GRA · Financial Crime and Fraud Risk
Spatial financeWhere capital meets hazard, exposure and transition
Suspicious activity controls
Financial institutions must know their customers, monitor transactions and report suspicion to financial intelligence units. These controls are costly and produce many reports, while the share that lead to law enforcement action is hard to observe. This page sets out how customer due diligence, monitoring and reporting work and where they are ineffective, how effectiveness is measured, and who decides.
Suspicious activity controls on the record.
Suspicious activity controls: how the risk develops.
Investigation responsibility and safeguards. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Rules generate noise
Rule-based transaction monitoring flags many alerts that turn out to be legitimate. Analysts spend time clearing false positives, and real cases can be missed in volume.
Defensive reporting
Fear of penalties encourages filing reports of low value, which strains FIUs. Feedback from FIUs to reporters is often limited.
Each bank sees a fragment
Launderers spread activity across institutions. One bank sees only part of the pattern, which is why information sharing partnerships exist.
Effectiveness versus compliance
Supervisors increasingly ask whether controls produce useful intelligence, not only whether processes exist. Measuring that requires outcome data from law enforcement.
What suspicious activity controls means for exposure, loss and capital.
The exposure, loss, scenario and capital views a risk officer, supervisor or ministry of finance would ask for, with the frameworks they report against. Structures follow supervisory and actuarial practice. Values are illustrative: never prices, ratings or advice.
Transmission channels
How a shock in suspicious activity controls reaches credit, market, underwriting, liquidity and operational risk, and feeds back.
What is measured, and how well.
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Suspicious activity reports filed | count by sector | annual | FIU annual reports | Published statistics |
| Transaction monitoring false positive rate | share of alerts closed without report | periodic | Firm data | DECLARED |
| Reports used in investigations | count or share | annual | FIU and law enforcement reports | REPORTED |
| Feedback provided by FIU to reporters | count of feedback instances | annual | FIU reports | Published statistics |
| Public-private partnership cases | count | annual | Partnership reports | REPORTED |
| AML enforcement penalties | count and currency | annual | Regulator enforcement records | Published statistics |
Where the evidence comes from.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| FinCEN SAR statistics | United States suspicious activity report volumes | Public domain |
| UK Financial Intelligence Unit SARs annual report | UK reporting and use of SARs | Open Government Licence |
| Europol Financial Intelligence Public Private Partnership publications | Partnership practice in Europe | Free, Europol terms |
| FATF guidance on partnerships and information sharing | Practice on private sector information sharing | Free, FATF terms |
| Regulator enforcement notices | AML control failures and penalties | Public records, terms per regulator |
Who decides, and what the evidence serves.
Financial Crime and Fraud Risk prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Money laundering reporting officers | Which alerts become reports and how monitoring is tuned | Alert data, typologies and FIU feedback |
| FIUs | How reports are analysed, disseminated and fed back | Report volumes and outcomes |
| AML supervisors | Whether controls are effective as well as present | Supervisory testing and outcome evidence |
| Legislators | What information sharing between institutions is permitted | Partnership evidence and privacy safeguards |
Outputs this topic produces
- Guide to due diligence, monitoring and reporting duties
- Brief on measuring the effectiveness of suspicious activity reporting
- Comparative notes on public-private information sharing
- Questions for boards on monitoring model performance
What experts ask.
Researchers on suspicious activity controls ask how reporting turns into useful intelligence.
- How do institutions decide what is suspicious, and how consistent are their judgements?
- How useful are suspicious activity reports to authorities, and how is feedback provided?
- Where does responsibility lie between institutions, intelligence units and law enforcement?
- How are customers' rights protected when accounts are restricted or closed on suspicion?
- How do confidentiality and tipping-off rules affect customers and information sharing?
Defensive reporting and the intelligence gap.
Institutions monitor transactions and customer behaviour, investigate alerts and report suspicion to the financial intelligence unit. Fear of penalties can lead to defensive reporting: large volumes of low-value reports that strain authorities' capacity. Feedback from authorities to reporters is often limited, so institutions cannot easily learn which reports are useful.
Institutions are not investigators or prosecutors. They report suspicion; authorities decide whether to investigate. Customers subject to suspicion may have accounts restricted or closed without explanation because of confidentiality rules, which raises questions of fairness and redress. Partnerships between public and private sectors aim to improve intelligence while respecting these boundaries.
How the evidence is built, and where it stops.
- 01
Alert and reporting analysis
Studying monitoring and reporting processes with machine learning and data engineering expertise. Report contents are confidential.
- 02
Public-private partnership review
Examining information-sharing arrangements. Evaluations are limited.
- 03
Legal analysis
Comparing reporting, confidentiality and redress rules. Practice varies.
- 04
Practitioner research
Learning from analysts and investigators. Requires safeguards for sensitive information.
How it is studied, and what the methods cannot say.
- 01Artificial intelligence and machine learningReal-time fraud scoring · Alert prioritisation · Fairness in fraud controlsApplied here
- 02Data engineering, interoperability and stewardshipScreening data quality · Monitoring coverage checks · Retention and minimisationApplied here
- 03Network science and contagionMule network detection · Ownership chain analysis · Cross-institution patternsApplied here
Questions and answers.
What is a suspicious activity report?
Why are false positive rates high?
What is a public-private partnership in AML?
What is tipping off?
Can a customer challenge an account closure?
Does GRA receive suspicious activity reports?
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- EmailGateway GW-GRASend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGlobal Risks AllianceSee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Bring an exposure or capital question to the Alliance.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.