Model Risk and Tuning Transaction-Monitoring Rules

A transaction-monitoring system generates alerts based on rules and models, and every one of those rules has parameters: thresholds, time windows, amounts, counts. Set them too tight and analysts drown in false positives; set them too loose and real financial crime slips through unnoticed. The discipline of choosing and validating those parameters is tuning, and the broader practice of managing the ways these models can be wrong is model risk management. This post explains both and why regulators care so much about them.

Why tuning matters so much

Monitoring rules are blunt instruments. A rule like "alert on aggregate cash deposits over a threshold in a rolling window" is only useful if the threshold and window reflect real risk. Most alerts that a typical system generates turn out to be false positives — legitimate activity that merely resembles a suspicious pattern. Each false positive costs analyst time, and a backlog of noise can bury the genuine alerts that matter. At the same time, a threshold set too high creates false negatives: real laundering that never triggers an alert. Tuning is the search for the parameter values that best separate the two.

Above-the-line and below-the-line testing

The core technique for tuning a threshold is testing on both sides of it. Suppose a rule fires when a value exceeds a threshold — the threshold is "the line."

• Above-the-line (ATL) testing examines the alerts the rule actually produced. What proportion were genuinely suspicious versus noise? A rule producing almost all false positives is inefficient and a candidate for a higher threshold or extra conditions.
• Below-the-line (BTL) testing examines the transactions that fell just short of the threshold and did not alert. If sampling those near-misses turns up activity that should have been flagged, the threshold is too high and is hiding risk. BTL testing is how you find false negatives you would otherwise never see.

Together, ATL and BTL testing bracket the threshold from both directions, giving evidence for whether it sits in the right place. Regulators expect this kind of empirical justification rather than thresholds pulled from thin air.

Segmentation

A single global threshold rarely fits everyone. A USD 10,000 aggregate that is unremarkable for a cash-intensive retailer is alarming for a salaried individual. Effective tuning uses segmentation: grouping customers by type, expected behaviour, product, and geography, then setting parameters per segment. Good segmentation sharpens detection and cuts false positives by comparing customers against relevant peers rather than one universal yardstick.

Model risk: the ways monitoring goes wrong

Regulators increasingly treat monitoring systems as models subject to formal model risk management, echoing frameworks originally written for capital and credit models. Model risk is the risk of adverse outcomes from a model that is flawed or misused. In transaction monitoring it shows up as:

• Coverage gaps. Typologies or products the rule set simply does not address, so certain risks are invisible.
• Data quality problems. Missing, mis-mapped, or stale data that makes rules fire wrongly or not at all. Garbage in, garbage out.
• Drift. Customer behaviour, products, and criminal typologies change over time, so a well-tuned rule slowly decays.
• Overfitting and opacity. Complex or machine-learning models that perform well in testing but cannot be explained to an investigator or regulator.

Governance: keeping models honest

Managing model risk is a governance process, not a one-off. Mature programs include:

• Independent validation. A team separate from the one that built the model reviews its assumptions, data, and performance.
• Documentation. Every threshold, window, and segmentation choice is documented with the rationale and the testing behind it.
• Periodic re-tuning. Thresholds are revisited on a schedule and after material changes to products or customer mix, using fresh ATL and BTL testing.
• Ongoing monitoring of the monitor. Tracking alert volumes, false-positive rates, and productivity so degradation is caught early.
• Change control. Any parameter change is reviewed, approved, and traceable, because a careless tweak can open or close a risk window.

The goal is a system whose behaviour is understood, justified, and kept current — one that can be explained to a regulator with evidence, not assertion.

Key takeaways

• Monitoring rules depend on tuned parameters; too tight floods analysts with false positives, too loose creates false negatives that hide real crime.
• Above-the-line testing checks the alerts produced; below-the-line testing samples near-misses to find risk the threshold is hiding.
• Segmentation sets parameters per customer type and behaviour rather than one global threshold.
• Monitoring systems are treated as models with model risk from coverage gaps, bad data, drift, and opacity.
• Governance — independent validation, documentation, periodic re-tuning, and change control — keeps the system defensible and current.