What is a Monitoring Scenario?
A monitoring scenario is a defined pattern of suspicious activity that a transaction monitoring system is designed to detect.
A monitoring scenario describes the risk a firm wants to catch, such as structuring or the rapid movement of funds. It starts as a plain-language hypothesis about how criminals might misuse an account, and it is then turned into technical rules or models that generate alerts when the pattern appears.
Monitoring scenarios connect a firm's risk assessment to its daily operations. The risks identified for specific customers, products, and geographies become the scenarios that transaction monitoring is built around, so the system watches for the threats most relevant to that business.
What is the difference between a monitoring scenario and a rule?
A monitoring scenario is the risk being targeted, while a rule is the technical logic used to detect it. For example, the scenario might be structuring through cumulative cash deposits. The matching rule would flag customers whose individual cash deposits are each under $10,000 but whose total exceeds $9,000 within 24 hours.
One monitoring scenario can be covered by several rules or models. A money mule scenario, for instance, might combine a velocity rule, a rule for many-to-one inbound payments, and network analysis of shared devices.
What are common monitoring scenarios?
Most AML programs cover a core set of monitoring scenarios, including the following.
- Structured cash deposits just below reporting thresholds
- Rapid movement of funds in and out of an account
- Wires to high-risk jurisdictions or corridors
- High-value payments to first-time beneficiaries
- Many unrelated senders paying into one account, followed by quick dispersion
- Fan-out payments to newly formed entities after a large inflow
How are monitoring scenarios developed?
Monitoring scenarios are developed by translating known risks into testable logic. Teams first write the pattern in plain language, then map it to the data fields available, set thresholds, and test it against historical transactions before going live.
Each monitoring scenario should be documented with a name, a description of its logic and thresholds, the rationale for why it exists, and a named owner. Many firms map at least one rule to each money laundering typology relevant to their market and review the results through regular tuning, so scenario coverage keeps pace with how risks change.
