What is transaction monitoring?

Every payment provider, mobile money operator, fintech and bank is expected to watch the money that moves through it and notice when it is being used for crime. Transaction monitoring is that watching, done systematically by software and followed up by people.

This page explains the ideas behind it. If you already work in compliance, skip to How SpeculaPro works.

Two problems, one platform

Transaction monitoring covers two related but different problems.

	Anti-money laundering (AML)	Fraud
Who is the criminal?	Usually your own customer, using your service to hide where money came from	Usually someone attacking your customer or you — stealing an account, a card or a phone number
Who loses?	Society; and you, through fines and lost licences	Your customer, and often you
When must you act?	Within days — investigate, then report if suspicious	Within milliseconds — before the money leaves
Typical signs	Many deposits just under a reporting limit, money passing straight through an account, transfers to high-risk countries	A login from a new phone, a SIM swap, many failed PIN attempts, a burst of small card payments
SpeculaPro mode	Post-event and scheduled rules	Real-time rules through the decision API

SpeculaPro handles both because the same data, the same rule engine and the same case workflow serve both. A fraud case can turn out to be laundering, and the other way round.

Post-event versus real-time

Real-time monitoring happens before a payment goes through. Your system asks SpeculaPro “should I allow this?” and waits for an answer — allow, review or block — usually within a few tens of milliseconds. This is how fraud is stopped.

Post-event monitoring happens after the payment has gone through. SpeculaPro looks at the transaction together with weeks or months of history — “this customer has made fourteen cash deposits of just under GHS 10,000 in three weeks” — and raises an alert for a person to review. This is how most money laundering is found, because laundering is a pattern, not a single event.

Scheduled monitoring is a third kind: sweeps that run every night or week over many transactions at once, to find patterns no single transaction reveals, such as money moving in a circle between several accounts.

What money laundering looks like

Money laundering is usually described in three stages:

Placement — getting criminal cash into the financial system: cash deposits, agent cash-ins, buying airtime or vouchers.
Layering — moving it around to hide where it came from: many transfers between wallets and accounts, across providers and borders.
Integration — bringing it back out looking legitimate: buying property, paying “business” invoices, withdrawing from a bank account that now appears clean.

Each stage leaves patterns in transaction data. The rule library is organised around those patterns, which are called typologies.

Why it is required

Financial institutions are required by law to have an AML programme. In broad terms, that means you must:

Know your customer (KYC) — identify customers and understand what activity to expect from them.
Monitor their transactions for activity that does not fit.
Investigate what the monitoring finds, and keep a record of the decision.
Report suspicious activity to the national Financial Intelligence Unit (FIU).
Keep records for a number of years so they can be examined later.

Failing at any of these can mean fines, restrictions on your licence, or personal liability for the officers responsible.

The Ghana context

SpeculaPro launches in Ghana, so its first rule packs and report formats target Ghanaian institutions.

Body	Role
Financial Intelligence Centre (FIC)	Ghana’s FIU. Receives suspicious and cash transaction reports, through the goAML system.
Bank of Ghana (BoG)	Licenses and supervises banks, payment service providers and electronic money issuers, including their AML controls.
Data Protection Commission	Oversees how personal data is stored and processed.

What happens when something suspicious is found

An alert is raised. A rule matched. An alert is not an accusation — most alerts turn out to be innocent. These are called false positives, and a good monitoring programme is constantly tuned to reduce them without missing real cases.
An analyst investigates. They look at the customer, their history, the counterparties and anything else relevant, and write down what they found.
The case is escalated if needed — to a senior analyst, then to the MLRO (Money Laundering Reporting Officer), the person legally responsible for deciding whether to report.
A decision is recorded. Innocent, suspicious but no report needed, or suspicious and reported.
A report is filed if the MLRO decides the activity is suspicious. This is a Suspicious Transaction Report (STR) — called a SAR, Suspicious Activity Report, in some countries.

Cash transaction reports

Separately from suspicion, many countries require a Cash Transaction Report (CTR) for any cash transaction above a set amount, whether or not anything looks wrong. SpeculaPro’s rule A2 flags CTR candidates; the threshold must come from current FIC guidance.