The false positive rate says how noisy a monitoring system is. The detection rate says what it misses, and it can be estimated from SARs the bank already filed.
Take every suspicious activity report the firm filed that did not start from a monitoring alert, and check whether monitoring had alerted on that customer beforehand. The detection rate is monitoring-sourced SARs plus those prior alerts, divided by all SARs. In an illustrative bank, 815 of 1,240 SARs had a monitoring alert: a detection rate of 65.7 per cent, and 34.3 per cent of known suspicious activity was never flagged by the system at all.
Worked in full in The EU AML Handbook by Julian R. Sterling, with every figure reproduced in a free workbook.See the book on Amazon →
Most monitoring statistics are about alerts: how many were generated, how many were closed, how many became cases. They describe precision, the share of alerts that turn out to matter. They say nothing about recall, the share of suspicious activity the system catches. A scenario set can be tuned to a better false positive rate by raising thresholds, and look like an improvement while it quietly misses more. As the AMLR, Regulation (EU) 2024/1624, moves the core due diligence and monitoring obligations into a directly applicable regulation from 10 July 2027, firms should expect to be asked to show that monitoring works, not only that it runs. Recall is the number that shows it.
The difficulty is that nobody knows the full population of suspicious activity. The practical substitute is the set of suspicious cases the firm found by other routes: staff referrals, law enforcement requests and production orders, sanctions and adverse media screening. Each is a case that monitoring should arguably have seen, and each can be tested.
| Source of the SAR | SARs | Share |
|---|---|---|
| Transaction monitoring alert | 610 | 49.2% |
| Staff referral (branch, relationship manager, fraud team) | 380 | 30.6% |
| Law enforcement request or order | 150 | 12.1% |
| Screening and adverse media | 100 | 8.1% |
| Total | 1,240 | 100% |
Monitoring generated 48,000 alerts in the year. The 610 SARs that came from them give an alert-to-SAR rate of 1.27 per cent, or 78.7 alerts per SAR: the precision side, worked in detail in the false positive rate article.
For each of the 630 SARs that did not come from monitoring, an analyst checks whether any monitoring scenario alerted on the customer or its linked accounts in the 12 months before the SAR, and how that alert was dispositioned. The look-back finds a prior alert on 205 of them. The other 425 never generated an alert.
Detection rate = (monitoring-sourced SARs + other SARs with a prior alert) / all SARs
= (610 + 205) / 1,240 = 815 / 1,240 = 65.7%
Miss rate = 425 / 1,240 = 34.3%
Alerted but closed = 205 / 815 = 25.2% of detected cases
Excel: =(B2+C2)/(B2+D2) with B2 monitoring SARs, C2 prior alerts found, D2 other SARs.
The three figures point to three different fixes. The 425 misses are a coverage problem: a typology the scenarios do not look for, or thresholds set above where it happens. The 205 alerted-but-closed cases are an investigation problem: the system saw the activity and an analyst closed the alert, so new scenarios would not help. The 49.2 per cent monitoring share is a context figure, not a quality metric on its own, because it moves with how active the referral and fraud teams are.
Reviewing 630 files is weeks of work. A random sample of 200 does most of the job. Suppose 65 of the 200 had a prior alert, 32.5 per cent. The Wilson score interval, which behaves better than the simple normal approximation at these sizes, gives:
Wilson interval = [p + z²/2n ± z √(p(1−p)/n + z²/4n²)] / (1 + z²/n), with p = 0.325, n = 200, z = 1.96
= 26.4% to 39.3%
Detection rate = (610 + 32.5% × 630) / 1,240 = 65.7%, interval 62.6% to 69.1%
An interval 12.9 points wide on the sample share (the normal approximation gives ±6.5 points) becomes 6.5 points wide on the overall rate, because the 610 monitoring-sourced SARs are known exactly and the sampling error only applies to the other 630. The interval is slightly conservative, since it ignores the finite population correction for a sample of 200 out of 630. That is precise enough to report and to track year on year.
| Typology | SARs | Detected | Detection rate | Missed |
|---|---|---|---|---|
| Cash structuring | 260 | 221 | 85.0% | 39 |
| Rapid movement / pass-through | 300 | 228 | 76.0% | 72 |
| Mule and third-party accounts | 280 | 168 | 60.0% | 112 |
| Fraud proceeds | 250 | 153 | 61.2% | 97 |
| Trade-based / invoice | 150 | 45 | 30.0% | 105 |
| Total | 1,240 | 815 | 65.7% | 425 |
The headline 65.7 per cent averages a strong cash scenario with a weak trade-based one. Trade-based cases are 150 of 1,240 SARs but 105 of the 425 misses, because monitoring that looks at payment amounts and velocity cannot see an over-invoiced shipment. The mule line, 112 misses, usually points to scenarios that look at one account at a time. Those two rows are where scenario development pays, and the same look-back can be rerun after each change. Pass-through behaviour, the second row, has its own detection logic in how to detect a pass-through account.
Reporting the monitoring share of SARs, here 49.2 per cent, as if it were the detection rate. It understates detection, because it ignores the 205 cases monitoring flagged and analysts closed, and it confuses two problems with different owners. The opposite mistake is reading 65.7 per cent as the share of all suspicious activity caught. The reference set contains only what the bank found some other way; activity nobody found is in neither the numerator nor the denominator. The measure is recall against known cases, which is the best available proxy and should be labelled as such.
The book's own worked case, sizing the remediation of an AML back book, is rebuilt in the free workbook for this case.
Measure recall as well as precision. Take the SARs that did not come from monitoring, look back 12 months for alerts, and report three numbers: the detection rate, the miss rate by typology, and the share of detected cases that analysts closed. The first tells the board whether monitoring works; the other two tell the team what to fix.
The false positive rate looks at alerts and asks how many were not suspicious; the detection rate looks at suspicious cases and asks how many the system alerted on. In the illustrative bank, only 1.27 per cent of 48,000 alerts became SARs, yet the system still alerted on just 65.7 per cent of the suspicious cases the bank knew about. Tuning one without measuring the other is guesswork.
Enough for the interval to support the decision. With 65 prior alerts in a random sample of 200 non-monitoring SARs, the share is 32.5 per cent with a Wilson 95 per cent interval of 26.4 to 39.3 per cent, which puts the overall detection rate between 62.6 and 69.1 per cent. Reviewing all 630 removes the sampling error entirely.
That the system detected the activity and the investigation closed it. In the illustrative look-back, 205 of the 815 detected cases, 25.2 per cent, had an alert closed in the year before another team raised the SAR. That is an investigation quality finding, not a scenario coverage gap, and it is fixed with alert review standards rather than new thresholds.
This article is one calculation from The EU AML Handbook. The book takes the same case from first principles to the decision, chapter by chapter, and every figure it prints is a live formula in the free companion workbooks.
Get the book on Amazon →Free companion files
Also on Amazon UK · Amazon Germany · Amazon France · Amazon Canada
Reading guide: regulation, compliance and banking → · All 1501 articles →
If this book helped, or didn’t, a few lines on Amazon are worth more than they look: they are what the next reader goes on. Write a review. The workbook stays free either way.