# Transaction Monitoring

> AML transaction monitoring for ongoing customer relationships. Identifies suspicious patterns including structuring, layering, and unusual activity. Assesses against regulatory thresholds and prepares Suspicious Activity Reports (SARs) with HITL decision gates.

- Skill: `vyayasan/transaction-monitoring` (Agent Skill)
- Install (CLI): `npx skillmds@latest add vyayasan/transaction-monitoring`
- Raw SKILL.md: https://api.skillmd.com/api/skills/vyayasan/transaction-monitoring/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: vyayasan (https://skillmd.com/u/vyayasan)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/vyayasan/transaction-monitoring

---


# Transaction Monitoring Skill - v1.0.0

AML transaction monitoring for ongoing customer relationships. Identifies suspicious patterns, assesses structuring and layering, and prepares Suspicious Activity Reports (SARs).

## Overview

Transaction monitoring is a continuous obligation under AML regulations. This skill analyzes transaction data to detect patterns that may indicate money laundering, terrorist financing, or other financial crime.

## Detection Patterns

### 1. Structuring (Smurfing)
- Multiple transactions just below reporting thresholds
- Multiple deposits across different branches/channels on same day
- Pattern of round-number transactions
- **Threshold (US):** $10,000 CTR threshold; $5,000 aggregated suspicious activity

### 2. Layering
- Complex routing through multiple accounts or entities
- Rapid movement between accounts with no clear business purpose
- International transfers through multiple jurisdictions
- Use of shell companies or nominee accounts

### 3. Circular Flows
- Money leaving and returning to same account via intermediaries
- Round-trip transactions with no economic substance
- Funds flowing through subsidiaries back to parent

### 4. Velocity Anomalies
- Sudden increase in transaction frequency
- Dramatic change in average transaction value
- Activity inconsistent with customer profile or declared business
- Dormant account reactivation with high-value activity

### 5. Geographic Risk Patterns
- Transactions to/from FATF grey-list or black-list jurisdictions
- Unexplained payments to/from high-risk countries
- Wire transfers to known shell company jurisdictions

## Monitoring Process

### Step 1: Data Analysis
- Import transaction data (CSV, Excel, or database extract)
- Calculate baseline metrics (average value, frequency, counterparties)
- Identify deviations from customer profile

### Step 2: Pattern Detection
- Apply detection rules for each pattern type
- Flag transactions meeting alert criteria
- Score alerts by severity (LOW/MEDIUM/HIGH/CRITICAL)

### Step 3: Investigation [HITL Checkpoint]
- Analyst reviews flagged transactions
- Assesses whether activity has legitimate explanation
- Researches counterparties and destinations
- Documents investigation findings

### Step 4: Decision
- **CLEAR:** Document rationale, close alert
- **SUSPICIOUS:** Draft SAR narrative, escalate to MLRO
- **CRITICAL:** Immediate MLRO notification, consider account freeze

### Step 5: SAR Preparation (if applicable)
Claude drafts SAR narrative including:
- Subject information
- Suspicious activity description
- Transaction details
- Why activity is suspicious
- Supporting evidence

**CRITICAL HITL: SAR filing is always a human decision. Claude drafts; MLRO reviews and files.**

## Output

- Transaction analysis report (Excel with flagged items)
- Alert summary with severity scoring
- SAR draft (if suspicious activity identified)
- Escalation brief for MLRO
- Updated customer risk assessment

## Regulatory Basis

- **US:** BSA/AML, FinCEN SAR requirements ($5,000 threshold)
- **UK/EU:** AMLD5 ongoing monitoring, POCA 2002 SAR obligations
- **MENA:** CBUAE, SAMA transaction monitoring requirements

---

**Version:** 1.0.0
**Author:** Vyayasan