Financial crime threats are accelerating. The cause is, once again, AI, which fraudsters use to create increasingly convincing synthetic identities, seemingly legitimate addresses, and employment histories assembled from publicly available data.
Yet many businesses still rely heavily on manual processes for identity and AML checks, leaving compliance teams under pressure to do more with limited resources. According to the 2026 SmartSearch Compliance Survey, more than 50% of firms across legal and financial services still conduct identity checks manually.
The challenge is becoming even more acute as regulatory expectations increase and sanctions, watchlists and other risk indicators change more frequently.
For regulated businesses, ongoing monitoring has therefore become an essential part of maintaining an accurate understanding of customer risk throughout the relationship.
But… sadly, there is always a but. The more frequently firms monitor customers, transactions and risk data, the greater the potential volume of alerts. And more alerts do not necessarily mean better compliance. If monitoring systems generate large numbers of alerts that ultimately prove to be harmless, compliance teams can quickly become overwhelmed by false positives.
So how can firms increase monitoring without increasing the noise?
Of course, the answer can’t be to monitor less. It’s to monitor more intelligently, using daily monitoring to identify what has changed on customers’ records rather than repeatedly generating alerts from unchanged information. Let’s see what that means.
What is ongoing monitoring?
Ongoing monitoring is a regulatory requirement that ensures customer risk is assessed throughout the business relationship rather than only at onboarding.
Under Regulation 28(11) of the UK Money Laundering Regulations 2017, firms must conduct ongoing monitoring of business relationships. This includes scrutinising transactions and activity throughout the relationship and ensuring that information obtained through customer due diligence remains up to date and relevant.
In a nutshell, ongoing monitoring means continuing to assess whether a customer's behaviour, circumstances or risk profile has changed.
This can include:
- Monitoring transactions and identifying unusual activity.
- Screening customers against sanctions, PEPs and other watchlists.
- Updating customer due diligence information.
- Applying enhanced due diligence to higher-risk customers.
- Reassessing customer risk when circumstances change.
- Reviewing alerts and reporting potentially suspicious activity.
The objective is simple: a customer's risk profile should not remain frozen from the day they are onboarded. A customer who was considered low risk two years ago may not have the same risk profile today. They could become a politically exposed person, appear on a sanctions list, change their business activities or begin conducting transactions that are inconsistent with their established profile.
Why more monitoring can create more false positives
Increasing monitoring sounds like an obvious way to improve financial crime detection. But there is a trade-off. Detection systems are deliberately designed to be sensitive. It is generally preferable for a compliance system to flag something that turns out to be legitimate than to miss genuinely suspicious activity. The result is that legitimate activity can sometimes look suspicious.
For example, a small business receiving frequent international payments from overseas suppliers could trigger transaction monitoring rules designed to identify unusual cross-border activity. A customer moving money between their own accounts could resemble layering.
None of these activities is necessarily suspicious, yet each can generate an alert. This is what we call the false-positive problem. A false positive occurs when a legitimate customer, transaction or entity is incorrectly flagged as potentially suspicious, requiring an analyst to investigate the alert before ultimately determining that there is no financial crime concern.
False positives are particularly problematic because every alert carries an operational cost. An analyst must review the information, investigate the circumstances, record the rationale for the decision and close or escalate the case.
Multiply that process by thousands or millions of alerts and the scale of the problem becomes clear. According to industry analyses, up to 90% of all alerts generated by traditional transaction-monitoring systems can ultimately prove to be false positives.
The exact proportion varies significantly between institutions, monitoring systems and alert types, but the underlying problem is consistent: compliance teams can spend a disproportionate amount of their time investigating activity that ultimately presents no risk.
If UK businesses now spend £33.9 billion per year on AML and financial crime compliance, false positives are one of the primary drivers of wasteful spending.
The real challenge: more monitoring without more noise
The challenge for compliance teams is to increase monitoring without creating an unmanageable volume of false positives.
As discussed earlier, more frequent screening can generate more alerts, but more alerts do not necessarily mean better compliance. And when analysts spend their time repeatedly reviewing legitimate activity, valuable resources are diverted away from genuinely risky cases.
The answer is smarter monitoring. But how do firms do that?
From ongoing monitoring to daily monitoring
Ongoing monitoring sets the expectation: customer risk should be assessed throughout the relationship, not just at onboarding or during periodic reviews.
Daily monitoring takes this a step further. It creates a regular, automated monitoring cycle that can help firms identify new risks by focusing on what has changed, rather than repeatedly generating alerts from unchanged information.
The key point about daily monitoring is that it does not have to mean daily alerts. The goal is to identify what has changed and determine whether that change requires investigation.
Don't generate an alert simply because you screened the customer again. Generate an alert because something has changed.
How SmartSearch delivers smarter monitoring
SmartSearch’s smarter monitoring helps firms focus attention on meaningful changes rather than simply generating another alert every time a customer is screened.
SmartSearch monitors changes in customer status, including PEP and sanctions status. Its watchlist data is updated daily, with monitored customers rescreened nightly, helping firms identify new risks as they emerge.
With this approach, firms can reduce unnecessary PEP, sanctions and adverse media hits to less than 1%.
The result is a smarter, more focused approach to monitoring, allowing compliance teams to spend less time reviewing unchanged information and more time investigating changes that may indicate genuine risk.
If false positives are putting an increasing amount of pressure on your team and compliance budget, don't miss our next free webinar: Beyond the Initial Check: Managing PEP & Sanctions Risk with Ongoing Monitoring, on Tuesday, the 10th of November, 11:00-11:30 am.
.png?width=1680&height=560&name=Report%20webinar%20banner%20(2).png)
Register now or Book a discovery call to explore how SmartSearch's ongoing monitoring solution can work for your firm.
Bibliography
https://www.gov.uk/hmrc-internal-manuals/economic-crime-supervision-handbook
https://www.pwc.pl/en/services/innovating-transaction-monitoring-using-ai.html
https://www.lseg.com/en/risk-intelligence/glossary/risk-management/false-positive
https://www.smartsearch.com/resources/blog/what-is-ongoing-monitoring-in-aml-and-why-it-Matters
https://www.smartsearch.com/resources/blog/scalable-kyc-risk-scoring-and-monitoring-in-2026
https://www.smartsearch.com/solutions/sanctions-and-pep-sip-rca-screening
Tired of false positives?
Let’s talk.
.png?width=464&height=275&name=Email%20Box%20Graphics%20(4).png)
