Take one bank and one spring day (illustrative). A landscaping firm's seasonal cash deposits trip a cash rule, and an analyst closes the alert in ten minutes. That afternoon 40 transfers of $480 from different senders reach one account and leave for abroad, under every line. No alert fires. A law enforcement request finds them three months later. A transaction monitoring program that lowers its lines to catch the second case raises more alerts like the first.
What is a false positive, and what is a false negative alarm?
In anti money laundering (AML) monitoring, each alert predicts suspicious activity, and review decides whether it was right. A false positive alarm is an alert on activity that proves legitimate. A false negative alarm is the alert that never fired on activity that was suspicious.
Among its questions for firms, the FCA's handbook notes that "Many alerts will be false alarms, particularly when generated by automated systems" (FCA FCG 3.2.5, 29 November 2024). In the bank above, the landscaping alert was a false positive and the 40 transfers were a false negative.
Table 1. The four outcomes of a monitoring decision (two by two).
| Outcome | Activity | Alert | What it costs | Who sees it |
|---|---|---|---|---|
| True positive | Suspicious | Yes | Review time, then a SAR when the facts support one | The analyst, then the MLRO or BSA officer |
| False positive | Legitimate | Yes | Analyst time; a delay if the payment is held | The analyst, in the queue |
| False negative | Suspicious | No | A report never filed; exposure in an exam or enforcement action | Nobody, until an examiner, an auditor or law enforcement finds it |
| True negative | Legitimate | No | Nothing | Nobody |
Do the terms mean the same in fraud, sanctions screening and KYC?
The logic holds. The meaning of each error moves with the check. In sanctions and PEP screening, a false positive is a name match on the wrong person, such as a customer who shares a name with a listed individual. In KYC it is an identity flagged in error, and in fraud a good customer's payment declined. Cybersecurity uses the same pair. There a false negative is an intrusion the security tool did not flag.
Why does a monitoring system raise alerts that are nothing, and miss what is real?
The cash rule saw the landscaping firm's amount. It did not know the business, and a fixed threshold without customer context flags a seasonal trade every spring. Data gaps have the same effect, and so does a rule written for one segment and run on all.
The 40 transfers slipped through because no rule described many small senders paying one account. A typology such as transaction laundering may have no rule at all. And a channel never fed to the system, such as a money services business (MSB) agent network, raises nothing.
Why are false negative alarms more dangerous than false positives?
FinCEN's record $1.3 billion penalty against TD Bank, on 10 October 2024, found that the bank "allowed trillions of dollars in transactions annually to go unmonitored" and willfully failed to file SARs on suspicious transactions worth about $1.5 billion (FinCEN release).
A false positive costs analyst time in a queue everyone can see. A false negative leaves a suspicious activity report unfiled and surfaces in an exam or an enforcement action. The 2021 interagency statement of the Federal Reserve, the FDIC and the OCC allows for that trade: a bank "may choose to accept a reduction in efficiency (such as by producing more alerts) in exchange for greater coverage" (interagency statement, 9 April 2021, pp. 4 and 5).
How do teams measure false positive and false negative rates?
Picture 1,000 alerts in a month, 960 of them closed as legitimate (illustrative). Divided by alerts, the false positive rate is 96 percent; divided by the month's 500,000 legitimate transactions, it is about 0.2 percent.
Ufuk Gürdaş, who reviewed this entry, on reading a rate: "A false positive rate near 100 percent and one near zero can describe the same month: analysts divide cleared alerts by all alerts, statisticians divide them by every legitimate transaction, so ask which denominator a figure uses before you compare it with your own."
A miss raises nothing to count. So among the metrics it suggests, the Wolfsberg Group lists an "Assessment of false negatives" based on SARs and STRs "which have resulted from other sources", such as internal referrals from staff (Wolfsberg statement, 2024, p. 4). If 3 of a quarter's 12 SARs began outside an alert (illustrative), those are 3 known misses to trace.
complead, formerly Sanction Scanner, backtests a changed rule in its transaction monitoring software on 30, 60 or 90 days of history before it goes live, with alert volume, clearance rate and true positives on screen. An analyst still decides each alert.
What are below the line and above the line testing?
Below the line testing lowers thresholds to "identify the point at which the system may generate false negatives"; above the line testing raises them to see where false positives grow (Wolfsberg glossary, p. 9). Wolfsberg adds that small steps such as "10% below the current value" are "unlikely to produce meaningful results" (p. 6).
What do examiners and supervisors expect?
In the United States, the same 2021 statement says that for automated monitoring, prudent risk management involves "periodically reviewing and testing the filtering criteria and thresholds to ensure that they are still effective", as well as independent validation of the system's methodology and effectiveness (pp. 3 to 4).
In the UK, one of the FCA's good practice examples is a firm that can justify retiring an automated system, weighing outcomes such as how useful its alerts were and "the proportion of 'false positives'" (FCG 3.2.5A). Its poor practice examples include a poorly calibrated system whose rules the firm struggles to explain.
How do you deal with false negative alarms?
- Trace each SAR that began outside an alert to the rule that should have caught it. That list is the false negative count Wolfsberg describes.
- Test below every threshold you raise. Below the line testing shows where the system starts to miss.
- Feed every product and channel to monitoring, because an MSB agent network the system never reads raises no alert.
- Write down each tuning reason. The FCA asks firms whether they understand the rationale behind each threshold and rule (FCG 3.2.5).
Wolfsberg also notes that machine learning models "may be used as booster models" beside a rules based system (p. 6).
For this month's figures, write the denominator next to the false positive rate, list the SARs that began outside an alert, and run one below the line test on the last threshold you raised.
Related terms
- Transaction monitoring rules. The scenarios that raise alerts.
- Transaction laundering. Illegal sales hidden behind an approved merchant account.
- Suspicious activity report. The report a confirmed alert can lead to.
- Ongoing monitoring. Keeping customer risk current after onboarding.
- Know your transaction (KYT). Reading each payment against the customer's expected activity.
