1. What Is A False Positive In AML

Two types:

• Sanctions / PEP Screening: John Garcia hits OFAC list John Garcia - same name, different DOB, country. System flags 100%.
• Transaction Monitoring: €9,900 cash deposit flagged as structuring, but it's normal for supermarket client.

Cost: For enterprise banks $10M+ per year in analyst time. But regulatory risk is inverted - if you tune out too aggressively, you miss crime.

2. Regulatory Framework For Management

• EU: AMLD 5/6 Art 33 - obliged entity must file STR without delay when suspicion. Dir 2015/849 Art 8 - risk-based approach, must be able to demonstrate appropriateness of monitoring. New EU AML Regulation 2024 + AMLA will require approval of detection criteria kept in-house even if outsourced. AI Act - AML monitoring NOT listed as high-risk, but senior manager accountability applies.
• US: BSA + FinCEN AML Program Rule proposed April 2026 - names "effective use of AI" as positive factor, says responsible testing will not itself trigger enforcement. OCC expects Below-The-Line testing.
• UK: Money Laundering Regulations 2007/2017 Reg 8(1), 8(3), 14(1) - must have adequate transaction monitoring.

Regulator expectation: You must prove why you suppressed, not just that you suppressed.

Four mandatory controls:

1. Data Quality: Clean KYC, beneficial owner data, standardized names. Fuzzy logic tuned to population.
2. Segmentation & Tuning: Different thresholds for different customer risk profiles. Retail student vs Money Service Business cannot have same €10k rule.
3. Documentation & Validation: Baseline before change, detection rate after change, approval trail, 90-day parallel run.
4. No Silent Auto-Close: AI can close low-risk alerts, but you need sampling, explainability, audit trail.

3. Best Practice Management Model

Stage 1 - Prevention:

• Match-score weighting: Name 60%, DOB 25%, Country 15% - reweight per population. Use Golden Key like passport number to auto-exclude.
• Entity resolution: Link related accounts, understand ownership.
• Whitelisting with expiry: Known true false positive, e.g., internal transfers, with annual re-validation.

Stage 2 - Detection Tuning:

• Risk-based scenarios: Create risk profiles. High-risk customers have lower thresholds.
• Behavioural baselines: Instead of static €10k, use deviation from customer's 90-day average. Reduces 60-80% false positives while maintaining 95%+ true positive rate - HSBC Dynamic Risk Assessment case: Google Cloud partnership, screened 980M transactions/month, found 2-4x more suspicious activity while cutting alerts 60%.
• Threshold tuning + BTL Testing: Test what you would have missed below old threshold.

Stage 3 - Triage & Feedback Loop:

• AI Forensics for Screening agent to auto-clear likely false positives with reason code.
• Investigator feedback loop: If analyst marks false positive, feed back to model.
• Model Risk Management: Independent validation.

4. Case Laws and Enforcement Actions

A. Bank Liability For Delay Due To AML Suspicion - Customer Sues Bank

Shah v HSBC Private Bank (UK) Ltd [2009] EWHC 79; [2010] EWCA Civ 31; [2011] EWCA Civ 1154 - The Leading Case
Plaintiffs had 4 transfers delayed because bank suspected proceeds of crime and filed SAR to authorities seeking consent. Sued for negligence, saying suspicion was self-induced, mechanical, irrational.
Held:

• Bank NOT liable in negligence when acting to fulfil statutory AML obligations
• Plaintiff cannot challenge employee's suspicion unless clear evidence of bad faith
• Bank does not have to disclose names of employees who raised suspicion
• Principle: If you have false positive suspicion but you act in good faith per AML law, you are protected. This is why banks can afford to have false positives - law shields good faith reporting.

B. Liability For INADEQUATE Management - Regulator Fines Bank

R v NatWest Plc - Southwark Crown Court Dec 2021 - £264.8 Million
First criminal prosecution of bank under MLR 2007 in UK. Client Fowler Oldfield deposited £365M cash, many at branch in bin bags. NatWest's system misclassified cash as cheques, so subject to less strict monitoring. Rules not tuned, alerts not acted on. Bank pleaded guilty to 3 offences under Reg 45(1) MLR 2007 for failing to properly monitor.
Lesson: False negative due to poor tuning = criminal liability.

TD Bank - US DOJ + FinCEN Oct 2024 - $3.09 Billion
Pleaded guilty to conspiracy to fail to maintain AML program + failure to file CTRs + conspiracy to launder. System generated excessive false positives with no process to manage volume, so true alerts buried.

Commonwealth Bank of Australia v AUSTRAC [2018] FCA 930 - AUD $700 Million
Late threshold transaction reports, failure to monitor ATMs, automated system did not generate alerts. Court declared contravention of AML/CTF Act 2006.

Community Federal Savings Bank - OCC Consent Order April 2026
Sponsor bank for Wise and Crypto.com. Automated triage system "auto-closed a very high percentage of all ingested alerts" that should have gone to person. OCC found flaws in logic, data, method, thresholds not tuned to growing cross-border business.
This is the modern false positive case: Reducing false positives by auto-closing without sampling, explainability, audit trail = violation.

Starling Bank - FCA £29M 2024 + Monzo £21M 2025
Starling sanctions screening checked only part of list to reduce false positives. Monzo controls failed to keep up with growth. Both fined not for using technology, but for untested reduction.

FINRA - RBC Capital Markets $275,000 July 28 2026 + Broker-Dealer Surveillance Deficiency Case
FINRA Rule 3310(a) + 3310(f)(ii). Surveillance system generated inaccurate/incomplete reports, automatically labeled all incoming transactions as first-party requiring manual change. Held violation for not reasonably designing AML program to detect suspicious activity. Excessive false positives due to bad data mapping = program failure.

BaFin - 6 March 2025 - Payment Institution Sanction
German regulator sanctioned payment institution for filing "unsubstantiated" SARs on regular basis - i.e., flooding FIU with false positives to look compliant, instead of proper filtering. Also violation of Art 33 AMLD.

5. How To Defend False Positive Management Program To Regulator

You need to show:

1. Baseline: alerts, false positive rate, SARs before
2. Tuning rationale: why threshold changed, risk appetite
3. Testing: BTL testing proving you didn't miss true crime, parallel run 90 days
4. Governance: Named senior manager owns model risk, per FCA AI guidance Oct 19 2026
5. Explainability: Analyst can state why alert closed

Do not do: Quietly increase threshold to cut costs without testing. That is what got TD Bank, NatWest, Community Federal, Starling fined.