A common mistake is focusing only on large transactions. Laundering often uses smaller transfers, repeated deposits, inconsistent customer information, offshore accounts, or business patterns that do not fit the stated profile. Teams also fail when they do not connect transaction review with customer risk scoring, staff escalation, and documented review processes.
What teams miss when they look only for big transfers
Money laundering in transaction flows is rarely just a “large transfer” problem. The more common pattern is structuring, repetition, velocity, and inconsistency: many smaller movements, deposits that stay just under thresholds, circular flows, offshore routing, or payments that do not fit the customer’s stated activity. Detection works best when teams review patterns across time, counterparties, and context, not a single transaction in isolation.
A second mistake is treating transaction monitoring as a standalone control. If transaction review is not connected to customer risk scoring, escalation rules, and documented analyst review, suspicious activity is easier to miss and harder to defend later. For high-volume environments, the operational issue is not only what is flagged, but whether the review process produces consistent, explainable outcomes.
Good practice is to think in terms of behaviour and profile mismatch. A transaction can be low value and still be high concern if it repeats, fragments, crosses inconsistent jurisdictions, or aligns with a customer profile that makes little commercial sense. That is why monitoring rules that only chase amount thresholds tend to create blind spots.
Why pattern context matters more than amount alone
Laundering typologies usually exploit the gap between what a payment looks like individually and what it means in aggregate. Repeated deposits, pass-through activity, rapid movement between accounts, unusual business counterparties, or a mismatch between expected turnover and actual flow can all indicate layering or placement activity even when no single transfer appears dramatic.
This is also where false confidence creeps in. Teams may assume that “normal-looking” payments are safe because they are small, domestic, or routine. In practice, the signal often emerges only when teams compare activity against customer type, stated source of funds, geographic exposure, and historical behaviour. That is why narrative context is not optional in AML review, it is part of the control.
Reference points such as FATF Recommendations reinforce this approach through customer due diligence, beneficial ownership, and suspicious activity reporting expectations. For teams that need a cybersecurity-style control analogue, the same discipline of visibility and review is echoed in NIST Cybersecurity Framework 2.0, where identify, detect, and respond must work together rather than as isolated checks.
Practitioner judgment that improves detection quality
What to prioritise: Prioritise scenarios where transaction behaviour disagrees with the customer profile, the merchant model, or the expected source and destination of funds. That is usually a stronger signal than raw value alone, especially where activity is repeated, distributed, or cross-border.
What to verify: Verify that escalation thresholds, analyst notes, and case outcomes are documented in a way a reviewer can reconstruct later. If a team cannot explain why a flow was cleared, it has not really validated the control, it has only observed the transaction.
Common mistake: Treating alerts as the end of the process. The more serious failure is when teams do not connect alert handling to customer risk scoring and ongoing refresh of the customer file, because that is where pattern-based laundering often becomes visible.
Practitioner takeaway: The best AML teams do not ask whether a payment is large enough to matter, they ask whether the flow makes sense across time, counterparties, geography, and customer context.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.AE — Anomalies and Events | Transaction anomalies must be detected across patterns, not isolated payments. |
| RS.AN — Analysis | Suspicious flows need documented case analysis to support escalation decisions. | |
| GV.OC — Organizational Context | AML monitoring depends on understanding the customer and business context behind activity. | |
| Recommendation — Correlate anomalous transaction patterns with customer context before clearing alerts. Document analyst reasoning for repeated, mismatched, or circular transaction flows. Align monitoring rules to customer profile and expected transaction behaviour. | ||
| CIS Controls v8 | 8 — Audit Log Management | Reviewable transaction trails are essential to reconstruct suspicious flow decisions. |
| 6 — Access Control Management | Escalation and review processes depend on bounded reviewer access and clear ownership. | |
| Recommendation — Retain transaction and case logs so investigators can trace review decisions end to end. Restrict case-editing and approval rights to approved AML reviewers. | ||
Related resources from NHI Mgmt Group
- What do compliance teams get wrong about anti-money laundering and identity checks in high-volume trading environments?
- What do teams get wrong about monitoring for money laundering in day to day operations?
- What do teams get wrong about private_key_jwt in MCP flows?
- What do teams get wrong about client identity in MCP flows?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
