Static AML Models Are Failing: Adaptive Scoring Is the Fix

The complaint in this headline is one of the oldest in financial crime compliance: rule-based transaction monitoring generates far more alerts than investigators can meaningfully review, and the great majority close with no action. The proposed remedy — scoring that adapts to behaviour rather than firing on fixed thresholds — is now widely adopted, but it brings its own supervisory obligations. What follows sets out both sides without endorsing a vendor or a technique.

How static monitoring works, and where it breaks

A conventional system runs a library of scenarios against transaction data: aggregate cash above a threshold in a rolling window, rapid movement of funds in and out, transfers to a higher-risk jurisdiction, activity inconsistent with a declared occupation. Each scenario has parameters, and each generates an alert when they are crossed. The design is transparent and easy to explain to a supervisor, which is precisely why it has persisted.

Its weaknesses are equally well understood. Fixed thresholds treat every customer in a segment identically, so a figure that is unremarkable for one business is an alert for another with the same classification. Parameters set at implementation drift out of alignment as products and customer behaviour change. Anyone who learns the threshold can structure beneath it. And because each scenario fires independently, a customer whose activity is mildly unusual in six different ways may generate six low-value alerts and no coherent picture.

What adaptive scoring changes

• behavioural baselines, comparing a customer against their own history rather than against a fixed number
• peer grouping, so the comparison set is customers with genuinely similar activity rather than a broad segment label
• risk scores that update with new information — a change in counterparties, geography, product use or ownership — instead of being set at onboarding and refreshed on a calendar
• network analysis that links accounts through shared devices, addresses, counterparties or timing patterns
• alert triage that ranks or consolidates output so investigators see the strongest cases first

What supervisors expect in return

Regulators have generally encouraged innovation in monitoring while insisting that the resulting system remains explainable and governed. In practice that means model risk management applies: documented development, independent validation before deployment and periodically thereafter, ongoing performance monitoring, and clear ownership. A firm must be able to explain why a particular alert was or was not raised, evidence that changes did not silently suppress genuine suspicion, and demonstrate that any training data and features do not produce discriminatory outcomes. Where a model replaces or reduces existing coverage, supervisors typically expect parallel running and documented comparison rather than a straight cutover.

The metric problem

Claims about false positive reduction should be read carefully, because the denominator is rarely stated on the same basis twice. An alert that closes without a report is not necessarily a false positive — it may be a correct review of activity that turned out to be legitimate, which is what the control is for. More useful measures are the proportion of alerts that become cases, the proportion of cases that become suspicious activity reports, the value of those reports to the financial intelligence unit and to law enforcement, and how many productive alerts the old system missed entirely. Reducing alert volume is trivial; reducing it without losing detection is the actual test.

A realistic implementation path

The dependency almost every programme underestimates is data. Adaptive scoring rests on complete, correctly attributed transaction records with reliable counterparty and customer reference data; where that foundation is weak, a more sophisticated model produces more confident errors rather than better outcomes. The sequence that tends to hold up is to fix data quality and lineage first, tune the existing scenarios and document the tuning, introduce scoring alongside the current system in parallel, validate independently against known outcomes, and only then reallocate investigator capacity — keeping the scenario library as a documented baseline against which the new approach can be measured.