False Positive Risk Classification

A False Positive is:

An alert incorrectly raised because of an imperfect rule. A legitimate transaction flagged as suspicious.

Industry benchmark: 90-95% of all alerts generated by AML engines are false positives. Up to 98% in some banks. Industry analysis puts false-positive ratios at 90 to 95% in traditional transaction monitoring programs. Deloitte's 2020 AML survey named it top operational hurdle.

If False Negative is a crime missed, False Positive is an innocent customer branded a criminal.

I. How Banks Classify False Positives - The 5-Category Model

Regulators now expect documented risk classification, not just close-as-false-positive:

Category 1 - True Crime - Definite True Positive: Confirmed money laundering, SAR must be filed. Black and white true.

Category 2 - Plausible but Below Threshold: Looks somewhat suspicious but doesn't meet reporting threshold. Keep under monitoring, enhance due diligence. Example: structuring pattern but legitimate business cash.

Category 3 - Unclear - Needs Human Review: Automated system cannot decide. Must go to Level 2 analyst. Most regulatory fines come from auto-closing these.

Category 4 - Explainable False Positive - System Tuning Opportunity: Legitimate but triggered due to bad rule - e.g., salary payment flagged as round-tripping because it is exactly $10,000. Rule needs recalibration.

Category 5 - Definite False Positive - Never Again: Pure noise - e.g., internal journal transfer between own accounts flagged as third-party. Should be whitelisted.

Alert Risk Scoring helps classify risk of alerts. If alert score does not meet set score, those alerts do not warrant further investigation and can be closed systematically, since these are false positives.

II. Why False Positives Are a Regulatory Risk

Three risks regulators prosecute:

1. The Crying Wolf Effect / Operational Failure
When 95% alerts are false, analysts get fatigue and auto-close real ones. In April 2026, OCC signed consent order against Community Federal Savings Bank, sponsor bank for Wise and Crypto.com. Its automated triage system "auto-closed a very high percentage of all ingested alerts" that should have gone to a person.

FinCEN: Reporting deadlines are 30 days after suspicious activity starts. Failure to effectively manage false positives can result in regulatory scrutiny.

2. Discrimination / Unfair Classification

Case studies from leading banks highlight that biased detection algorithms disproportionately misclassify transactions associated with specific customer demographics.

• CFPB Circular May 2022 on Black Box Models: CFPB told banks that ECOA liability extends to algorithmic models. If your false positive rate is higher for remittances to Nigeria vs. Canada, or for names with Arabic origin, that's disparate impact.
• EU AI Act Articles 6, 10-15, Annex III: Systems evaluating creditworthiness, biometric ID, KYC are classified as high-risk. Requires bias testing.
• GDPR Article 22: Restricts solely automated decisions with legal effect.

3. Defamation / Debanking / Data Protection
When you label customer high-risk in World-Check / Dow Jones Risk & Compliance and close account, customer sues.

III. Case Laws

A. Debanking Litigation - When False Positive Leads to Account Closure

1. Merciful Group Inc v Norfina Ltd t/as Suncorp Bank [2025] NSWSC 841 & NSWCA 155 [2026]
Facts: Between Nov 2019 - Mar 2022, four alerts registered on Merciful's account by AML Operations Team in accordance with triggers. Suncorp closed account, citing rational honest opinion that there was unacceptable ML/TF risk under AML/CTF Act.

Merciful sought injunction that debanking was unlawful.

Held: Supreme Court of NSW ruled bank entitled to de-bank to protect legitimate interests, where it held rational honest opinion of ML/TF risk. Bank can rely on statutory protection from liability in AML/CTF Act as defence.

Lesson for False Positive: Court accepted that bank does not need to prove actual money laundering, only that its risk classification system reasonably triggered. But must show alerts were not arbitrary.

2. Human Appeal International Australia v Beyond Bank Australia Ltd [2023] NSWSC 1161 (No 2) - Opposite Outcome
Beyond Bank closed account of charity Human Appeal without valid reason, claiming ML/TF risk.

Justice Parker found bank wrongfully de-banked. Bank could not show any alerts, pattern, or risk assessment. Closure was commercial, not compliance.

Lesson: If you classify as high-risk false positive with no documented triggers, court will treat as wrongful termination / breach of contract.

3. N v The Royal Bank of Scotland plc [2019] EWHC 1770 (Comm)
RBS froze 10 sub-accounts suspected of fraud / proceeds of crime. Customer N argued false positive - legitimate business.

Commercial Court upheld bank's contractual right to close without notice where bank had suspicion of money laundering. Referenced Shah v HSBC Private Bank [2012] EWHC 1283 - bank not liable for delay when reporting suspicion to SOCA.

Principle: Suspicion (subjective) is enough for reporting, but must be in good faith. False positive classification, if in good faith, protected.

4. Harvey v Santander UK plc [2023] EWHC 2947 (KB)
High Court dismissed injunction to unfreeze account - reinforced that where bank has suspicion, customer bears heavy burden to prove false positive was irrational.

B. Adverse Media / Database False Positive - GDPR + Defamation

5. Pacini & Anor v Dow Jones & Co Inc [2024] EWHC 2714 (KB)
Claimants were senior execs of XIO Group. Wall Street Journal 2017-2018 published articles naming them relating to fraudulent conspiracy.

2023 proceedings alleged personal data contained inaccurate / misleading data. Claimants sought compensation and erasure.

Court ruled personal data did not constitute "criminal offence data" under Article 10 UK GDPR, but opened door to argue meaning of personal data using defamation principles. Shows banks using Dow Jones / World-Check databases that ingest news create false positive classification risk - person flagged as criminal when article only alleged investigation.

6. Vince v Associated Newspapers Ltd [2026] EWCA Civ 899
Court of Appeal ruled headline-and-photograph juxtaposition can be unfair personal data processing under UK GDPR, even where same facts give no claim in defamation.

Implication for KYC: If your adverse media screening tool flags Mr. Vince as "sex pest donor" because his photo was under that headline, you have created a false positive by unfair processing. You are liable under GDPR Art 5(1)(a) fairness, not just defamation.

7. Due Diligence Databases - General Principle - Brett Wilson LLP
GDPR 2018 made it easier to assert data protection rights to object to inclusion of false or outdated information in risk/compliance databases. Inclusion of inaccurate info may give rise to defamation claim.

Banks that auto-reject customers based on fuzzy name match in World-Check (e.g., "Mohammad Khan" matches sanctioned person) without disambiguation face GDPR Art 22 challenges.

C. US - Systemic False Positive Classification Failure

8. OCC Consent Order - Community Federal Savings Bank - April 2026
Sponsor bank for Wise, Crypto.com. Automated triage auto-closed very high percentage of alerts. This is regulator's nightmare: bank tried to solve false positive burden by suppressing all alerts - creating false negatives.

This is the new enforcement trend: You cannot solve false positives by auto-closure without human. You must classify and tune.

IV. How to Build Defensible Risk Classification

Regulators expect:

1. Threshold Documentation: Why $10k? Why 3x daily volume? Show statistical analysis of true positive rate at each threshold.
2. Bias Testing: Test false positive rate by nationality, business type, transaction corridor. CFPB expects it.
3. Whitelisting Governance: Category 5 exclusions must be approved by MLRO + model risk, not by analyst alone.
4. Debanking File Note: Before closing, show: alerts + investigation + customer explanation request + rational opinion memo. That's what saved Suncorp in Merciful and sank Beyond Bank.