Clearing a Transaction Monitoring Backlog

By Christian Steinmetz and Maren Siegels

Short answer: Banks clear a transaction monitoring alert backlog in three steps: triage open alerts by risk and age, deploy a separate team of level 1 analysts, level 2 investigators and quality control, and fix the cause of the alert flood, usually scenarios and thresholds set too broadly, in a controlled way. In Switzerland, alerts generated by the monitoring system must be assessed within a reasonable period (Art. 20(3) of the FINMA AML Ordinance, GwV-FINMA); in Germany, section 25h(2) of the Banking Act (KWG) requires working monitoring systems. The decision on a suspicious activity report always stays with the institution.

This guide is for heads of compliance, MLROs and financial crime team leads in Switzerland and Germany. It explains how an alert backlog builds up, how to clear it with interim support and how to stop it returning once the project ends.

Why transaction monitoring alert backlogs build up

A backlog builds up when more alerts arrive over several weeks than the team can close. The causes rarely lie with staffing alone, and each cause calls for its own measure:

Cause	Typical signal	Measure
New or changed scenarios, lowered thresholds	Sharp rise in alerts after a rule change	Analyse the hit rate per scenario, recalibrate with a documented rationale, clear the backlog separately
System or data changes	Duplicate alerts, missing client data, mismatched counterparties	Fix data errors first, bundle duplicates per client
New products or client segments	Many unremarkable hits in one segment	Sharpen the segment's behaviour profile, have documented closure reasons approved
Events such as new sanctions packages or media reports	Ad hoc reviews tie up the same analysts	Plan the ad hoc review as a separate work package with its own capacity
Staff changes	Falling closure rate with unchanged inflow	Cover vacancies, onboard with review instructions and quality control
Supervisory finding	A lookback order, i.e. a retrospective review of a past period	Interim team with a pilot, capacity plan and clean evidence trail

The monitoring duty is clear in both countries. In Switzerland, financial intermediaries must ensure effective monitoring of business relationships and transactions; banks and securities firms operate an IT-based system for this purpose (Art. 20(1)–(2) GwV-FINMA). In Germany, credit institutions must operate and update data processing systems that detect unusual business relationships and payments (section 25h(2) KWG), alongside ongoing monitoring under section 10(1) no. 5 of the Money Laundering Act (GwG). A growing backlog is therefore not just a capacity issue but a compliance risk.

Triage by risk and age

Triage determines which alerts are worked first. A sensible order covers the highest risk first and stops old alerts from ageing further.

Map the backlog: analyse open alerts by scenario, client risk, amount, age and status.
Group by client: handle several alerts on the same client as one case. That saves time and gives a better overall picture.
Set priorities: first higher-risk clients, high-risk countries, large amounts and the oldest alerts; then standard cases.
Define closure rules: for recurring, clearly unremarkable patterns, define documented closure reasons and have them approved by the AML function or MLRO.
Manage inflow and outflow: measure weekly whether more alerts are closed than are created.

Worked example (assumption)

An institution has 6,000 open alerts; 1,200 new alerts arrive each month and the team closes 1,000. The backlog therefore grows by 200 a month. To clear it in six months, the team needs 2,200 closures a month. At 20 minutes per level 1 alert, a level 2 share of 10% and two hours per level 2 case, that is about 1,170 hours a month. At 120 productive hours per person, this means roughly ten analysts, plus quality control and a team lead. All values are assumptions; a short pilot provides the real figures.

The team: separate processing, quality control and decisions

An alert team separates first review (level 1), in-depth investigation (level 2), quality control and decision-making. That keeps it traceable who reviewed an alert, who approved it and who decided on a report. Unusual cases escalate to the AML function or MLRO according to a fixed rule. The worked example above shows how to size the team; the number of quality controllers and team leads depends on the share of level 2 cases.

External specialists typically cover level 1, level 2, quality control and tuning analysis. The institution decides on reporting and on continuing relationships. Alpinum Solutions provides analysts, senior analysts, team leads and subject matter experts for this through staff leasing and freelancing, as individuals or as a taskforce. Under staff leasing they work in the institution's systems and follow its professional instructions. More on our AML, KYC and financial crime compliance page.

Recalibrate scenarios and thresholds

Without tuning, the backlog comes back. Clearing it should therefore run alongside a root-cause analysis from day one.

Ownership: in Switzerland, the AML function (Geldwäschereifachstelle) or another independent unit sets the parameters of the monitoring system and arranges the review of its alerts (Art. 25(1)(b) and (c) GwV-FINMA). External analysts deliver analysis but do not decide on parameters themselves.
Data first: many false positives come from incorrect master data, missing counterparties or duplicate bookings. Fix data errors before raising thresholds.
Change with a rationale: every change to scenarios or thresholds needs documented analysis, a test and approval. Simply raising thresholds to cut alert numbers is hard to justify.
Measure the effect: compare hit rates per scenario, the share of alerts escalated and the share of reports before and after.
EU outlook: from 10 July 2027, approving the criteria for detecting suspicious transactions may not be outsourced (Art. 18(3)(f) AMLR).

Documentation and reporting

Every closed alert needs a traceable rationale. In Switzerland, records must allow qualified third parties to form a reliable view of transactions and business relationships, and must be kept for at least ten years after the relationship ends (Art. 7(1) and (3) of the Swiss Anti-Money Laundering Act, GwG).

What every alert record should contain

Triggering scenario and transactions concerned
Information reviewed: client profile, transaction history, documents, queries
Assessment: why the transaction is plausible or not
Outcome, date, analyst and, where applicable, quality control

Where there is suspicion, both countries require reporting without delay. In Switzerland, to the Money Laundering Reporting Office (MROS) under Art. 9 GwG; the most senior executive body decides on filing or delegates this, for example to the AML function (Art. 25a GwV-FINMA). In Germany, to the Financial Intelligence Unit (FIU), regardless of the amount involved (section 43(1) GwG). A backlog delays these reports, which is why cases with grounds for suspicion belong at the top of the triage.

Limits and risks

Responsibility for monitoring and reporting stays with the institution. External analysts prepare decisions but do not take them.
Bulk closures without approved rules and a rationale create a new audit risk instead of a cleared backlog.
A clean-up project without tuning and root-cause analysis only postpones the problem.
Alpinum is not a law firm and does not provide legal advice. Interpreting reporting and due diligence obligations in individual cases remains with the institution and its advisers.

Frequently asked questions about transaction monitoring backlogs

What is a false positive in transaction monitoring?

A false positive is an alert raised by the monitoring system although the transaction turns out to be unremarkable on review. Typical causes are broad thresholds, missing client data or scenarios that do not reflect the normal behaviour of a segment. A false positive also needs a documented rationale before it is closed.

Who decides on a suspicious activity report?

In Switzerland, the most senior executive body decides on reports to MROS; it can delegate this to members without direct business responsibility, to the AML function or to a largely independent unit (Art. 25a GwV-FINMA). In Germany, the money laundering reporting officer is not bound by instructions when filing suspicious activity reports (section 7 GwG). External analysts prepare the case.

How quickly must alerts be processed?

The GwV-FINMA requires alerts to be assessed within a reasonable period (Art. 20(3)) and additional checks to be started without delay (Art. 17). The ordinance sets no fixed number of days. Internal processing deadlines per risk level are therefore advisable. Where suspicion arises, both countries require reporting without delay.

Can external analysts close alerts?

External analysts can process and document alerts under the institution's rules and review procedures. The institution decides which alerts they may close themselves and which need sign-off. In Germany, transferring internal safeguards such as monitoring systems to third parties must be notified in advance (section 6(7) GwG). Whether a staff leasing assignment is outsourcing is for the institution to assess and document in the specific case (BaFin guidance, section 3.10).

How big a team does clearing an alert backlog need?

That depends on the backlog, inflow, handling time and target window. In the worked example above, 6,000 open alerts, 1,200 new alerts a month and a six-month window require about ten analysts plus quality control and a team lead. Only a pilot shows the real handling times. Our guide to planning KYC remediation explains the method.

Next step

Tell us about your backlog, inflow and target date. Selected profiles are usually available within 48 hours; the start date is agreed jointly between the company and Alpinum.

Last updated: 31 October 2026.

Transaction monitoring alert backlogs: clearing and controlling them