MSB Transaction Monitoring: Who Should Review Daily

Introduction

Many UK MSBs struggle to decide who should review transaction-monitoring output each day without overloading the MLRO or leaving alerts unworked. Daily output should normally be reviewed by a trained, designated compliance or AML reviewer. The MLRO stays accountable for escalation, suspicious activity decisions and the effectiveness of the framework.

"Daily review" does not mean someone manually examines every transaction. The regulations require ongoing, risk-sensitive scrutiny rather than a fixed universal daily timer.

Yet the 2025 National Risk Assessment still rates MSB money laundering risk as high, particularly for remittance and currency exchange.

This guide sets out who owns what, how a daily workflow runs, and when manual, automated or hybrid monitoring suits a UK MSB. It is general information, not legal advice. Check current rules before acting.

Key Takeaways

• Name a trained daily reviewer and a backup; avoid informal ownership.
• Operations supplies context; complex or high-risk cases go to compliance and the MLRO.
• Automation prioritises alerts; people investigate, decide and escalate.
• Record who reviewed what, when, on what evidence, and why it was closed or escalated.

What Daily MSB Transaction Monitoring Actually Requires

Daily monitoring is not manual review of every transaction

Regulation 28(11) of the Money Laundering Regulations 2017 requires ongoing monitoring. That includes scrutiny of transactions to check they are consistent with what the firm knows about the customer, their business and risk profile.

HMRC says reviews must follow a risk-based approach. JMLSG says higher-risk relationships generally need more frequent or intensive monitoring.

None of those sources sets a universal daily interval. Your documented risk assessment justifies your frequency and depth. Factors include:

• Transaction volume and customer types
• Products and delivery channels
• Countries and corridors served
• Agent network
• Known typologies

Different outputs feed the daily queue: automated rules, exception reports, risk alerts and screening hits. Only some need a human investigation, and that is where reviewer time should go.

What should be examined during a daily review?

A reviewer compares the activity against:

• Customer risk profile and expected activity
• Transaction value, frequency and velocity
• Counterparties, destinations and purpose of funds
• Linked accounts and previous alerts
• Changes in behaviour

HMRC's 2026 MSB risk assessment flags patterns such as:

• Unusually large or complex transactions
• Payments inconsistent with the customer's business
• High-risk jurisdictions
• Multiple customers sharing an address or telephone number
• Inadequate agent scrutiny

Rapid movement of funds and unusual remittance corridors fit these patterns. Tailor further scenarios, such as structuring or third-party funding, to your own risk assessment.

Keep the controls distinct. Transaction monitoring, sanctions screening, customer due diligence and fraud controls have different purposes. Sanctions screening does not replace ongoing monitoring. Their outputs should meet in one case review so the reviewer sees the full picture.

What evidence must the reviewer leave behind?

Each case record should show:

• The alert and the data sources checked
• Analysis performed and any explanation obtained
• Decision, reviewer identity, date and time
• Follow-up action or escalation

Outcomes differ. You can:

• Close with a documented rationale
• Request further information
• Apply enhanced monitoring
• Escalate to the MLRO, who considers whether a SAR is needed

Regulation 40 requires transaction records to be kept for at least five years after the relevant transaction or relationship ends.

Restrict access to case files. Under POCA section 333A, disclosures likely to prejudice an investigation are prohibited, so staff must not discuss a SAR with the customer or third parties. UKFIU guidance says the same.

Which UK obligations shape the daily review?

The main sources are the MLRs 2017, the FCA Handbook (including SYSC 6.3 for FCA-regulated firms), HMRC's MSB guidance, and NCA/UKFIU SAR guidance. Which apply depends on your supervisory status. Remittance firms may sit under both HMRC and FCA regimes, so confirm yours.

Regulation 21 requires, where appropriate to size and nature, a board-level or senior-management officer and a nominated officer, with the supervisor notified within 14 days. It does not prescribe a job title for clearing daily alerts.

Who Should Review Daily?

First-line operations: useful for facts, not final ownership

FCA guidance says customer-facing staff should engage with ongoing monitoring but should not control it. Trained operations or payments staff can:

• Spot obvious exceptions
• Reconcile transaction details
• Confirm operational facts
• Supply customer or agent context

They should not close complex or high-risk alerts just because a payment looks operationally plausible. Move a case to compliance when it involves unexplained activity, higher-risk geography, repeat alerts or anything that looks suspicious.

AML or compliance analyst: the normal daily alert reviewer

The analyst owns the daily queue. They apply documented procedures, assess customer and transaction context, and record a defensible outcome. They need:

• Knowledge of MSB products and corridors
• Familiarity with financial-crime typologies
• Understanding of the customer-risk methodology and internal systems
• Clear evidence standards and escalation procedures

Give them independence, system access, time, supervision and authority to pause or escalate. Measuring them only on queue-clearing speed invites poor decisions.

An FCA supervisory notice to a payment and e-money institution (not an MSB finding) recorded 4,968 alerts marked "not suspicious" in one file, 3,294 without documented rationale. That is what speed-driven closure looks like.

MLRO: accountable for escalation and reporting

The MLRO oversees the monitoring framework, handles material escalations, decides whether to submit a SAR, and manages confidentiality and tipping-off risk. FCA guidance expects sufficient resources, seniority, independence and a direct line to the board.

The MLRO need not personally review every low-risk alert. They do need visibility of higher-risk cases, reporting decisions, quality issues and emerging patterns. Involve them for:

• Unexplained high-risk activity or suspected criminality
• Repeat alerts
• Senior or connected customers
• Unusual agent behaviour
• Law-enforcement requests
• A potential exit decision

Senior management and the board: oversight, not routine cases

Management sets risk appetite, funds adequate staff and technology, reads meaningful monitoring metrics, and responds to control weaknesses. Executives should not swap personal familiarity with a customer for documented review, especially where they have a commercial interest in releasing funds or keeping the account.

Small teams and outsourced support: create named accountability

A workable small-MSB model:

• One named daily reviewer and a trained backup
• A clearly identified MLRO or escalation owner
• Documented handover arrangements
• Independent sample checking of closed cases

Where internal seniority or continuity is thin, an MSB can bring in external compliance leadership. Fraxtional provides fractional and interim MLRO services under UK, EU and Canadian frameworks, with Director-led oversight.

Outsourcing does not transfer accountability. The MSB still approves its framework, gives the provider proper access, supervises the arrangement and keeps final responsibility. SYSC 8 sets oversight and access expectations for FCA-regulated firms.

How to Design a Daily Review Workflow

Start with queue and data-integrity checks

Before reviewing any case, confirm that transaction feeds, customer-risk data, screening results, alert rules and exception reports are complete. Look for:

• System outages and delayed feeds
• Missing fields and duplicated alerts
• Rule changes and watchlist updates
• Unresolved issues from the previous business day

Triage by risk and urgency

Do not work strictly first-in, first-out. Prioritise by documented risk factors:

• Potential sanctions concerns
• Suspected fraud
• Rapid movement of funds
• Vulnerable customers
• Law-enforcement requests
• Material agent risks

Define risk tiers, service levels, holds and escalation routes in your own procedures. Do not borrow a generic alert-clearance deadline; set time limits that match your risk profile.

Investigate in context

1. Review the customer profile and history.
2. Compare activity with expected behaviour.
3. Examine linked transactions and counterparties.
4. Assess geography and product risk.
5. Obtain further information where permitted and appropriate.

Record evidence that confirms and contradicts the concern. A threshold breach alone, or an unexplained customer statement, is not enough. Possible outcomes include:

• Close with rationale
• Request information
• Enhanced monitoring
• Restrict or hold under approved procedures
• Escalate

Escalate suspicious or unresolved cases

Escalate cases that cannot reasonably be explained, show a pattern, carry elevated risk, or meet internal criteria. The MLRO evaluates SAR considerations. Preserve records, hand over clearly, and document any decision not to escalate so it can be reviewed later. Never tip off the customer or unauthorised parties.

Close the day with ageing and handover controls

Check unreviewed alerts, overdue investigations, data issues, open escalations and pending customer information. Management reports should expose backlogs rather than reward fast closure. Document handovers for nights, weekends, holidays and multi-jurisdiction cover, with a named owner for urgent cases.

Manual, Automated, or Hybrid Monitoring?

FCA guidance covers manual and automated monitoring alike, and accepts that small firms may use credible manual procedures.

Method	Works when	Watch for
Manual	Low volume, simple risks, trained staff	Fatigue, spreadsheet errors, key-person dependency, weak audit trail
Automated	Larger or complex flows	Rule tuning, data quality, false positives, governance of configuration
Hybrid	Most growing MSBs	Clear split between detection and judgement

Automation applies rules consistently, spots velocity and linked activity, prioritises alerts and keeps case histories. The FCA notes that many automated alerts are false alarms, and expects firms to understand system limitations and justify threshold rationale.

A hybrid model is often the practical answer. Technology detects and prioritises, trained reviewers investigate and document, and the MLRO oversees material escalations and reporting decisions. Tie the choice to your risk assessment and revisit it when you add products, channels, agents, countries, customer types or materially different volumes.

Governance, Quality Assurance, and Capacity

Competence, independence, and cover

Build competence and cover into the operating model:

• Role-based and refresher training
• Written procedures and access permissions
• Conflict-of-interest controls
• Supervision plus backup for absences and out-of-hours activity

Whoever benefits commercially from releasing or retaining a transaction should never be the only person deciding a complex alert is safe to close.

Quality assurance and independent testing

Sample closed alerts, escalations and non-escalations regularly. Test for:

• Missed typologies and inconsistent outcomes
• Excessive false positives and stale rules
• Incomplete data
• Failures to follow escalation or confidentiality procedures

Daily review is operational. Second-line QA and independent audit are separate.

Regulation 21 requires an independent audit function where appropriate to the firm’s size and nature. Independent reviews, such as Fraxtional’s audit services, can evaluate monitoring effectiveness and produce board-ready findings.

Metrics that show whether the model works

Track the signals that show whether capacity and controls keep pace with risk:

• Alert volumes, ageing and unresolved cases
• Escalation rates, repeat alerts and SAR outcomes
• Review timeliness and QA findings
• System exceptions and staffing capacity

No single metric proves effectiveness, and FCA guidance sets no numeric target.

Revisit staffing or design after new products or corridors, changes in customer risk, bank or regulator feedback, recurring backlogs, data failures or investigation patterns.

The right daily reviewer has the training and authority to make or escalate a risk-based decision, backed by MLRO oversight and a documented control framework.

Frequently Asked Questions

Who should review MSB transactions each day?

A trained AML or compliance reviewer is the usual daily owner. Operations supplies context, and the MLRO oversees significant escalations and SAR decisions.

Does every transaction need a manual daily review?

No. Automated monitoring can screen transactions, while people investigate alerts. Your risk assessment and procedures should justify the frequency and depth.

Can operations staff review transaction monitoring alerts?

Trained operations staff can do first-line checks and gather facts. Complex, high-risk or potentially suspicious cases belong with compliance or the MLRO.

What does the MLRO do in daily transaction monitoring?

They oversee the framework, review material escalations, decide on SARs, protect confidentiality and drive remediation of control weaknesses.

How often should an MSB review transaction monitoring alerts?

It depends on risk, transaction flow, alert type and your documented procedures. No universal rule applies.

Should small MSBs use automated transaction monitoring?

Manual, automated or hybrid approaches can all work, depending on volume and complexity. Every option still needs named ownership, trained reviewers, escalation controls and an auditable record.