case properly, and the reporting rule does not set it. The 30-day filing period runs from the bank's determination, after review, that activity is suspicious, not from the alert; FFIEC guidance on when the clock starts is set out in the SAR filing process. The review itself still has to happen within a reasonable period, so a bank's procedures should set a deadline for it and measure against that.
Where a trade alert's days go, by hand and with agents gathering the evidence
- Read1 d
- Price4 d
- Route3 d
- Parties5 d
- Write4 d
- Decide2 d
- Agents1 d
- People decide3 d
The sample bank sets its own policy clock at 30 days from the alert, stricter than the rule, with a warning to the owner at day 20 and the escalation summary drafted at day 25, by which time the case must be with the BSA Officer. Against that clock the KPI that matters is not the median but the tail: the share of alerts decided by day 25, and the reason each late one was late. On the sample queue three alerts were at risk: one on day 27 with its summary drafted, one on day 24, and one on day 22 waiting on a second bank that had not answered.
What does an examiner sample in trade finance?
The FFIEC's trade finance procedures sample accounts, chosen from the bank's own risk assessment of its trade portfolio and from prior examination and audit reports, and then look at the due diligence and the activity behind each one. That makes the closed alerts on a sampled customer part of the evidence, and it makes the documented clearance rate the KPI with the most direct examination consequence. A cleared alert with a written reason and a proving document shows the bank did the due diligence and recorded its results. A cleared alert with a disposition code and nothing else does not.
The Wolfsberg principles add a post-transaction check of the bank's own: "Risk based post transaction reviews and quality assurance processes should be established to determine, within a reasonable timeframe, if transactions have been appropriately evaluated and risk managed." The solution supports that review directly. Internal audit can open any alert and its explanation without being able to approve, escalate or close anything, and the examiner pack exports closed alerts with customer identifiers masked. For a program built to be measured this way, start at Trade-Based Money Laundering Detection, and for the evidence behind the price rule, see the model risk view of a TBML tool.
Questions people ask
Can transaction monitoring rules detect TBML?
Rules can surface indicators, such as a price far outside the market for a goods code or a payer the credit does not name, but they cannot establish laundering on their own. The Wolfsberg principles call standard patterning for documentary trade difficult, if not impossible, because normal trade varies so much; rules work best as prompts for an investigation that records its reasons.
What is a false positive in trade AML?
An alert whose red flag has an innocent explanation once the facts are gathered: a price quoted per short ton rather than per kilogram, a payer that is the customer's own parent, a port call that is a scheduled rotation. No regulator or independent study reports false positive rates for trade alerts, so each bank should measure its own, per rule.
Should alerts and SARs be reported to the board as KPIs?
As context, not as targets. Volumes rise and fall with thresholds and with the trade book itself. Boards learn more from coverage, the share of alerts decided on time, the documented clearance rate and the rules that produced cases.
How often should TBML rules be tuned?
On a schedule the bank sets and records, and whenever a rule's yield or clearance share moves sharply. At the sample bank each rule shows its last tuning review on the same row as its yield, and every threshold change needs the BSA Officer's approval.
Does open account trade need different KPIs?
The same five apply, but the inputs differ. With no invoice or bill of lading, coverage means payments screened against counterparty and account indicators, and rule yield is measured on payment patterns rather than on document mismatches.