More AML alerts can reduce investigation capacity
Under fixed staffing, low-value AML alerts consume review capacity and can delay material cases. Alert counts require measures of coverage, quality, and investigation timeliness.
AML investigation capacity is the amount of monitoring and case-review work an anti-money-laundering programme can complete to its required standard in a given period. An alert consumes that capacity; it does not by itself establish suspicious activity or improve the programme’s effectiveness.
Detection creates work before it creates a finding
A monitoring rule identifies activity for examination. Reviewers then retrieve records, establish customer context, assess linked transactions, document reasoning, and decide whether escalation or reporting is required.
The costs include more than the first analyst’s handling time. Missing data, customer contact, supervisory review, quality checks, and corrections consume additional capacity.
An ordinary transaction can legitimately trigger review. The relevant question is whether the rule identifies useful risk at an acceptable investigative burden, not whether every generated alert becomes a report.
A fixed team cannot absorb an unlimited alert increase
Take a team whose analysts can each complete 18 uncomplicated initial reviews per working day at the required standard. A configuration change adding 180 such alerts per day creates ten analyst-days of additional daily work before escalation and quality review.
If staffing and productivity remain unchanged and the team had no spare capacity, unfinished work accumulates. Risk prioritization can direct scarce time toward more serious cases, but it does not remove the remaining workload.
The adverse effect is conditional. Additional useful alerts accompanied by adequate resources can improve detection. Additional low-value alerts under a fixed capacity constraint can delay cases that warrant deeper investigation.
Total analyst hours have not fallen. The amount available for material cases has fallen because other reviews consume those hours.
Counts can reward the wrong outcome
A higher alert count can reflect business growth, a new risk pattern, better detection, duplicate data, or poorly calibrated rules. A higher suspicious activity report count can likewise reflect different reporting choices or changes in the monitored population.
Neither count, by itself, establishes that more relevant activity was detected or that law-enforcement use improved. Cost per report also becomes misleading if costs fall because required monitoring was narrowed.
Pair volumes with queue age, investigation quality, scenario coverage, data defects, escalation results, and customer impact. These measures describe different stages of the process and should retain their own definitions.
Capacity pressure requires resources and better information
Reducing duplicates, improving customer context, and repairing data can remove unnecessary work without deliberately excluding relevant risk. Adding qualified reviewers and improving tools can increase capacity.
Raising thresholds solely to make alerts fit the existing staff converts a resourcing constraint into a detection blind spot. The defensible change identifies the risk the rule should detect, evaluates coverage, and provides enough capacity to investigate its output.
The second-order effect is that a detection system can weaken its own downstream response when it expands output faster than the institution can evaluate it.
Questions
- Does more alert volume mean a better AML programme?
- No. Volume must be interpreted alongside risk coverage, data quality, investigation results, and timeliness.
- Do false positives prove that a monitoring rule is useless?
- No. Some ordinary activity must be reviewed to distinguish it from suspicious activity. The issue is whether the rule provides useful detection for the work it creates.
- Should alert thresholds be raised until the queue fits the staff?
- No. That uses staffing as the basis for risk coverage. The programme needs justified detection settings and enough resources to investigate their output.