Transaction Monitoring: Rules vs Typologies

Anti-money-laundering (AML) programmes lean heavily on transaction monitoring — the ongoing scrutiny of customer activity to spot the financial fingerprints of crime. Two words come up constantly in this world: rules and typologies. They are related but not the same, and understanding the difference clarifies how monitoring systems are actually built.

What a rule is

A rule is a concrete, codified condition that a monitoring system evaluates against transactions. Rules are deterministic: given the data, a rule either fires an alert or it does not. Typical rules are threshold- and pattern-based, for example:

• A cash deposit at or above a reporting threshold (in the US, cash transactions over 10,000 dollars trigger a Currency Transaction Report).
• Multiple transactions just below a reporting threshold within a short window.
• A sudden spike in activity far above a customer's historical baseline.
• Funds moving rapidly in and then out of an account (pass-through activity).

Rules are the operational layer — the actual logic running against transaction streams. They are precise, auditable, and easy to explain to a regulator, which is exactly why they dominate production monitoring.

What a typology is

A typology is a description of a method or pattern of laundering — the behaviour, not the code. Typologies are the intelligence, often published by bodies like the Financial Action Task Force (FATF) and national financial intelligence units, describing how criminals actually move illicit funds. Common typologies include:

• Structuring (smurfing) — breaking a large sum into many small transactions to stay under reporting thresholds.
• Layering — moving money through multiple accounts, entities, and jurisdictions to obscure its origin.
• Trade-based laundering — mis-invoicing goods to move value across borders.
• Funnel accounts — deposits made in many locations, withdrawn from one.
• Money mules — third parties moving funds on behalf of criminals.

A typology tells you what to look for. It does not, by itself, run against your data.

How the two connect

The relationship is one of translation. A typology is the concept; rules are how you operationalise that concept in a system. Take structuring: the typology says criminals split cash to dodge the 10,000 dollar report. To detect it, you might write several rules — many sub-threshold cash deposits by one customer within days, aggregated deposits crossing the threshold over a rolling window, or repeated deposits at suspiciously round amounts. One typology can spawn many rules, and no single rule fully captures the typology.

Why you need both

Relying on rules alone risks monitoring for the wrong things — firing on activity that is unusual but not actually indicative of any known laundering method, while missing genuine schemes that no rule was written to catch. Relying on typologies alone gives you insight with nothing running in production. Good programmes flow from typology to rule: analysts study typologies (and their own suspicious-activity history), then design and tune rules that express those patterns in the institution's specific data.

This is also why monitoring is never “done.” New typologies emerge as criminals adapt, and rules must be added, retuned, and retired in response. A rule set frozen in time slowly drifts out of alignment with real risk, catching yesterday's schemes while missing today's.

The link also runs in the other direction. When investigators file a suspicious activity report and later learn how a scheme actually worked, that knowledge feeds back as a new or refined typology, which in turn spawns new rules. Mature programmes treat this as a loop: typologies inform rules, alerts and investigations reveal new patterns, and those patterns update the typology library. Institutions supplement published FATF and regulator typologies with their own experience, because the schemes that target a specific business are not always the ones described in general guidance.

The tuning problem

Because rules are threshold-driven, they generate false positives — alerts on legitimate activity that merely resembles a suspicious pattern. Set thresholds too tight and analysts drown in noise; set them too loose and real activity slips through. Tuning is the continuous discipline of adjusting thresholds and logic against outcomes, and increasingly institutions supplement rules with behavioural analytics and machine learning to catch patterns that static thresholds miss. Even so, the typology-to-rule backbone remains, because explainability to regulators demands logic that can be described and justified.

Key takeaways

• A rule is codified, deterministic logic that fires alerts; a typology describes a real-world laundering method.
• Typologies (structuring, layering, trade-based laundering) are the intelligence; rules are how you operationalise them.
• One typology usually maps to several rules, and no single rule fully captures a typology.
• Effective programmes translate typologies into tuned rules against their own data and update both as threats evolve.
• Threshold-based rules generate false positives, making continuous tuning — and increasingly analytics — essential.