Why AML programs should count investigations, not alerts
A high alert count can feel like proof that a monitoring program is working. Ten thousand alerts a month looks like vigilance. In practice, it often means the opposite: rules that are too broad, thresholds that were never tuned, and analysts spending their time clearing noise instead of finding risk.
What it looks like
Queues that never shrink. Analysts closing alerts as quickly as possible to keep up. The same customers flagged again and again for activity that has already been reviewed. Metrics that report how many alerts were cleared, not what was found.
Why it happens
Volume is easy to measure. Quality is not. A dashboard can show alerts generated and alerts closed in real time. It cannot show whether the right activity was escalated, whether a pattern across accounts was noticed, or whether a case was documented well enough to hold up later. So programs drift toward what they can count.
The cost is real. When analysts are buried, the alert that matters looks exactly like the hundred before it.
What to do about it
Tune before you add. Review which rules produce alerts that almost never lead to escalation, and adjust or retire them.
Measure outcomes, not output. Track escalation rates, case quality, and what investigations actually uncovered.
Give investigators room to think. Time to connect activity across accounts is where real money laundering gets found.
Review a sample of closed alerts. Quality checks on cleared work show whether noise is being separated from risk.
The takeaway
An effective program is not the one with the most alerts. It is the one that reliably tells the difference between noise and real risk, and can show its work.
Follow KingaRisk on LinkedIn for more.
