Table of Contents
For financial institutions, AML transaction monitoring systems should detect not just individual financial transactions, but multiple transactions that collectively contribute to a suspicious pattern in the financial system. Low-and-slow laundering is an editorial label, not a formal regulatory typology, for activity that may look ordinary transaction by transaction but becomes concerning when investigators examine cumulative value, frequency, counterparties and changes from a customer’s expected behaviour. For financial crime compliance leaders, the challenge is to make AML transaction monitoring sensitive to patterns that emerge over time, without treating every deviation as evidence of crime.
The regulatory basis for this approach is ongoing, risk-sensitive monitoring, not a universal numerical threshold. AUSTRAC’s ongoing customer due diligence guidance advises businesses to monitor transactions against what they know about a customer. The UK Financial Conduct Authority’s Financial Crime Guide also describes ongoing monitoring in the context of customer risk and expected activity. Requirements differ by jurisdiction and type of regulated entity.
Why fixed transaction thresholds can miss gradual patterns
A fixed-value rule asks whether one transaction crosses a configured amount. That can be useful for a defined risk or legal obligation, but it cannot by itself answer whether a customer’s behaviour is changing or whether many individually modest transactions form a meaningful cumulative pattern.
The FATF Recommendations establish the international AML/CFT standards and identify the risk-based approach as their cornerstone. The UK FCA makes the monitoring point more specific to counterparties in its Financial Crime Guide, sections FCG 3.2.5 and 3.2.5A describe transaction-by-transaction and threshold-driven monitoring as common and say firms should take a holistic view of customer behaviour, aggregate where appropriate at transaction, account, customer, and linked-entity levels, and test and review their monitoring rules. The operational implication is clear: a single amount threshold should not be treated as a complete detection strategy.
Consider three signals that a single-event rule may not capture well:
Cumulative value: total inflows or outflows over a rolling period, even if each transaction is modest.
Frequency and velocity: a sustained change in transaction count or the time between incoming and outgoing payments.
Behavioural change: new counterparties, new geographies, different products, or volumes inconsistent with the customer’s stated purpose and historical use.
These are indicators for compliance teams to review through the transaction monitoring process, not proof of laundering. Effective calibration can help reduce false positives and prioritise cases for further investigation. A seasonal business, a new contract or a legitimate change in circumstances can also alter a customer’s pattern.
Low-and-slow laundering versus structuring
The terms overlap, but they are not interchangeable. Structuring generally refers to breaking transactions into smaller amounts to evade a reporting or recordkeeping requirement. FinCEN’s official materials on structuring explain the U.S. legal and reporting context.
Low-and-slow laundering, as used in this article, is broader: it describes a gradual pattern that only becomes meaningful over a longer period. It may involve structuring, but it may also involve repeated routine-looking transfers, a slow increase in payment activity, or activity spread across connected accounts or channels. It should not be presented as a formal category recognised by FATF or every national regulator.
The distinction matters operationally. A rule designed to identify attempts to avoid a specific reporting threshold will not necessarily detect a long-term deviation from a customer baseline. Monitoring designs should address both risks where they are relevant to the institution’s documented risk assessment.
How temporal analysis reveals suspicious transaction patterns in money laundering
Temporal analysis looks at how transaction behaviour changes over time. Instead of evaluating an isolated payment, an analyst reviewing suspicious transactions looks at a sequence: what changed, when it changed, whether it persisted, and how the activity compares with the customer’s history and relevant peers.
1. Use overlapping rolling windows
Compare short and long periods—for example, 30-day activity against a 90-day or 180-day view. A short window can reveal a recent acceleration; a longer window can expose a gradual build-up that does not stand out in any single month. These are implementation options, not prescribed universal periods.
Track more than total amount. For AML transaction monitoring teams, useful features include transaction count, median and distribution of amounts, unique counterparties, inbound-to-outbound ratios, time between receipt and onward transfer, and the share of activity involving new destinations. Aggregate at account and customer level where reliable linkage data allows it.
2. Compare behaviour with the customer’s baseline
Ongoing customer due diligence should keep the relationship purpose, expected activity and risk assessment current; a customer baseline records observed behaviour that can be compared with that profile. The FCA’s Financial Crime Guide and AUSTRAC’s guidance on monitoring customers provide regulatory context for assessing activity in light of what the firm knows about the customer.
A baseline should not be frozen at onboarding. Continuous monitoring should distinguish a persistent, unexplained shift from an expected change supported by updated information. Reassess whether the profile still fits when transaction purpose, volume, counterparties or geographic exposure change materially.
3. Use peer comparisons carefully
Comparisons with customers of a similar type can add context when an individual’s own history is limited. A new business, for example, may not have enough transaction history to establish a stable personal baseline. Peer groups can help identify unusual activity, but only if segments are meaningful and data quality is adequate.
Do not treat a statistical outlier as inherently suspicious. Segment definitions, seasonal effects, business models and incomplete data can all distort comparisons. Document why the comparison is relevant and what evidence an investigator should review next.
A fictional example: normal payments, changing pattern
Illustrative scenario only; the figures below are fictional and do not describe a real case.
An online seller initially receives around 100 payments each month, generally between $90 and $110. That pattern is consistent with the account’s recorded business purpose. Over the next quarter, the monthly count rises to 400 while average payment size remains similar. The account then begins sending most incoming funds onward to a small set of new overseas counterparties. The customer profile describes a domestic business and does not explain the new cross-border flows.
No individual payment necessarily triggers a fixed-value rule. The combination of rising frequency, rapid onward movement, new counterparties and divergence from the customer’s expected activity may, however, justify review.
A well-designed AML transaction monitoring scenario could alert on a combination of signals across rolling windows and show investigators the transaction history, counterparties and transaction timeline. The alert should explain what changed and why the activity was selected—not label the customer a money launderer. Investigators would then assess supporting information, plausible explanations and any applicable reporting obligations.
Designing AML transaction monitoring controls for cumulative behaviour
Combine rules with contextual features
Rules remain useful for known money laundering typologies and clear control requirements. Extend them with cumulative and relative features: rolling totals, transaction frequency, changes in counterparty diversity, activity across linked bank accounts and differences between current behaviour and the customer’s baseline.
Cross-channel analysis is especially important for AML transaction monitoring systems where the institution has reliable identifiers and lawful access to the relevant data. Separate views of cards, accounts and payment products can obscure a pattern that is visible only when events are linked. Weak identity matching or inconsistent timestamps can create misleading results, so data quality should be assessed before new scenarios are relied upon.
Make alerts understandable to investigators
An actionable alert should state the observation, comparison period and reason for escalation. For example: “Outbound transaction count increased materially against the customer’s six-month history; most recent payments went to counterparties not seen previously.” Include transaction timelines, cumulative totals and links to related activity where available.
This helps reviewers test a specific hypothesis instead of interpreting an opaque score. An AML transaction monitoring process should document why a pattern warranted escalation and what counter-evidence was considered. Record both the decision and its reasoning, including why a plausible explanation was accepted or why escalation was warranted. The control objective is a defensible investigation, not merely more alerts.
Test, tune and govern the scenarios
Before deployment, back-test transaction monitoring rules on historical data and review whether they surface relevant transaction patterns without generating an unmanageable volume of low-value alerts. Where outcomes are known, use them to assess strengths and gaps, while recognising that prior alerts and reports are imperfect labels. Run new scenarios in parallel where feasible before changing live workflows.
Set ownership for scenario changes, document assumptions, monitor alert quality and revisit performance as products, customer behaviour or money laundering risks change. Model validation and governance should reflect the complexity of the approach used. If machine learning is introduced, retain appropriate explainability, validation and human review; an anomaly score is not a substitute for an investigator’s assessment.
Common failures in suspicious activity monitoring
Treating one threshold as the whole control. A fixed amount is only one signal. Add temporal and behavioural context where the risk assessment supports it.
Flagging every change as suspicious. Legitimate growth, seasonality and changes in customer circumstances can alter transaction patterns. Use context and investigation to separate explainable change from unresolved risk.
Fragmented customer and transaction data. Inconsistent identifiers, missing counterparties or disconnected product systems may prevent cumulative analysis. Establish data lineage and matching quality before relying on cross-channel conclusions.
Optimising only for alert volume. Fewer alerts do not necessarily mean better detection. Review case quality, documented rationale, coverage of relevant typologies and the performance of scenarios over time.
Frequently asked questions
What is low-and-slow money laundering?
It means a gradual, cumulative pattern that may look ordinary at the transaction level but warrants closer review when viewed across time, customer behaviour and counterparties. It is an editorial phrase, not a formal universal regulatory classification.
What is the difference between structuring and low-and-slow laundering?
Structuring generally involves breaking transactions up to evade a specific reporting or recordkeeping requirement. Low-and-slow laundering is a broader description of patterns that may emerge over a longer period; some examples may involve structuring, but not all do. See FinCEN’s structuring resources.
How can banks detect laundering below a transaction threshold?
They can supplement applicable threshold-based rules with rolling cumulative measures, transaction frequency, counterparty changes and comparisons with expected customer activity. AUSTRAC’s monitoring guidance provides an official reference for monitoring customer transactions in context. Exact controls depend on the institution’s risks and jurisdiction.
Does an unusual transaction pattern prove money laundering?
No. A pattern is a signal for contextual review, not a conclusion about criminal conduct. Investigators should consider the customer’s profile, supporting information and plausible explanations before deciding whether escalation or reporting is appropriate under applicable rules.
Conclusion
The key detection question is not only whether a transaction exceeds a fixed amount. It is whether activity over time remains consistent with what the institution knows about the customer. Combining rolling windows, cumulative measures, changing baselines and explainable investigation can help AML transaction monitoring teams examine patterns that isolated thresholds may not reveal—while preserving the distinction between an alert and evidence of wrongdoing.
