Brolly Academy | AML
Transaction Monitoring in AML
How Alerts Are Raised, Rule Types, False Positives and Step-by-Step Alert Investigation (2026)
A plain-English guide to transaction monitoring in AML for India in 2026: how alerts are made, the rules banks use, false positives, how an analyst investigates an alert, when an STR goes to FIU-IND, tools, KPIs and the TM analyst job.
Transaction monitoring in AML explained: how alerts are raised, common rules, false positives, a step-by-step alert investigation, STR filing and tools.
By Brolly Academy Team · Brolly Academy · Updated 24 October 2026
Table of Contents
1. Transaction monitoring at a glance
2. What is transaction monitoring in AML?
3. Why banks must monitor transactions in India
4. How a transaction monitoring system works
5. Transaction monitoring rules: types and examples
6. Scenario tuning and false positives
7. Real-time vs batch transaction monitoring
8. How an analyst investigates an alert, step by step
9. A worked alert from start to finish
10. The STR decision and FIU-IND filing timeline
11. Transaction monitoring tools
12. KPIs for transaction monitoring teams
Quick answer
Transaction monitoring is the ongoing review of a customer's transactions to check that they match what the bank knows about that customer, and to flag anything unusual that could be money laundering or terrorist financing. Banks run their transaction data through rules and models in monitoring software. The software raises an alert when a pattern looks wrong. An L1 analyst reviews the alert, an L2 investigator digs deeper if needed, and the bank either closes the alert with a reason or files a Suspicious Transaction Report (STR) with FIU-IND. In India this is a legal duty: the RBI's KYC Directions require banks to monitor transactions and to match the depth of monitoring to each customer's risk.
- Input: transactions plus KYC data (who the customer is, what they do, expected activity)
- Engine: rules (thresholds, velocity, structuring, geography) and, increasingly, models
- Output: alerts, which analysts close or escalate
- End point: closure with a documented reason, or an STR to FIU-IND
- People: L1 analysts, L2 investigators, and the Principal Officer who decides on the STR
Key takeaways
- The RBI's Commercial Banks KYC Directions, 2025 say the extent of monitoring must match the customer's risk category, and risk categorisation must be reviewed at least once every six months (RBI, October 2026).
- A monitoring system works as a pipeline: data, rules and models, alerts, L1 review, L2 investigation, then closure or STR.
- A large share of alerts turn out to be false positives, so scenario tuning and good L1 judgement matter as much as the software.
- FIU-IND expects an STR not later than seven working days after the Principal Officer is satisfied a transaction is suspicious (FIU-IND FAQs, October 2026).
- Transaction monitoring analyst is a common entry and mid-level AML role; AmbitionBox showed a typical range of ₹5.4 to 6 lakh a year for 1 to 6 years of experience in October 2026.
1. Transaction monitoring at a glance
Short answer: Transaction monitoring is the "after onboarding" control in AML: KYC checks who the customer is, and monitoring checks whether their money behaves the way their profile says it should.
2. What is transaction monitoring in AML?
Short answer: Transaction monitoring in AML means watching the money moving through each account, comparing it with what you know about the customer, and flagging activity that has no clear business or personal reason.
Anti-money laundering (AML) is the set of laws, controls and checks that stop criminals from making dirty money look clean. If you are new to the field, start with our guide to anti-money laundering basics, then come back here.
The RBI calls this control "on-going due diligence". In the Reserve Bank of India (Commercial Banks – Know Your Customer) Directions, 2025, banks must make sure a customer's transactions are consistent with what the bank knows about the customer, their business, their risk profile and the source of their funds or wealth (RBI, October 2026). These Directions, dated 28 November 2025, replaced the earlier 2016 Master Direction on KYC for commercial banks.
A few terms you will see throughout this guide:
- KYC (Know Your Customer): collecting and verifying a customer's identity documents and basic details at onboarding.
- CDD (Customer Due Diligence): identifying and verifying the customer and the real owner behind them, and understanding the purpose of the account. EDD (Enhanced Due Diligence) is the deeper version used for high-risk customers.
- Alert: a flag raised by the monitoring system when a transaction or pattern breaks a rule.
- False positive: an alert that turns out, after review, to be legitimate activity.
- STR (Suspicious Transaction Report): the report a bank files with FIU-IND when it suspects a transaction is linked to crime.
- FIU-IND (Financial Intelligence Unit – India): the national agency under the Ministry of Finance that receives and analyses these reports.
- Typology: a known method or pattern criminals use, such as structuring cash below a limit.
- L1, L2, L3: the levels of review. L1 does first-level alert triage, L2 does deeper investigation, and L3 usually means senior investigators, quality reviewers or the team that signs off STRs.
Transaction monitoring is different from sanctions screening. Screening checks names against lists such as the UN Security Council lists before or during a payment. Monitoring looks at behaviour over time. Most banks run both, often in separate teams.
3. Why banks must monitor transactions in India
Short answer: Indian banks monitor transactions because the RBI's KYC Directions require it, because the PMLA makes them report suspicious and large cash transactions to FIU-IND, and because missed reports can lead to fines.
Three layers of rules sit behind every monitoring team in India.
1. The RBI KYC Directions. Paragraphs 39 to 41 of the 2025 Directions set the monitoring duty (RBI, October 2026). Paragraph 40 says the bank must monitor these types of transactions:
- Large and complex transactions, including RTGS transactions, and those with unusual patterns or no apparent economic rationale or legitimate purpose
- Transactions that exceed the thresholds prescribed for specific categories of accounts
- High account turnover that does not fit the size of the balance maintained
- Deposits of third-party cheques, drafts and similar instruments in existing and newly opened accounts, followed by large cash withdrawals
Paragraph 41 says the bank must align the extent of monitoring with the customer's risk category, review risk categorisation at least once every six months, and subject high-risk accounts to more intensified monitoring. It also asks banks to watch the accounts of marketing firms, especially multi-level marketing companies, closely. Do not confuse this six-monthly review with periodic KYC updation, which the same Directions set at least once every 2 years for high-risk, every 8 years for medium-risk and every 10 years for low-risk customers. The same paragraph 40 lets banks consider innovations such as artificial intelligence and machine learning tools.
2. The PMLA and the PML Rules. Under section 12 of the Prevention of Money-laundering Act, 2002, reporting entities must keep transaction records and report prescribed transactions to the Director of FIU-IND. The FIU-IND FAQs list what must be recorded and reported, including cash transactions above ₹10 lakh, integrally connected cash transactions that together cross ₹10 lakh in a month, cross-border wire transfers above ₹5 lakh, and all suspicious transactions (FIU-IND, October 2026). Transaction records must be kept for 5 years.
3. Penalties. The same FIU-IND FAQs say the Director of FIU-IND can fine a reporting entity, its designated director or its employees from ₹10,000 to ₹1 lakh for each failure. In FY 2024-25, FIU-IND passed 8 compliance orders with an aggregate penalty of about ₹30.5 crore (FIU-IND Annual Report 2024-25, October 2026).
The volume is large. The same annual report shows Indian reporting entities filed 4,34,668 STRs and 1,73,13,368 CTRs (cash transaction reports) in FY 2024-25. Many of those STRs start life as a monitoring alert.
This guide is for education, not legal advice. Check the current Act, rules and RBI Directions, or ask a lawyer, before you rely on any rule for a real case.
4. How a transaction monitoring system works
Short answer: A transaction monitoring system pulls transaction and customer data into one place, runs it through rules and models, raises alerts, and routes each alert through L1 review and, if needed, L2 investigation until it is closed or reported as an STR.
Here is the flow most banks and GCC (global capability centre) operations teams follow. You can picture it as six boxes in a row.
- Data collection. The system takes in transactions from every channel: cash deposits and withdrawals, NEFT, RTGS, IMPS, UPI, cheques, cards, wire transfers and trade payments. It joins them with KYC data such as occupation, declared income, business type, risk rating and expected monthly activity.
- Rules and models. Scenarios run on the data, usually in a nightly batch, sometimes in real time. A rule might say "flag cash deposits that add up to more than X in Y days for a low-risk salaried customer". Models score how unusual an account looks compared with its own history or its peer group.
- Alert generation. When a scenario fires, the system creates an alert and attaches the transactions that triggered it. Related alerts on the same customer are often grouped.
- L1 review. An L1 analyst checks the alert against the customer profile and recent history. Many alerts are explained here, for example a salary bonus or a property sale with documents, and closed with a written reason.
- L2 investigation. Alerts that L1 cannot explain are escalated. The L2 investigator looks at the full relationship: linked accounts, counterparties, open-source information, past alerts and, sometimes, a request for information to the branch or relationship manager.
- Decision: STR or closure. The investigator writes a case narrative and recommends either closure or an STR. The Principal Officer (the officer named to FIU-IND for reporting) decides, and the STR is filed with FIU-IND.
5. Transaction monitoring rules: types and examples
Short answer: Most monitoring rules fall into a few families: thresholds, velocity, structuring, dormant account activity, high-risk geography, round amounts, and profile mismatches; each one targets a known laundering pattern.
A rule (also called a scenario) is a condition the system checks on every account. Each bank sets its own parameters based on its risk assessment and customer base. The examples below are illustrative only; they are not regulatory limits.
Two of these rows come straight from paragraph 40 of the RBI Directions (RBI, October 2026). The structuring example connects to another RBI rule: CDD applies to occasional transactions of ₹50,000 or more, and banks must also apply it where they suspect a customer is breaking transactions below ₹50,000 to avoid that check.
To understand which rule catches which stage of placement, layering and integration, read our guide to the stages of money laundering.
6. Scenario tuning and false positives
Short answer: Tuning means adjusting rule thresholds and logic so the system catches real risk without burying analysts in alerts; a false positive is an alert that turns out to be normal activity, and a large share of alerts end up that way.
A loose rule floods the team with alerts and hides the few that matter. A tight rule misses real laundering, which is the bigger regulatory risk.
Why false positives happen:
- Poor KYC data. If the declared income or occupation is out of date, normal salary hikes or business growth look suspicious.
- One-size thresholds. The same cash limit for a kirana shop owner and a salaried IT employee will fire constantly on one of them.
- Seasonal patterns. Festival sales and year-end bonuses create spikes that rules read as unusual.
- Duplicate scenarios. Two rules that look at the same behaviour raise two alerts for one event.
How banks tune rules, in a typical cycle:
- Segment customers. Group them by type, such as salaried individuals, students, small businesses, corporates and NRIs, and set different parameters for each.
- Analyse alert outcomes. Look at which rules produce alerts that analysts close, and which produce escalations and STRs.
- Test below the line. Sample transactions just under the current threshold to check the bank is not missing real cases. This is called below-the-line testing.
- Adjust, document and recheck. Change the thresholds, record why, get compliance sign-off, then watch alert volumes and STR quality after the change.
You will also hear about machine learning in monitoring. Models can score alerts so analysts see the riskiest first, or spot unusual behaviour that fixed rules miss. The RBI Directions allow banks to consider AI and machine learning tools in monitoring (RBI, October 2026). In practice, many banks keep rules as the base layer and add models on top, because rules are easier to explain to auditors.
7. Real-time vs batch transaction monitoring
Short answer: Batch monitoring reviews transactions after they happen, usually overnight, and suits most AML patterns; real-time monitoring checks a payment before or as it goes through, and suits fraud, sanctions and instant payments.
Most banks use both. Scenarios that need a pattern over time, like structuring across branches, only make sense in batch. Real-time checks matter more as instant payments such as UPI and IMPS make money move in seconds, which gives mule networks very little time between credit and cash-out.
8. How an analyst investigates an alert, step by step
Short answer: An analyst reads the alert, checks the customer profile, reviews the transactions in context, researches the counterparties, decides whether the activity is explained, and writes a clear rationale for closure or escalation.
Procedures differ by bank, but most L1 and L2 work follows these steps.
- Read the alert. Note which rule fired, the date range and the transactions attached. Ask: what exactly looks unusual?
- Check the KYC profile. Look at occupation, declared income, account purpose, risk rating, date of onboarding and when KYC was last updated.
- Review account history. Compare the alerted activity with the last 6 to 12 months. Is this a one-off, or a new pattern?
- Look at counterparties. Who sent the money and who received it? Are they related, new, repeated, or linked to other alerted accounts?
- Check past alerts and cases. Has this customer been alerted or reported before? Are there linked accounts with the same mobile number, address or device?
- Run screening and open-source checks. Search for adverse media and check names against sanctions and PEP (politically exposed person) lists through the bank's screening tools.
- Ask for information if allowed. At L2, the investigator may ask the branch or relationship manager for supporting documents. They must not tip off the customer about a possible STR. The RBI Directions say banks must keep risk categorisation confidential and must not tip off the customer (RBI, October 2026).
- Decide. Is there a reasonable, documented explanation? If yes, close. If no, or if red flags remain, escalate or recommend an STR.
- Write the narrative. Record who, what, when, where, how much and why it is or is not suspicious. A reviewer who has never seen the case should understand your decision in two minutes.
The written rationale is your most important output, because reviewers, auditors and FIU-IND all rely on it. Our guide to the AML analyst role covers the wider daily routine around this work.
9. A worked alert from start to finish
Short answer: Here is a fictional alert followed from rule to decision, so you can see how the steps fit together; all names and figures are invented for teaching.
The alert (fictional). A structuring rule fires on the savings account of "Suresh M", opened in 2023. The alert shows 14 cash deposits of between ₹45,000 and ₹49,000 at 6 different branches across Hyderabad over 12 days, a total of about ₹6.6 lakh. Two days after the last deposit, ₹6.4 lakh leaves the account by RTGS to a beneficiary added the week before.
Step 1: KYC profile. Suresh is recorded as a salaried employee at a private firm, low risk, with a monthly salary credit of about ₹55,000. He has never deposited more than ₹20,000 cash in a month before.
Step 2: History and pattern. The deposits are new behaviour. Every single one sits just under ₹50,000, which matches the structuring red flag the RBI describes. Using several branches adds to the concern.
Step 3: Counterparty. The RTGS beneficiary is a newly opened current account of a trading firm in another state. The bank's records show two other alerted customers sent money to the same account this month.
Step 4: Checks and information request. No adverse media and no sanctions or PEP match on Suresh. The L2 investigator asks the home branch for any known reason, such as a property sale. The branch has no documents. Nobody contacts Suresh about the alert.
Step 5: Decision. The pattern has no economic rationale that fits the profile. It shows likely structuring, a pass-through to a new beneficiary and a link to other alerted customers, which suggests a mule network. The total is under ₹10 lakh, so it does not trigger an integrally connected cash report, but suspicion does not depend on value. The investigator recommends an STR.
Step 6: Narrative and sign-off. The case goes to the Principal Officer with a narrative, a transaction table and the linked accounts. Once the Principal Officer is satisfied the activity is suspicious, the seven-working-day clock for the STR starts. The bank also raises the customer's risk rating and considers enhanced due diligence.
10. The STR decision and FIU-IND filing timeline
Short answer: An STR is filed when the bank has reasonable grounds to suspect a transaction, regardless of value; it must reach FIU-IND not later than seven working days after the Principal Officer is satisfied, while CTRs and other threshold reports are filed monthly by the 15th.
FIU-IND's definition of a suspicious transaction covers a transaction, including an attempted one, cash or not, that gives reasonable grounds to suspect it involves proceeds of a scheduled offence regardless of value, has unusual or unjustified complexity, has no economic rationale or bona fide purpose, or may involve terrorist financing (FIU-IND Annual Report 2024-25).
Three points in that definition matter for monitoring analysts. Attempted transactions count, so a refused or abandoned transaction can still be reportable. Value does not matter, so a small transaction can be suspicious. And "no economic rationale" is exactly what an alert review tests.
The main FIU-IND reports and timelines, as listed in the FIU-IND FAQs (October 2026):
Reporting entities register with FIU-IND and file through its FINnet online reporting system, after naming a Designated Director and a Principal Officer (FIU-IND FAQs). In most banks, analysts prepare the case and the Principal Officer's team files it.
11. Transaction monitoring tools
Short answer: Banks run monitoring on specialist AML platforms such as NICE Actimize, SAS Anti-Money Laundering and Oracle Financial Crime and Compliance Management, plus newer AI-led platforms, and analysts also rely heavily on Excel and SQL.
Here are named platforms, described the way their owners describe them on their websites (October 2026):
- NICE Actimize: AI-driven fraud prevention and AML solutions for detecting financial crime.
- SAS Anti-Money Laundering: a risk-based approach to uncovering illicit activity in line with AML and CFT rules.
- Oracle Financial Crime and Compliance Management: a suite for AML, KYC and sanctions compliance using AI, machine learning and analytics.
- Napier AI: an AI-powered AML platform for transaction monitoring and sanctions screening.
- Hummingbird: risk and compliance operations software with case management and automated SAR, STR and CTR filing.
Job descriptions show what analysts actually touch. A Deutsche Bank AML monitoring and screening listing for 0 to 3 years' experience in Jaipur and Bengaluru, seen on 24 October 2026, asks the analyst to review transaction monitoring alerts at L1, close or escalate them, and names Actimize, Fircosoft and Mantas as platforms.
For analysts, Excel matters every day: pivot tables to summarise transactions, filters to spot repeated amounts, and lookups to match counterparties. SQL helps when you pull data yourself. For the full list of tools by function, read our guide to AML software.
12. KPIs for transaction monitoring teams
Short answer: Monitoring teams are measured on speed, quality and effectiveness: how fast alerts are cleared, how accurate decisions are, how many alerts turn into cases and STRs, and how well the rules perform.
Job descriptions often mention productivity, quality and SLA (service level agreement) targets together.
13. Career as a transaction monitoring analyst
Short answer: A transaction monitoring analyst reviews alerts, investigates unusual activity and prepares STR cases; the role suits commerce graduates and banking staff, usually starts at L1 and can grow into investigations, QA, tuning or team leadership.
Where TM analysts work. Indian private and public sector banks, global banks' GCCs in Hyderabad, Bengaluru, Pune, Chennai and Mumbai, consulting firms and BPO or KPO operations that run monitoring for overseas banks. Many GCC roles review alerts for US, UK or European customers, so you will also hear about the US Bank Secrecy Act and SARs (suspicious activity reports, the US equivalent of STRs).
How the levels compare.
Salary. On AmbitionBox's Transaction Monitoring Analyst page (updated 21 October 2026, based on 823 reported salaries), the typical range was ₹5.4 to 6 lakh a year for 1 to 6 years of experience. The experience bands shown to logged-out users were about ₹4.2 to 4.7 lakh for 1 to 3 years (309 salaries), ₹5.7 to 6.2 lakh for 3 to 6 years (465 salaries) and ₹7.1 to 8.5 lakh for 6 to 9 years (37 salaries, a small sample). These are typical ranges from self-reported data, not offers. For city-wise and role-wise figures, see our AML analyst salary in India guide.
What employers ask for. Most operations listings ask for any graduate, with commerce or finance preferred in some. Certifications like CAMS are usually listed as good to have, not mandatory. Strong written English, Excel, a clear grasp of KYC and red flags, and comfort with shifts help most. The Deutsche Bank listing above shows that some entry-level L1 roles exist, but many TM roles ask for 1 year or more of KYC or banking operations experience.
14. How Brolly Academy helps
Short answer: Brolly Academy's 45-day AML Course in India covers KYC, CDD, regulation, typologies and AML technology, and introduces transaction monitoring tools, with a transaction monitoring capstone project and placement assistance.
If you want structured training before applying for KYC or TM analyst roles, here is what the Brolly Academy AML Course in India offers, as stated on the course page (Brolly Academy, October 2026):
- Duration and format: 45 days, live online across India or classroom in Hyderabad, plus a self-paced video recording plan. Weekday and weekend batches run, and a free demo class is offered before you enrol.
- Syllabus: 7 modules, from understanding money laundering and AML risks and typologies to sector risks, the regulatory framework (FATF, RBI, SEBI, reporting), CDD and KYC including EDD, AML compliance programmes and AML technology (monitoring software, AI and machine learning).
- Tools introduced: NICE Actimize, SAS AML, Oracle Financial Services (OFSAA), FICO TONBELLER, BAE Systems NetReveal, ComplyAdvantage, World-Check, Excel and SQL. The course introduces these systems; it does not promise hands-on licences.
- Capstone projects: six, including a transaction monitoring project, a KYC verification case study, a fraud detection simulation, compliance reporting, a risk assessment and an end-to-end AML case.
- Fees: Video Recording ₹6,999, Online Course ₹14,999 and Classroom Training ₹19,999.
- Trainer: Mr. Ravi Rama Chandran, AML and compliance expert with 8+ years in AML, KYC and compliance.
- Career support: resume building, mock interviews and placement assistance. The certificate is a Brolly Academy course completion certificate; certifications such as IIBF AML and KYC or ACAMS CAMS are separate and have their own fees.
The next batch listed on the page starts on Monday, 2 November 2026.
Learn to investigate alerts the way TM teams do
Reading about alerts is a start, but writing a clear closure rationale or STR narrative takes practice on real-looking cases. Brolly Academy's 45-day AML Course in India covers KYC, CDD, typologies, Indian regulation and AML technology, with a transaction monitoring capstone project, mock interviews and placement assistance. Join a free demo class to see the teaching style before you enrol.
Frequently asked questions
What is transaction monitoring?
Transaction monitoring is the ongoing review of a customer's transactions to check that they fit what the bank knows about that customer. The bank compares activity with the customer's profile, risk rating and source of funds, and flags unusual patterns as alerts. Analysts then review each alert and either close it with a documented reason or escalate it, which can lead to a Suspicious Transaction Report to FIU-IND.
What is transaction monitoring in AML?
In AML, transaction monitoring is the control that looks for money laundering and terrorist financing after a customer is onboarded. KYC checks who the customer is, and monitoring checks whether their money behaves as expected. The RBI calls this on-going due diligence and requires banks to make sure transactions are consistent with the customer's profile, business, risk and source of funds or wealth.
Is transaction monitoring mandatory for banks in India?
Yes. The RBI's Commercial Banks KYC Directions, 2025 require banks to carry out on-going due diligence and to monitor specific types of transactions, such as large and complex transactions, high turnover inconsistent with the balance, and third-party deposits followed by large cash withdrawals. The PMLA also requires reporting entities to keep records and report suspicious and prescribed transactions to FIU-IND.
The extent of transaction monitoring depends on what?
The extent of transaction monitoring depends on the risk category of the customer. Paragraph 41 of the RBI's 2025 KYC Directions says banks must align the extent of monitoring with the customer's risk category, and high-risk accounts must face more intensified monitoring. So a high-risk customer's account is watched more closely than a low-risk salaried customer's account.
What is the periodicity for reviewing risk categorisation in transaction monitoring?
The RBI's 2025 KYC Directions say banks must review the risk categorisation of customers at least once every six months, and check whether enhanced due diligence is needed. This is different from periodic KYC updation, which the Directions set at least once every two years for high-risk customers and at longer intervals for medium and low-risk customers.
How does a transaction monitoring system work?
A transaction monitoring system collects transaction and customer data, runs it through rules and models, and creates alerts when a pattern looks unusual. An L1 analyst reviews each alert and closes or escalates it. An L2 investigator examines escalated cases in depth. Finally, the bank closes the case with a documented reason or the Principal Officer decides to file an STR with FIU-IND.
What are transaction monitoring rules?
Transaction monitoring rules, also called scenarios, are conditions the system checks on every account. Common types include thresholds, velocity, structuring, dormant account activity, high-risk geography, round amounts and profile mismatches. Each bank sets its own parameters based on its risk assessment and customer segments, so the exact limits differ from bank to bank and are not regulatory figures.
What are some examples of transaction monitoring alerts?
Typical alerts include many cash deposits just under ₹50,000 across branches, a dormant account suddenly moving large sums, money credited and sent out within hours, round-figure transfers to many people, and turnover far above what a customer's declared income supports. Third-party cheques deposited into a new account followed by large cash withdrawals is another pattern the RBI specifically asks banks to monitor.
What is a false positive in transaction monitoring?
A false positive is an alert that turns out, after review, to be legitimate activity, such as a salary bonus, a documented property sale or seasonal business income. A large share of alerts end up as false positives. They happen because of outdated KYC data, one-size thresholds, seasonal patterns and duplicate rules, which is why banks regularly tune their scenarios.
What is scenario tuning in AML?
Scenario tuning is the process of adjusting monitoring rules so they catch real risk without flooding analysts with alerts. Banks segment customers, study which rules lead to escalations and STRs, test transactions just below current thresholds, change parameters with documented reasons and compliance sign-off, and then watch alert volumes and STR quality after the change.
What is the difference between real-time and batch transaction monitoring?
Batch monitoring reviews transactions after they happen, often overnight, and suits patterns that build over days or weeks, such as structuring or layering. Real-time monitoring checks a payment before or as it goes through, so the bank can hold or block it. Real-time checks suit fraud, sanctions hits and instant payments, and most banks use both approaches together.
What is the difference between transaction monitoring and sanctions screening?
Sanctions screening checks names of customers and payment parties against lists, such as the UN Security Council lists, before or during a transaction. Transaction monitoring looks at the behaviour of an account over time to find unusual patterns. Screening asks whether a person is on a list, while monitoring asks whether the activity makes sense. Most banks run both, often in separate teams.
What does a transaction monitoring analyst do?
A transaction monitoring analyst reviews alerts raised by the monitoring system, checks them against the customer's KYC profile and history, researches counterparties, and decides whether the activity is explained. The analyst writes a clear rationale to close the alert or escalates it. At L2, the analyst investigates in depth and prepares STR narratives for the Principal Officer.
What is the difference between L1 and L2 in transaction monitoring?
L1 analysts do first-level alert triage. They check the profile and recent activity and close or escalate each alert with a written reason. L2 investigators handle escalated alerts, review the full relationship including linked accounts and counterparties, run open-source research, may request information from the branch, and write the case narrative that recommends closure or an STR.
How do you investigate a transaction monitoring alert?
Read the alert and the rule that fired, check the KYC profile, compare the activity with the last 6 to 12 months, and look at counterparties and linked accounts. Check past alerts, run screening and adverse media checks, and request information if your role allows, without tipping off the customer. Then decide and write a narrative a reviewer can follow quickly.
When should a bank file an STR?
A bank should file an STR when it has reasonable grounds to suspect a transaction, including an attempted one, involves proceeds of crime regardless of value, has unusual or unjustified complexity, has no economic rationale or bona fide purpose, or may involve terrorist financing. In practice, an investigator recommends the STR and the Principal Officer decides whether the activity is suspicious.
What is the STR filing timeline in India?
FIU-IND expects an STR not later than seven working days after the Principal Officer is satisfied that a transaction is suspicious. The clock starts from that decision, not from the date of the alert. Cash transaction reports, cross-border wire transfer reports and non-profit transaction reports follow a different, monthly cycle and are due by the 15th of the following month.
What is the difference between an STR and a CTR?
An STR is filed when there is suspicion, regardless of value, and is due within seven working days of the Principal Officer's decision. A CTR is a threshold report for cash transactions above ₹10 lakh, or integrally connected cash transactions above ₹10 lakh in a month, and is filed monthly by the 15th of the next month, whether or not anything looks suspicious.
What is tipping off in AML?
Tipping off means letting a customer know, directly or indirectly, that the bank suspects them or is considering an STR. It can alert criminals and damage an investigation. The RBI's KYC Directions require banks to keep risk categorisation confidential and avoid tipping off, so analysts and branch staff must never tell a customer about an alert or a possible report.
Which tools are used for transaction monitoring?
Banks use specialist AML platforms such as NICE Actimize, SAS Anti-Money Laundering and Oracle Financial Crime and Compliance Management, along with newer AI-led platforms such as Napier AI. A Deutsche Bank listing seen in October 2026 also named Fircosoft and Mantas. Day to day, analysts depend heavily on Excel for pivots, filters and lookups, and SQL helps when pulling data directly.
What KPIs are used in transaction monitoring?
Common KPIs include alert turnaround time, backlog and ageing, productivity per analyst, quality score from QA reviews, alert-to-case rate, case-to-STR rate, false positive rate and STR timeliness. Exact targets vary by bank and client. Productivity, quality and service level targets often appear together in job descriptions, and quality of decisions is what reviewers and auditors look at most closely.
What is the salary of a transaction monitoring analyst in India?
AmbitionBox showed a typical range of about ₹5.4 to 6 lakh a year for transaction monitoring analysts with 1 to 6 years of experience, based on 823 reported salaries, updated on 21 October 2026. Bands were about ₹4.2 to 4.7 lakh for 1 to 3 years and ₹5.7 to 6.2 lakh for 3 to 6 years. These are self-reported typical ranges, not offers.
Can a fresher get a transaction monitoring job?
Yes, but entry-level roles are fewer than roles asking for experience. Some L1 alert review roles accept 0 to 3 years, such as a Deutsche Bank listing seen in October 2026, while many TM roles ask for a year or more of KYC or banking operations work. Strong written English, Excel, and a clear understanding of KYC and red flags improve your chances.
What qualifications do you need for a transaction monitoring analyst role?
Most operations listings ask for any graduate, and some prefer commerce or finance. Certifications such as CAMS are usually listed as good to have rather than mandatory. Employers look for clear written English, Excel skills, knowledge of KYC, red flags and Indian reporting rules, and willingness to work shifts, since many GCC teams support overseas banks.
Does Brolly Academy's AML course cover transaction monitoring?
Yes. Brolly Academy's 45-day AML Course in India includes an AML technology module covering monitoring software, AI and machine learning, introduces tools such as NICE Actimize, SAS AML and Oracle Financial Services, and includes a transaction monitoring capstone project among its six projects. It also offers mock interviews and placement assistance, with a free demo class before you enrol.
Learn with Brolly Academy
Review the syllabus, practical projects and batch timings, and book a free demo before you enrol.
Related Articles
Continue Your Learning
AML Course in India
45-day programme in KYC, customer due diligence, transaction monitoring, AML regulations and compliance, with case studies, capstone projects and placement assistance.
View CourseBusiness Analyst Course in Hyderabad
Learn requirements, process mapping, documentation and stakeholder skills used by analysts in banks and financial services teams.
View CourseData Analytics Course in Hyderabad
Build Excel, SQL and dashboard skills that help in alert analysis, reporting and data-driven compliance roles.
View Course