AI transaction monitoring for banks: regulatory map and design

Transaction monitoring scans payment flows in near real time to detect patterns suggestive of money laundering, terrorist financing, sanctions evasion or fraud. Traditional rule engines look for threshold breaches and known typologies. AI supplements add anomaly detection, network analysis (entity-link graphs), behavioural baselining per customer segment and natural-language enrichment of unstructured payment narratives.

The output is rarely a final action. It is an alert routed to a human analyst who triages, investigates and decides whether to file a Suspicious Activity Report. The bank that wires AI output directly to account freezes or SAR filings has skipped the human step that supervisors expect.

Regulation (EU) 2024/1624 (AMLR), Directive (EU) 2024/1640 (AMLD6) and Regulation (EU) 2024/1620 establishing the Anti-Money Laundering Authority entered into force in 2024. AMLR Articles 16 to 19 set out customer due diligence and ongoing monitoring obligations. Article 21 covers transaction monitoring specifically: institutions must establish and maintain effective monitoring systems calibrated to their risk profile [1].

The package consolidates and tightens the EU's Anti-Money Laundering rules and centralises supervision of high-risk cross-border institutions under AMLA in Frankfurt. AI in transaction monitoring is permitted, but the institution remains accountable for false-negative rates, alert quality and timely SAR filing.

Annex III 5(b) of Regulation (EU) 2024/1689 covers AI systems used to evaluate creditworthiness or establish credit scores. There is an explicit carve-out: AI systems used for the purpose of detecting financial fraud are not high-risk under that point. Pure transaction monitoring AI focused on AML, fraud and sanctions therefore sits outside the high-risk perimeter, provided it does not double as a creditworthiness scorer.

This does not mean unregulated. GDPR, the AML package, banking secrecy rules, FATF Recommendation 10 and BCBS sound-management guidance all apply. The AI Act's general transparency obligations under Article 50 also apply where a customer interacts with the system directly.

FATF Recommendation 10 requires customer due diligence and ongoing monitoring proportionate to risk. The 2021 FATF guidance on a risk-based approach to virtual assets and the 2023 update on digital identity systems both endorse machine-learning monitoring with appropriate governance [2].

The Basel Committee on Banking Supervision's Sound Management of Risks Related to Money Laundering and Financing of Terrorism (BCBS guidelines) sets out three-lines-of-defence governance, model validation expectations and the requirement for an independent compliance function with sign-off authority over monitoring system changes.

Layered. Rule engine for known typologies and regulator-mandated scenarios stays as the floor. ML supplements add anomaly scoring, peer-group comparison and entity-resolution. Network analysis surfaces connected-party exposure. Each layer feeds an alert queue; the alert is the unit of human review.

The model risk discipline is unchanged from credit models: independent validation, documented data lineage, performance monitoring (precision and recall against confirmed SARs), drift detection and a governance committee with sign-off. Banks that present supervisors with reproducible model cards, validation reports and tuning histories survive AML inspections; banks that present a black-box vendor system without local documentation do not.

Impetora's TRACE methodology applies the same governance discipline that bank model-risk teams expect. Trust covers the contractual and data-protection layer including DORA third-party clauses for the vendor stack. Readiness produces the workflow audit and feature documentation. Architecture covers production-grade design with logging, segregation and recoverability. Citations and Evidence covers the audit-trail layer reviewed by AMLA, national supervisors and internal audit.