Bank of America built its own monitoring system, Event Processor, in 2010. For most of the years FinCEN examined, a group of related alerts generally reached an investigator only once its combined score hit 20 points. That threshold was "initially set by stakeholder judgment" and, in FinCEN's words, "not adequately supported by documentation or empirical evidence". It stayed until December 2023, when the bank cut it to 10 or 12 points. Then came the lookback. In 2024 it found the bank had failed to identify and file nearly 8,900 suspicious activity reports on nearly $4 billion of activity. FinCEN's consent order of 13 October 2026 set a $1.2 billion penalty.
For a buyer, the lesson is narrow. Ask every vendor how a threshold is proven on your own data before it goes live, and read the ten tools below against that question. complead publishes this comparison and lists itself first.
What does transaction monitoring software have to do for a bank and for a fintech?
Transaction monitoring software reviews customer activity over time, raises an alert when a rule or a model finds a pattern worth a look, and carries that alert to a decision and, where needed, a report. The stages are the same for every buyer. What each stage must deliver is not.
Table 1. What monitoring has to do, stage by stage (November 2026)
| Stage | Mid sized bank | Fintech or EMI | Who decides |
|---|---|---|---|
| Data in | Core banking, cards and wires, often in nightly batches, with years of history | Payments through an API, in real time, with a short history | The firm maps the fields; the vendor says what it needs |
| Detection | Scenarios an examiner already knows, plus models it can explain | Rules the team writes itself, changed in days | The compliance owner of each scenario |
| Testing before go live | Evidence that each threshold catches what it should, kept for the file | A sandbox or shadow run before a rule touches live traffic | The model or rule owner, signed off by the MLRO |
| Alert triage | Queues by typology and analyst skill | One queue, often with fraud alerts in it | The analyst; any AI scoring is advice |
| Case and SAR | A case file and report drafts in the regulator's format | The same, in fewer hands | The reporting officer decides what is filed |
| Change control | Versions, approvals and rollback for every rule | The same, at a faster pace | The person who signs the change, on the record |
Picture a regional lender with 400,000 customers, an illustrative case: it keeps its core system and must show its examiner why each threshold sits where it does. Now picture an EMI with 60 staff that ships a new product every quarter and wants a new rule the same week. The bank needs the evidence column filled. The EMI needs the speed.
How do you choose transaction monitoring software?
Have each vendor show these nine points on a sample of your own data.
- Data in. Which fields the tool needs, how much history it loads, and whether it scores payments in real time or in batches. A field the tool cannot read is a typology it cannot see.
- Detection. Rules, models or both, and whether customers are grouped into peer segments. Ask what produces the alert score and whether a person can read it.
- Testing before go live. A backtest on your history, a shadow run on live traffic, or a sandbox. Bank of America's threshold ran for years without that evidence. Testing is also where false positives and false negatives get counted, before they cost analyst hours or missed reports.
- Thresholds by customer risk. Whether a higher risk customer meets a lower threshold without a separate copy of every monitoring rule. Separate copies drift apart as rules change.
- Explanation an examiner can follow. Every alert should show which rule fired and which values crossed it. An examiner in the US, or an auditor in the UK and EU, asks for exactly that.
- Fit with the rest of the stack. Customer risk scores from KYC and KYB, results from sanctions screening software and core systems should reach the monitoring engine without manual exports.
- Case and report. The alert should open a case with the evidence attached and a SAR or STR draft in the regulator's format. The decision to file stays with your reporting officer; ask whether the tool then submits the report itself.
- Deployment. Public cloud, private cloud or on premise, and where the data sits. Banks with data residency rules settle this first, and US bank procurement usually asks for a SOC 2 report too.
- Cost of ownership. License, implementation, tuning, staff time and the months of running two systems during a switch. Get every line priced, not only the license.
How do you switch tools without a monitoring gap?
Picture an EMI moving off a tool it has used for five years, an illustrative case. It starts from its risk assessment. Customer types, products, countries and channels decide which scenarios it needs, and the scenario list decides what the new tool must be shown to catch. Last quarter's transactions go into the new tool, and its alerts are compared with the old tool's, case by case. Then both run on live traffic for a period, so nothing goes unmonitored on cutover day. Analysts learn the new case screens before the switch.
The 10 best transaction monitoring software tools compared
After complead, the nine rivals follow in alphabetical order. Each appears in three or more of eleven "best transaction monitoring software" lists read for this page, most of them written by a vendor. They take the place of the seven names on an older list of this kind (SEON, Unit21, SAS, Actico, iComply, Dow Jones and Sanction Scanner itself); Unit21 and SAS stay. Verafin, ThetaRay, Sardine, SymphonyAI, Quantexa and Lucinity also appear in those lists and are not covered here.
Every rival cell comes from that vendor's transaction monitoring page as it read on 10 November 2026, quoted or closely summarized. Where the page is silent, the cell says "not stated". Prices, review scores and the vendors' own percentages are left out, and the order is not a ranking.
Table 2. 10 transaction monitoring tools compared (vendor pages read 10 November 2026; Hawk AI in a browser)
| Vendor | Detection (as stated) | Testing before go live (as stated) | Case and SAR (as stated) | Fraud on the same platform (as stated) | Deployment (as stated) | Best for |
|---|---|---|---|---|---|---|
| complead | No code rules (conditions, thresholds, score effects), no limit on rule count; one risk score per customer | Backtests on 30, 60 or 90 days of history, reporting alert volume, clearance rate and true positives; versions kept, one click rollback | Report drafted from the case and checked against the regulator's format; SAR and other regulatory filings submitted directly, including to FinCEN; alerts routed by load and skill | Yes, fraud prevention on the same engine | Runs on Azure; on premise option | A bank or EMI that wants monitoring, screening and fraud under one score, tested on its own history |
| ComplyAdvantage | One AI native engine; scenarios written in natural language; simple, aggregate, behavioral and risk pattern rules | Sandbox shows the effect on alert volumes before go live | Up to eight review stages; SAR, CTR, FINTRAC STR and EFT reports | Yes, laundering, fraud and other risks in one engine | Not stated; SOC 2 Type II and ISO 27001 infrastructure | A fintech that wants rules in plain language and agents on routine alerts |
| Feedzai | More than 20 ready scenarios plus custom rules; a model ranks alerts | Scenarios and thresholds adjusted to risk tolerance; backtest not stated | Case Manager; SAR Manager with templates for eight countries | Yes, the RiskOps platform covers fraud and financial crime | Cloud based data science environment and APIs | A bank already using Feedzai for fraud |
| Flagright | Rules from plain English or 100+ ready scenarios; machine learning anomaly detection beside them | Shadow mode on live transactions; simulations on history | Case management; SAR filing to FinCEN and goAML countries (vendor statement) | Yes, AML and fraud rules | Not stated on the page read | A fintech that changes rules weekly |
| Hawk AI | Rules fused with AI; typologies such as structuring, layering and smurfing | Self serve rule configuration with production sandbox testing | Automated audit trails; integrated SAR and CTR filing | Yes, FRAML and fraud products in one platform | SaaS or private cloud | A bank or payments firm that wants fraud and AML alerts together |
| Napier AI | "Over 100+ inbuilt AML typologies"; rules and AI give separate scores | Sandbox on real production behavior or your own datasets | Guided case management with a full audit trail | Not stated on the page read | SaaS; one client runs it on Azure | A bank or payments firm that wants a typology library and a sandbox |
| NICE Actimize | Rules library plus machine learning: customer segmentation, anomaly detection, predictive alert scoring, graph analysis | Machine learning to assess model performance; rule testing not stated | Investigation layer; SAR not stated on the page read | Separate fraud management line | Not stated on the page read | A large bank with its own data science team |
| Oracle FCCM | Configurable rules, behavioral analytics, graph intelligence, adaptive scoring | Threshold tuning, scenario performance checks, automated calibration; versions, approvals, rollback | Routing by risk, skill, workload and urgency; AI drafts SAR narratives for human review | Separate fraud product in the same suite | SaaS described | A large bank that wants governed change control |
| SAS | Ready scenarios, network analytics, AI and machine learning; alerts summarized per customer or counterparty | Not stated on the page read; scenarios authored by drag and drop, AI decisions explained to auditors and examiners | Investigation management and regulatory reporting on one platform | Separate fraud products | Cloud native | A bank whose model governance team reviews every model |
| Unit21 | Detection models plus configurable and graph based rules; AI rule recommendations | Backtesting and shadow mode on historical or live data | Case management, regulatory filings, a 314(a) agent, 40+ dashboards | Yes, fraud and AML in one platform | Not stated on the page read | A fintech or sponsor bank |
Sources: each row links the vendor page it comes from, all opened on 10 November 2026, Hawk AI's in a browser (its fraud and deployment cells from hawk.ai's home page) and the rest by script; Oracle's SaaS cell comes from the FAQ on that page. complead's row uses its own product pages, read the same day. Text in quotation marks is the vendor's own.
Transaction monitoring software vendors, one by one
complead
Rules need no code. A team builds them from conditions, thresholds and score effects, with no cap on how many it runs. Before a rule goes live, it runs as a backtest against 30, 60 or 90 days of the firm's real transactions, and the result shows alert volume, clearance rate and true positives. One click rolls a rule back to an earlier version, and the log records who made each change, when and why. Alerts show which rule fired and which signals matched; monitoring, screening and fraud feed one risk score per customer. Since the October 2026 release, a rule can be held to one alert a day for the same customer. Reports are drafted from the case and checked against the regulator's format, and complead submits SAR and other regulatory filings directly, including to FinCEN. Identity checks run through the firm's IDV provider, and the verified identity feeds the risk model. Moldcell, whose Moldovan telecom network serves 1.5 million users, had processed about 100,000 transactions through complead when its case study came out in July 2026. About 10,000 went to review. Demo question: backtest one of your current thresholds and show what it missed.
ComplyAdvantage
A fintech that wants its analysts to write their own rules is the buyer this page speaks to. ComplyAdvantage runs transaction monitoring on Mesh, one AI native engine for money laundering, fraud and other risks. Rules are written in natural language. A sandbox shows a new rule's effect on alert volumes before it goes live, and cases then move through up to eight review stages, with SAR, CTR, FINTRAC STR and EFT reports listed on the page. The infrastructure carries SOC 2 Type II and ISO 27001. Demo question: which alerts do its agents close, and who signs off?
Feedzai
Feedzai sells AML monitoring on the same RiskOps platform as its fraud products. The page lists more than 20 ready scenarios grouped by typology, custom rules on top, and a machine learning model that ranks alerts by learning from past alert labels, investigations and SARs. Scenarios and thresholds are adjusted to the firm's risk tolerance. Its SAR Manager has ready templates for the US, Brazil, the UK, France, Germany, Lithuania, Malaysia and South Africa. No backtest is described. Best fit: a bank that already runs Feedzai for card or payment fraud. Ask to see one scenario's alerts over a year, before and after a threshold change.
Flagright
Flagright lets an analyst describe a pattern in plain English and turns it into rule logic, or start from more than 100 ready scenarios tagged by typology. Machine learning looks for anomalies beside the rules. In shadow mode a new rule runs on live transactions with its alerts kept out of analysts' queues, and simulations test it against history. Thresholds follow each customer's live risk score, so a high risk customer meets a lower one without a copy of the rule. The vendor says it files SARs to FinCEN and goAML countries. Deployment is not stated. Weekly rule changes at a fintech are the case it is built for. Ask for one rule's shadow results.
Hawk AI
Founded in Munich in 2018, Hawk AI sells monitoring, screening and fraud detection as modules of one platform. Its fraud side blocks fraudulent activity in real time across payment rails, and FRAML in its menu serves teams that want fraud and AML alerts together. The monitoring page fuses rules with AI and covers typologies such as structuring, layering and smurfing. Customers configure rules themselves and test them in a production sandbox. Audit trails are automatic. SAR and CTR filing is built in. Deployment is SaaS or private cloud, and the platform can sit on top of existing systems or take over from them, which suits a bank or payments firm keeping its core. Ask what the AI changes in an alert and what the analyst sees.
Napier AI
"Over 100+ inbuilt AML typologies" is how Napier AI describes the library its Transaction Monitoring starts from, next to a rules builder that needs no code. Rules and AI each give a separate score, so analysts can compare two views of the same customer. Changes are tested in a sandbox on real production behavior or the firm's own datasets before anything goes live, with a full audit trail and version history. Cases run through guided workflows. The tool is sold as SaaS, and one public client runs it on Azure. It suits a bank or payments firm that wants a library to start from. Ask how a sandbox result becomes a live rule, and who approves it.
NICE Actimize
NICE Actimize's Suspicious Activity Monitoring, SAM, is built around the entity rather than the single transaction. It pairs a rules library the vendor calls proven in the industry with machine learning: unsupervised segmentation of customers, anomaly detection, predictive scoring of each alert and graph analysis of relationships. Teams can also build their own machine learning analytics. An investigation layer is named, while deployment options and any backtest go unstated on the page, and fraud management is a separate NICE Actimize line. A large bank with its own data science team gets the most from it, and should ask how a segmentation change is validated before it moves an alert.
Oracle FCCM
Oracle Financial Crime and Compliance Management (FCCM) monitors traditional, real time, cross border, P2P and wallet payments with configurable rules, behavioral analytics, graph intelligence and adaptive scoring. Teams tune thresholds and check scenario performance under versioning, approvals and rollback. Calibration can be automated. Work is routed by risk, skill, workload and urgency. Its Investigation Hub drafts SAR narratives for a person to review and decide. The page describes a SaaS approach. Fraud sits in a separate product of the same suite. A large bank that wants every rule change governed fits best; ask to see the approval trail behind one calibrated threshold.
SAS
SAS Anti-Money Laundering puts monitoring, customer due diligence, entity resolution, investigation and reporting on one platform, with AI and machine learning throughout. Ready scenarios sit beside network analytics. Alerts are summarized per customer or counterparty rather than reviewed transaction by transaction, and scenarios are authored in a drag and drop interface. The architecture is cloud native. The page says AI and machine learning decisions are visible, so teams can explain them to auditors, model governance staff and examiners; one of its customer stories covers 120 Nordic banks. A bank whose model governance team reviews every model fits. Ask for the explanation an examiner would see for one alert.
Unit21
Unit21 pairs detection models with configurable rules and graph based rules that link accounts through shared information, and an AI recommends new rules from emerging patterns. Transactions are ingested in real time. Rules and models are backtested on history or run in shadow mode on live data before deployment. An AI agent checks FinCEN 314(a) matches. Case management and regulatory filings sit on the same platform, more than 40 dashboards track alerts and cases, and fraud shares the platform with AML. Fintechs and sponsor banks are among the buyers its menu names. Ask for a backtest report built from one of your own rules and a month of your own transactions.
Which transaction monitoring software fits your firm?
Which software does a mid sized bank use for AML monitoring?
Picture a regional bank keeping a core system it has run for 15 years, an illustrative case. It needs scenarios its examiner recognizes, evidence for every threshold and change control. NICE Actimize, Oracle FCCM and SAS each list a library of ready rules or scenarios; Napier AI and Hawk AI pair a library with a sandbox. complead for banking backtests each threshold on the bank's own history before it goes live.
What if the bank needs on premise or private cloud?
Some banks cannot send transaction data to a shared cloud at all. Hawk AI offers private cloud beside SaaS. complead runs on Azure with an on premise option; its certifications include SOC 2 as well as ISO 27001 and ISO 9001, GDPR is built in, and data can stay in the EU. The other pages read say SaaS, cloud or nothing at all, so ask each vendor in writing.
What is the best AML transaction monitoring software for fintechs in 2026?
Picture an EMI launching a card product. It needs new rules the same week, tested before they touch a real customer. Unit21 and Flagright do that in shadow mode, ComplyAdvantage in a sandbox, and complead for fintechs with no code rules and a backtest before they run.
Which platforms unify AML monitoring and fraud alerts?
Picture a payments firm whose fraud detection and AML teams chase the same mule accounts in two queues. Feedzai, Hawk AI, ComplyAdvantage and Unit21 run both on one platform.
Who offers transaction monitoring for digital assets?
Picture an exchange that monitors card deposits, bank transfers and wallet flows. Flagright, Hawk AI and Unit21 name crypto among the sectors they serve; Oracle lists wallet payments. On complead, monitoring and screening for crypto firms share one engine.
Which other industries use transaction monitoring software?
Payment firms, online gambling operators, money remitters, marketplaces, insurers, real estate firms and luxury goods dealers monitor too. Most need fewer scenarios than a bank and faster changes than one, which is why the fintech questions above usually apply to them as well.
When is complead not the right fit?
A buyer that needs a published price before the first call should look elsewhere. complead quotes each firm on its modules and volume and keeps no public price list, so the number comes after a conversation.
What changed in transaction monitoring in 2026?
- 10 April. A FinCEN proposal on AML/CFT programs, published in the Federal Register, named machine learning, generative AI and APIs as approaches institutions may use. The comment period ended on 9 June, and by 10 November 2026 no final rule was out.
- 17 April. The OCC, the Federal Reserve and the FDIC issued revised model risk guidance and rescinded the 2021 statement on models in BSA/AML systems. The new guidance is not enforceable, is aimed mainly at banks over $30 billion in assets, and leaves generative and agentic AI out of scope.
- 1 October. AMLA's final draft standards went to the European Commission, ahead of the EU AML Regulation applying from 10 July 2027.
- 13 October. FinCEN fined Bank of America $1.2 billion, and the OCC $750 million, over the monitoring failures above.
The 2021 statement's line on testing monitoring thresholds periodically went with it in April; in October, the Bank of America order showed what an untested threshold can cost.
Back to that 20 point line. A backtest of the alert groups that scored just under it would have shown activity piling up below the threshold years before the lookback did. This quarter, run the same test on each tool you shortlist. Take one live threshold, lower it in a backtest or a shadow run, and count what appears underneath. Then ask who changed the rule, and see whether the tool can tell you.
