AML False Positive Rate

What is the AML false positive rate?

The AML false positive rate is the share of alerts that a bank's monitoring or screening system raises and that reviewers close as not suspicious. It is a measure of how much analyst effort goes into alerts that lead nowhere. A high rate means most of the queue is noise. The number says nothing on its own about whether the system finds real activity, so it needs to be read next to other measures.

This entry covers the definition and the measurement. For how to reduce the volume and where an AI employee takes on triage work, see AML alert triage with AI.

How is the false positive rate calculated?

The usual formula is alerts closed as not suspicious divided by total alerts reviewed, over a set period. If analysts reviewed 1,000 alerts in a quarter and closed 950 with no further action, the rate is 95 percent. The figure is for illustration only and is not a benchmark.

The result changes with how you define the pieces:

• Alert level or case level. Some banks group several alerts on one customer into a single case. Counting alerts gives a higher rate than counting cases, so pick one unit and keep it fixed.
• Transaction monitoring or sanctions screening. Transaction monitoring alerts are scenario-based and screening alerts are name matches. They have different volumes and different causes, so report them separately.
• Scenario. A 12-month rate can hide a single rule that fires thousands of times, so break it out by scenario.

We could not find a primary-source industry-wide rate to cite, and published figures vary by source and method. The number that matters is your own, calculated the same way each period.

Why are false positive rates so high?

Rules fire when a transaction crosses a fixed condition, such as cash above a threshold or a sudden change in volume. They apply to customer segments and cannot see that one customer's business is seasonal or that two accounts belong to the same legitimate group. Thresholds also tend to start conservative, because a missed case carries regulatory risk while an extra alert only costs analyst time. Name screening adds its own noise, because common names produce partial matches against watchlist entries.

Can a very low rate be a warning sign?

Yes. A rate that drops sharply after a threshold change may mean the system now alerts on less, including some activity it should catch. The same is true if a rule never fires at all. A low rate can come from good targeting, or it can come from under-alerting, and the rate alone cannot tell you which. That is why tuning needs testing and not only a falling number.

How do examiners view tuning?

Banks must maintain an anti-money laundering program with a system of internal controls and independent testing under 31 CFR 1020.210, including risk-based procedures for ongoing monitoring to identify and report suspicious transactions. The FFIEC BSA/AML Examination Manual discusses monitoring systems in its suspicious activity reporting section, and its text has said management should periodically evaluate the filtering criteria and thresholds it uses.

In practice, a defensible change is documented, tested and approved. Many banks run above-the-line and below-the-line testing. Above-the-line testing raises a threshold to see where alerts that analysts found useful would be lost. Below-the-line testing samples activity just under the current threshold to see whether reportable activity is being missed. These are industry practices and not regulatory terms, so confirm your own method with your model risk team and examiners.

Model governance matters here too. The 2021 interagency statement on model risk management for BSA/AML systems has been replaced. The Federal Reserve, OCC and FDIC issued revised model risk management guidance on April 17, 2026 (SR 26-2), which supersedes the 2021 statement. The revised guidance defines a model as a method that applies statistical, economic or financial theories, and excludes deterministic rule-based processes. Whether a given monitoring system is a model under your bank's governance is for your bank to decide and document. See model risk management.

What should you measure alongside it?

The false positive rate describes cost. Two other measures describe yield within a BSA/AML program.

• Alert-to-case rate. The share of alerts that a reviewer escalates for investigation.
• SAR conversion rate. The share of alerts or cases that end in a suspicious activity report.

Read together, they separate a noisy system from a blind one. A high false positive rate with a steady SAR conversion rate suggests the system is catching what it should and wasting effort on the rest. A falling false positive rate with a falling SAR conversion rate points to missed activity.

Where do AI employees fit?

The work behind each alert is gathering evidence and writing the rationale. An AI employee can pull the transaction history and the KYC file, compare activity with the customer's expected behavior, and draft a closure or an escalation with the evidence cited. People keep the decisions: rule and threshold changes, model classification, escalated investigations and whether to file a SAR. Reviewers can sample the AI employee's closures against their own to check quality. For the end-to-end picture, see how AML automation works, and for tooling options, the best AML software roundup.

Frequently asked questions

What is a good AML false positive rate?

There is no regulatory target and no single benchmark. A good rate is one you can explain: it falls from documented, tested tuning and holds steady against your SAR conversion rate.

Is a lower false positive rate always better?

No. A lower rate can mean better targeting or it can mean the system is missing activity. Check it against testing below the threshold and against the SAR conversion rate before treating it as an improvement.

Does the false positive rate differ for sanctions screening?

Yes. Screening alerts come from name matching and transaction monitoring alerts come from scenarios, so they have different causes and volumes. Calculate and report each separately.

Who is responsible for lowering the rate?

The bank, through its model governance and BSA/AML program. Changes to rules and thresholds should be documented, tested and approved by the people accountable for the program, not made by the team reviewing the alerts.