What is Threshold Tuning?
Threshold tuning is the process of adjusting the values that trigger monitoring alerts so a system catches genuine risk without generating excessive false positives.
Threshold tuning focuses on the numbers inside monitoring rules, such as transaction amounts, counts, and time windows. A threshold set too low floods investigators with false positives, while one set too high lets suspicious activity slip through. Tuning finds the balance between the two.
Threshold tuning is an ongoing part of running transaction monitoring. Customer behavior, products, and criminal methods all change over time, so thresholds that worked last year may not fit today.
How does threshold tuning work?
Threshold tuning starts with back-testing on historical data. Teams run new or revised rules against 6 to 12 months of past transactions, ideally covering a full business cycle to capture seasonal patterns. The results show how many alerts each threshold would generate and how many of those were genuinely suspicious.
Teams then adjust parameters based on the results. Common changes include the following.
- Raising or lowering monetary thresholds
- Applying different thresholds by customer risk level
- Lengthening or shortening time windows to avoid benign patterns like payroll cycles
- Adding filters that exclude low-risk segments or recurring payments
Risk-weighted thresholds are one of the most effective tuning techniques. A firm might flag cash deposits over $2,000 for high-risk customers, over $5,000 for standard customers, and only over $10,000 for low-risk customers.
What metrics guide threshold tuning?
Threshold tuning relies on a small set of performance metrics. These include alert volume per month, the false positive rate, precision, recall measured against past suspicious activity reports, and alert-to-SAR conversion. A false positive rate above 90 percent is often a signal to raise thresholds or tighten criteria.
Many teams also tune toward an alert budget, the number of alerts investigators can review each day at good quality. The aim is to fit that capacity while still catching as much real risk as possible.
How often should thresholds be tuned?
Threshold tuning should happen regularly and be documented. Many firms review rule performance in monthly calibration meetings and run fuller reviews when they launch new products, enter new markets, or respond to regulatory changes. Regulators expect firms to show documented rule logic, back-testing results, the rationale for each change, and evidence of independent review.
