False Positives in AML Screening and How to Reduce Them

Ask any AML analyst about their biggest daily frustration and the answer is almost always the same: false positives. Screening and monitoring systems generate huge volumes of alerts, and in many programmes the overwhelming majority — often cited as well above 90 percent — turn out to be legitimate activity flagged in error. Understanding why, and how to reduce them, is central to running an effective and affordable compliance operation.

What a false positive actually is

A false positive is an alert that, on review, turns out not to indicate the risk it was raised for. In sanctions screening, that usually means a customer or transaction was flagged as a potential match to a watchlist entry but is not actually that person. In transaction monitoring, it means activity tripped a rule but is genuinely legitimate on investigation.

False positives are not harmless. Each one consumes analyst time, delays legitimate customers and payments, and — at scale — buries the rare true positive in noise, which is itself a compliance risk.

Why sanctions screening produces so many

Name screening is intrinsically fuzzy. Systems must catch matches despite spelling variations, transliterations, nicknames, and missing data, so they deliberately match loosely. That looseness produces false hits for predictable reasons:

• Common names. A customer sharing a name with a listed person triggers a match with no real connection.
• Transliteration variance. Names originally written in other scripts have many valid Latin spellings, so fuzzy logic casts a wide net.
• Partial data. Without a date of birth or nationality to disambiguate, a name alone matches many list entries.
• Thresholds set conservatively. Because missing a true match is far worse than an extra false one, teams lower match thresholds and accept more noise.

Why monitoring produces so many

On the monitoring side, rules are blunt by nature. A threshold rule cannot tell a legitimate large deposit (a house sale, a bonus) from a suspicious one; it only sees the amount. Static rules that ignore customer context flag ordinary behaviour that happens to resemble a pattern, and poorly tuned thresholds fire constantly on benign activity.

Practical ways to reduce them

There is no switch that eliminates false positives, but several levers meaningfully reduce them:

• Improve data quality. Richer, cleaner customer data — full names, dates of birth, nationalities, identifiers — lets screening confirm or reject matches automatically instead of alerting. Better data is the single highest-impact lever.
• Use secondary matching attributes. Scoring on more than name — date of birth, country, entity type — lets a system dismiss a name match when the other attributes clearly differ.
• Tune thresholds against outcomes. Regularly analyse which rules and match scores produce only false positives, and adjust fuzzy-match sensitivity and rule thresholds using real alert-disposition data.
• Apply whitelisting carefully. Recording confirmed-clear matches (good-guy lists) stops the same benign customer alerting repeatedly, with governance so nothing genuinely risky is suppressed.
• Segment customers. Baselining behaviour by customer type and risk lets rules judge activity against a relevant norm rather than one global threshold.
• Add risk scoring and analytics. Layering machine learning or risk models over rules can rank alerts so analysts work the most likely true positives first.

The balance that must be respected

The one thing you cannot do is chase a low false-positive rate by simply turning screening down until real risk slips through. Regulators expect institutions to catch true matches, and the cost of missing a sanctioned party or a laundering scheme dwarfs the cost of extra alerts. Every tuning decision therefore has to be documented and justified, showing that changes reduce noise without materially raising the chance of a miss. Effective programmes treat false-positive reduction as an optimisation under a hard constraint — cut the noise, but never at the expense of genuine coverage.

Key takeaways

• False positives dominate AML alerts — frequently over 90 percent — and consume most analyst effort.
• Sanctions screening matches loosely on purpose, so common names, transliterations, and thin data drive false hits.
• Monitoring false positives come from blunt, poorly tuned threshold rules that ignore customer context.
• The biggest levers are better data, secondary matching attributes, outcome-based tuning, and governed whitelisting.
• Reduction must never lower genuine coverage; every change should be documented and justified to regulators.