Transaction Monitoring Design and Tuning
We tune monitoring so that the system finds what it should find, and the analysts have time to work through what it finds.
- Duration
- Two to six weeks
- Format
- Remote
- Result
- Rules, procedures and a calibration method
The two extremes monitoring lives between
The system stays silent
Almost no suspicious activity reports, and the statistics look calm. On an inspection that calm turns into a question about why nothing was detected all year, and there is no answer to give.
The queue grows
More alerts than people, so analysts close them without looking in order to clear the backlog. Formally the system works; in practice nobody does.
Tuning monitoring means finding the middle between those extremes, and the middle is different for every firm.
It depends on the risk profile, the products, and how many people can realistically work through alerts.
How the work runs
First
Diagnostics
- Analysis of the current system: rules, scenarios, thresholds and the alert process.
- An effectiveness review: false positive rate, typology coverage, speed of response.
The main work
Tuning
- Design or optimisation of the rule set against the firm's risk profile.
- Setting up alert investigation, escalation and the preparation of reports to the financial intelligence unit.
- Recommendations on automation and systems, including the link to sanctions lists and, for crypto, to blockchain data.
At the end
Go live
- Analyst training and a set of measures for how the system performs.
- Where needed, a pilot and calibration of rules against real data.
What we need from you
A description of the current rules and alert statistics, anonymised is fine. Information about products and customer segments, the systems in use, and a willingness to test new scenarios.
That last point decides the outcome. A rule that has not been run against your data stays a hypothesis, however sensible it looks on paper.
What you get
Rule and scenario set
A current set built around your risk profile and products, with an explanation of why each rule is shaped the way it is.
Alert handling procedures
Investigation, escalation and report preparation, with clear deadlines at every step.
Calibration method
How and against which measures the rules are reviewed from here, so the system does not go stale without us.
Report and improvement plan
An assessment of the current state with numbers, and a prioritised plan of changes, including recommendations on systems.
Timing
The range covers diagnostics and rule tuning. Continuous calibration and support are available separately under a retainer: monitoring is not a project with an end, it is a process that lives alongside your products and your customer base.
Frequently asked questions
How many alerts a day is normal?
There is no norm expressed in numbers, and comparing yourself to someone else's figures is pointless. What matters is different: are alerts worked through on time, what share leads to a report, and is a backlog building up. If the queue grows, the system is not tuned for you, whatever the alert count.
Can monitoring be set up once and left alone?
No. Products, the customer base and typologies change while the rules stay as they were, and gradually stop hitting anything. That is why we hand over a calibration method along with the tuning, so review becomes planned work rather than a scramble after a finding.
How is monitoring different in a crypto business?
Alongside the usual transaction data there is blockchain data: the source of funds, address clustering, work with transaction analysis tools. Scenarios are built with that in mind, otherwise monitoring sees half the picture.
Everything sits in a vendor system we cannot change ourselves. Is that a problem?
No. In that case we prepare the configuration requirements and work with the vendor or with your developers. The understanding of what should fire and why still has to stay with you.
What does it cost?
The fee depends on the number of products and rules, the volume of data and whether a pilot and calibration against real transactions are needed. We name an exact figure after a short conversation and fix the scope in the contract.
Shall we look at your case?
Tell us the task and we will say whether it needs the full piece of work or a narrower one.
Book a consultationNorthhold Advisory is an independent consultancy. We are not affiliated with, and do not represent, the AFM of Kazakhstan, the AIFC (AFSA) or the National Bank of Kazakhstan.