Set It and Forget It Doesn’t Work: Keeping Your Monitoring Program Honest
A transaction monitoring system can be in place and still fail to provide the protection an organization needs. Rules may have been written years ago. Customer behavior may have changed. Transaction volumes may have grown. The business may have entered new markets or added new products. If you leave that system alone—untuned, untested, and under-resourced—you create blind spots. And in today’s environment, regulators have been very clear: “we didn’t know” is not a strong defense.
That is why payment risk management cannot be treated as a set-it-and-forget-it exercise. Organizations need to regularly review, tune, test, validate, and audit their monitoring programs to make sure they are working as intended, not just as originally designed.
In my work with merchants and partners, I see a common pattern: the strongest programs are not the ones with the fanciest tools. They are the ones where teams understand their customers, know what “normal” looks like, document their decisions, and escalate early when something does not add up.
Why monitoring systems cannot be treated as set-it-and-forget-it tools
Legacy rules engines are often treated like a black box: as long as they are running, people assume they must be doing their job. That assumption is dangerous. Regulators have issued significant enforcement actions where the core issue was not the absence of a monitoring system, but the fact that it was insufficient, uncalibrated, or not reviewed as risks evolved. In some cases, delayed or missing suspicious activity reports were traced back to systems that simply did not identify unusual activity in the first place.
A recent case makes the point concrete. In March 2026, FinCEN entered an $80 million consent order against broker-dealer Canaccord Genuity LLC—the largest Bank Secrecy Act enforcement action ever brought against a broker-dealer. Until late 2021, just four employees, none with prior AML experience, were responsible for reviewing more than 100 surveillance reports a year, and key trade-surveillance reports went unreviewed for stretches ranging from months to four years. The result was at least 160 unfiled suspicious activity reports tied to fraud schemes that harmed investors. The SEC and FINRA settled parallel actions the same day, adding a further $20 million penalty each.
Read the FinCEN consent order.
A more responsible fraud monitoring posture is to ask simple, practical questions on a regular cadence:
When was the system last tuned?
Has it been tested and validated against current risks, not just historical patterns?
Are alerts being generated as expected—or has volume drifted up or down in ways nobody has explained?
Can the organization review alerts in a timely way, given current staffing and business growth?
Do the rules and models still reflect today’s customers, products, channels, and transaction behavior?
These are not just technical housekeeping questions. They are core risk-management questions. If your system does not identify unusual activity, or if your team cannot review alerts promptly, you may have exposure you do not yet see.
Start with the difference between unusual and suspicious activity
One of the most helpful mental shifts for risk and compliance teams—and for partners—is to separate unusual from suspicious.
Unusual activity is a signal that something changed or does not fit the expected pattern.
Suspicious activity is what you arrive at after you analyze that signal, test explanations, and determine there is no reasonable business purpose, or other red flags are present.
Consider a simple example. A merchant typically processes about $500,000 in a month. Suddenly, you see that same merchant processing $1 million or $2 million. That spike might be legitimate. The business could have:
Entered a seasonal peak,
Won a large new customer,
Added a new product line, or
Shifted more of its volume to digital channels.
But you do not know that until you look. The job of your transaction monitoring program is to identify that change, flag it as unusual, and prompt a review. If there is no reasonable business explanation, or the explanation does not reconcile with the facts, the activity may become suspicious and require further escalation or reporting. If you never see the spike, you never have the chance to ask those questions.
Why customer and business context matters
Raw transaction data is only part of the story. To distinguish unusual from suspicious, you also need context:
What vertical is this customer in, and what does “normal” look like in that industry?
How long have they been with you, and how has their behavior changed over time?
What is their business model and geography?
Are there known events—a product launch, a merger or acquisition (M&A), a seasonal pattern—that explain the change?
The same pattern can mean very different things in different contexts. A sudden increase in volume for a mature, well-understood business may be easier to explain than a spike at a newly onboarded customer with limited transparency into ownership or source of funds. This is where partners and sales teams have a critical role. They are often the first line of visibility into:
Who the customer really is,
How their business operates, and
What has changed recently on the ground.
If a customer is evasive about basic information—ownership, source of funds, nature of their activity—that is itself a red flag. If they refuse to disclose who actually controls the business, or consistently push back on reasonable due-diligence questions, that should trigger deeper review and, in some cases, reconsideration of the relationship.
How risk-based decisions support proportionate controls
Not all customers carry the same level of risk, and your controls should reflect that reality. Most programs start with basic due diligence at onboarding: collecting key information like legal name, address, date of birth, beneficial owners, business type, expected activity, and banking details.
For certain categories of merchants, regulators and banking partners expect enhanced due diligence (EDD). In practice, that can mean:
Understanding the customer’s source of funds or source of wealth,
Paying closer attention to high-risk geographies or channels,
Monitoring activity more frequently or at lower thresholds,
Considering reserves, delayed funding, or other financial safeguards, and
Refreshing KYC (Know Your Customer) information when there are trigger events such as a change of ownership, negative news, or a move to a higher-risk category.
A risk-based approach does not mean treating everyone the same. It means:
Segmenting customers by risk,
Applying more intensive controls where they are warranted, and
Reassessing those decisions as the relationship and environment evolve.
Think of it as proportionate oversight. The higher the inherent risk (the risk before controls are applied) and residual risk (what remains after controls are applied), the more structure and scrutiny you should apply.
What makes a decision defensible
In the real world, risk and compliance decisions are rarely clean or perfect. You often work with incomplete information, complex facts, and competing pressures. A defensible decision is not one that turned out to be right in hindsight; it is one you can clearly explain. A defensible decision record should capture at least:
What you observed (the signal) and why it was notable,
What you knew and did not know at the time,
What steps you took to validate or challenge the explanation,
How you weighed the risks and options, and
Why your decision aligned with policy, risk appetite, and regulatory expectations.
This applies across the lifecycle:
Onboarding a higher-risk merchant,
Approving additional locations or new products,
Adjusting limits or reserves,
Exiting a relationship, or
Deciding whether or not to file a suspicious activity report.
Documentation is not administrative cleanup after “the real work” is done. It is part of the decision. It is what you will rely on when a regulator, banking partner, auditor, or internal stakeholder asks, “Why did we think this was acceptable at the time?” If you cannot reconstruct your reasoning, you are vulnerable—even if the original call was reasonable.
Escalation is sound judgment, not failure
One message I emphasize often is simple: when in doubt, escalate early. Too often, teams—especially in sales or growth roles—treat escalation as an admission of failure or a blocker to revenue. That mindset creates risk you don’t have to take on. A better way to think about it:
When information is incomplete,
When activity is out of pattern, or
When the stakes are high,
bringing compliance and risk partners into the conversation is sound judgment, not weakness. Compliance should be an early partner, not a “revenue stopper.” Bring them in sooner, and they can:
Help you frame the right questions,
Identify information gaps,
Suggest proportionate conditions or mitigants, and
Protect the customer relationship and the business alike.
We’re a “yes, but” department: yes, but let’s understand the risk first. The goal isn’t to block growth—it’s to make sure it’s growth you can defend.
A practical checklist for ongoing monitoring improvement
You do not need a brand-new platform to start improving your monitoring program. You do need consistent habits. Here is a simple checklist you can use to assess and strengthen your approach:
Step 1: Review and tune rules on a regular cadence. Do not assume a legacy rules engine is still fit for purpose just because it is running. Check whether rules still map to actual products, channels, and risk patterns.
Step 2: Validate that alerts match your current risk profile. Test that your system flags what it should (including unusual activity) and does not drown analysts in noise that hides real issues.
Step 3: Confirm staffing can support alert volumes. Align headcount, training, and processes with the volume and complexity of alerts, especially during periods of growth or expansion.
Step 4: Document onboarding, offboarding, and key risk decisions. For higher-risk merchants in particular, make sure you capture risk rationales and that they are consistent with your policies and risk appetite.
Step 5: Reassess higher-risk merchants over time. Use trigger events—ownership changes, negative news, spikes in disputes or returns, volume shifts—to prompt refreshes of due diligence and risk ratings.
Step 6: Investigate unusual activity in context. Do not treat every anomaly as suspicious, but do insist on explanations that make sense given the customer’s business, history, and peer behavior.
Step 7: Escalate questions early when the facts are incomplete. Encourage a culture where front-line teams, partners, and sales leaders see compliance and risk as allies, and know exactly how to pull them in.
Proactive risk management is not about eliminating every false positive or predicting every threat
It is about:
Maintaining systems that actually work,
Applying business context thoughtfully,
Documenting decisions so they are defensible, and
Acting early—before a manageable issue becomes a larger exposure for your organization, your partners, and the broader payments ecosystem.
If we all take responsibility for our part of the chain, we do more than protect ourselves. We help protect the integrity of the entire ecosystem we depend on.
Bottom line: a monitoring program is never “done.” Treat it as a living system—tuned, tested, and documented—and it will earn its keep the day a regulator, partner, or auditor asks you to explain a decision.