Above-the-line and below-the-line testing on an illustrative cash scenario, with the sample size the decision needs.
An AML transaction monitoring threshold is set by testing each band of events around it: above-the-line, where every alert is already reviewed, and below-the-line, where a sample of events that did not alert is reviewed as if it had. A band earns its alerts when its productive rate, the share escalated to a case, clears the firm's minimum. On an illustrative cash scenario, lowering the threshold from €15,000 to €12,500 adds 900 alerts a month at a 5.0 per cent productive rate and is justified; going to €10,000 adds 1,800 more at 1.7 per cent and is not, even though the €10,000 option's average rate looks better than today's.
Worked in full in The EU AML Handbook by Julian R. Sterling, with every figure reproduced in a free workbook.See the book on Amazon →
An illustrative retail bank runs a scenario on cash deposits summed over 30 days per customer, alerting at €15,000. The firm has set a minimum productive rate of 2.0 per cent for a band to be worth alerting on, and costs a level-one review at €30, about 20 minutes. For the tuning exercise, it splits events into four bands. The two above the line are fully reviewed already. For the two below the line, it draws a random sample of 60 events in each and has analysts review them blind, as normal alerts. These are internal risk settings: they have nothing to do with the AMLR's €10,000 CDD trigger for occasional transactions, which is a legal obligation applied at the point of the transaction, as worked in when linked transactions trigger the €10,000 threshold.
| Band, 30-day cash | Events | Reviewed | Productive | Productive rate |
|---|---|---|---|---|
| 10,000 to 12,500 (below the line) | 1,800 | 60 | 1 | 1.7% |
| 12,500 to 15,000 (below the line) | 900 | 60 | 3 | 5.0% |
| 15,000 to 20,000 (above the line) | 700 | 700 | 12 | 1.7% |
| Over 20,000 (above the line) | 500 | 500 | 18 | 3.6% |
Productive rate = productive in sample / reviewed; expected productive = events × rate
12,500 to 15,000: 3 / 60 = 5.0%; 900 × 5.0% = 45.0 productive alerts a month
10,000 to 12,500: 1 / 60 = 1.7%; 1,800 × 1.67% = 30.0
Cost per productive alert = events × 30 / expected productive: 600 euro and 1,800 euro
| Threshold | Alerts | Expected productive | Rate | Review cost | Analysts |
|---|---|---|---|---|---|
| 10,000 | 3,900 | 105.0 | 2.69% | 117,000 | 9.8 |
| 12,500 | 2,100 | 75.0 | 3.57% | 63,000 | 5.3 |
| 15,000 (current) | 1,200 | 30.0 | 2.50% | 36,000 | 3.0 |
| 20,000 | 500 | 18.0 | 3.60% | 15,000 | 1.3 |
Analysts assume level-one review only, at 133.3 productive hours a month. Read the table band by band, not line by line. Moving to €12,500 adds 900 alerts, 300 hours or 2.25 analysts, and 45 productive alerts: the band below the current line is more productive than the alerts the bank already reviews. Moving on to €10,000 adds 1,800 alerts for 30 productive ones, a marginal rate of 1.7 per cent, under the 2.0 per cent minimum.
Sixty reviews is a small sample for rates of a few per cent. One-sided 95 per cent bounds, from the binomial distribution, put the 12,500 to 15,000 band between 1.4 and 12.4 per cent, and the 10,000 to 12,500 band between 0.1 and 7.7 per cent.
Sample size to show a rate below 2.0% with zero findings: n = ln(0.05) / ln(1 − 2.0%) = 149
Excel, upper bound for k findings in n reviews: =BETA.INV(0.95,k+1,n-k)
So the evidence supports lowering to €12,500 but does not yet prove that €10,000 is unproductive: its upper bound, 7.7 per cent, is above the minimum. The defensible decision is to lower to €12,500 now and extend the sample in the lower band to about 150 events before closing the question. If the larger sample returned, say, 5 productive in 150, a 3.3 per cent rate with bounds of 1.3 and 6.9, the point estimate would clear the minimum and the case for €10,000 would reopen. The burden of proof is deliberately asymmetric: the €12,500 to €15,000 band's lower bound, 1.4 per cent, is also under the minimum, but a change that adds detection can rest on a point estimate double the current alerts' rate, while declaring a band unproductive, which forgoes detection, should rest on an upper bound below the minimum.
Productive means escalated to a case under the bank's own definition, applied the same way above and below the line. If below-the-line reviews are done by a different team, or know the events are test events, the rates are not comparable.
The 15,000 to 20,000 band above the line runs at 1.7 per cent, also below the minimum. Raising the threshold to €20,000 would save 700 alerts and €21,000 a month and lose 12 productive alerts a month. Most firms, and most supervisors, treat a raise very differently from a cut: lost productive alerts are potential unreported suspicion. The better response to a weak band above the line is usually to refine the scenario, for example by segmenting customers whose business is cash-intensive, rather than to move the line upward.
The common mistake is to compare options on their average productive rate. At €10,000 the scenario as a whole runs at 2.69 per cent, above the current 2.50, and the option looks like an improvement. The average is carried by the strong €12,500 to €15,000 band; the band the extra step adds runs at 1.7 per cent. Decisions belong to the marginal band. The second mistake is a sample too small to support the conclusion drawn, which is what a model validator or a supervisor will test first. Productive rate is the mirror of the false positive rate worked in how to calculate the false positive rate of AML alerts, and the staffing method there applies to every option in the table. The companion page has the free workbook and working documents for the book.
Reviewing a random sample of events that fell just below a scenario's threshold, as if they had alerted, to see whether suspicious activity is being missed. In this example 60 events between €12,500 and €15,000 produce 3 escalations, a 5.0 per cent productive rate, double the 2.50 per cent of the alerts already reviewed, which justifies lowering the threshold.
Big enough for the decision. To show with 95 per cent confidence that a band's productive rate is below a 2.0 per cent minimum, you need 149 reviews with no productive finding. A sample of 60 with one finding gives a rate of 1.7 per cent but an upper bound of 7.7 per cent, which proves nothing either way.
It can if the evidence supports it and the decision is documented, but supervisors look hard at it because lost alerts may be unreported suspicion. Here raising the threshold from €15,000 to €20,000 saves 700 alerts and €21,000 a month but loses 12 productive alerts a month; refining the scenario is usually the better answer.
This article is one calculation from The EU AML Handbook. The book takes the same case from first principles to the decision, chapter by chapter, and every figure it prints is a live formula in the free companion workbooks.
Get the book on Amazon →Free companion files
Also on Amazon UK · Amazon Germany · Amazon France · Amazon Canada
Reading guide: regulation, compliance and banking → · All 1340 articles →
If this book helped, or didn’t, a few lines on Amazon are worth more than they look: they are what the next reader goes on. Write a review. The workbook stays free either way.