Secretary of State Business Search for KYB: What It Proves
A Secretary of State search proves an entity exists and its status, not who owns it. What each state shows, good standing, agents, and BOI.
TL;DR: The AML compliance KPIs that matter measure whether alerts turn into useful reports, how fast decisions are made against the SAR clock, and whether closed work holds up under review. We track 12 of them across four groups: outcome, speed, quality, and coverage and cost. Volume alone says little: in a Bank Policy Institute study, large banks reviewed roughly 16 million alerts in 2017 and filed over 640,000 SARs, and a median of 4% of those SARs drew a follow-up inquiry from law enforcement.
Most BSA Dashboards Measure Effort
A typical BSA dashboard reports alerts generated, alerts closed, SARs filed, and analyst headcount. Those numbers describe how busy the team was. They do not say whether the program found anything, whether it found it in time, or whether the closures would survive an examiner pulling a sample.
That gap is now a regulatory question as well as an operational one. In April 2026 FinCEN published a proposed rule to reform AML/CFT program requirements that, in FinCEN's words, aims to ensure institutions maintain effective programs that "lead to more effective outcomes." We covered the details in our explainer on FinCEN's effectiveness-based AML rule. The practical consequence for a BSA officer is simple: an examiner who is asked to judge effectiveness will want metrics that show it, and alert counts will not.
The Bank Policy Institute's Getting to Effectiveness study makes the point with numbers. Nineteen member banks employed over 14,000 people and spent approximately $2.4 billion on BSA/AML compliance, reviewed about 16 million alerts in 2017, and reported that a median of 4% of SARs warranted law enforcement follow-up. Effort was enormous. Measured outcome was thin. The broader case for measuring outcomes instead of throughput is one we have made before. This piece is the working list.
The 12 metrics below are grouped by the question each one answers. None of them works alone. A falling false positive rate with a rising QA defect rate is not progress.
Outcome Metrics: Is the Program Finding Anything?
1. Alert-to-SAR conversion rate
Alert-to-SAR conversion is the share of alerts, or of escalated cases, that end in a SAR filing. Track it at two levels: alerts to cases, and cases to SARs. The first tells you how much of the alert stream deserves investigation. The second tells you whether escalation judgment is calibrated. Capgemini Invent's KYC and AML benchmark study of European banks found SARs as a share of transaction monitoring alerts to be "very heterogenous" across participants, which is why your own trend line matters more than an industry average. A sudden drop in conversion usually means a new rule is firing on noise. A sudden rise can mean a real typology is emerging, or that escalation standards loosened.
2. False positive rate
The false positive rate is the share of alerts closed with no suspicious finding. The same Capgemini study reported an average transaction monitoring false positive ratio of 92%. Report it per scenario and per customer segment, never only in aggregate, because one structuring rule at 99% can hide inside a portfolio average. Treat it as a cost signal, not a target. Driving it toward zero by raising thresholds just moves risk below the line.
3. Rule productivity
Rule productivity is the number of SARs, or productive cases, each scenario produces per hundred alerts. It is the metric that tells you which rules to tune, retire, or keep. A rule that has fired 4,000 times in a year without a single escalation is consuming analyst hours for nothing, and a rule with high productivity but low volume may deserve a lower threshold. Productivity data feeds directly into transaction monitoring rule tuning, and any change should be tested with backtesting or shadow mode before it goes live.
Speed Metrics: Are Decisions Made in Time?
4. Alert aging and backlog
Alert aging measures how long open alerts have been waiting, bucketed by age, for example under 10 days, 10 to 30, and over 30. Backlog is the count of alerts past your internal service level. The FFIEC BSA/AML Examination Manual says the 30-day SAR period does not begin when a system flags a transaction. It begins once an appropriate review determines the activity is suspicious, and that review "should be completed in a reasonable period of time." An aging alert queue is exactly what makes "reasonable" hard to defend. Report the oldest alert in the queue alongside the average, because averages hide the cases examiners find.
5. SAR filing timeliness
SAR filing timeliness is the share of SARs filed within the regulatory window. Under 31 CFR 1020.320, a bank files no later than 30 calendar days after initial detection, with one additional 30 days when no suspect was identified, and never later than day 60. Track three numbers: percent filed on time, median days from determination to filing, and the count of filings that used the 60-day extension. That last number deserves scrutiny. A team that leans on the extension when a suspect was in fact known is creating a late-filing finding.
6. Handle time per alert
Handle time is the analyst time spent per alert, measured by alert type. Pair it with outcome. A drop in handle time is good news only if conversion and QA results hold steady. A rise in handle time on one alert type often points to missing data, such as an analyst re-pulling the same customer profile from three systems for every alert. Handle time is also the input that makes capacity planning honest: alerts per month multiplied by minutes per alert tells you how many analysts the queue actually needs.
Quality Metrics: Will the Work Hold Up?
7. QA defect rate
QA defect rate is the share of sampled closed alerts and cases where a reviewer found an error, split into critical defects (wrong disposition, missed SAR) and non-critical ones (incomplete documentation). This is the counterweight to every speed metric above. How to design the sample and score the work is covered in our guide to building an AML quality assurance program. For the dashboard, the point is to report the critical defect rate separately and by analyst, team, and alert type, so a problem is traced to its source.
8. Auto-closure rate with QA sampling
Auto-closure rate is the share of alerts closed without an analyst decision, whether by rules-based suppression or by an AI agent. It is only a meaningful number when reported next to the QA defect rate on that same auto-closed population. An auto-closure rate of 60% with an unknown error rate is a liability. The same rate with a sampled critical defect rate below the human baseline is evidence. If an automated process is closing alerts, the sample has to cover it, and the reasoning behind each closure has to be readable by a reviewer.
9. Exam and audit findings
Track the count of open findings from examinations, independent testing, and internal audit, their severity, and days to remediation. Repeat findings carry the most weight. A finding that reappears in the next exam cycle tells a board more about the program than any operational metric. For institutions heading into an exam, our BSA exam preparation guide covers what examiners typically request.
Coverage and Cost Metrics: Is the Program Complete and Sustainable?
10. CDD refresh overdue rate
The CDD refresh overdue rate is the share of customers whose periodic or event-driven review is past due, broken out by risk rating. Overdue high-risk reviews are the number to watch, because a stale profile undermines everything downstream: monitoring compares activity against an expected profile that may be years old. The refresh schedule itself should follow your customer risk rating methodology, and institutions moving toward perpetual KYC should also track how many refreshes were triggered by events rather than calendar dates.
11. Screening hit rate
Screening hit rate is the share of screened names, customers or payments, that generate a potential match, alongside the true match rate. The gap between the two is the screening team's workload. BPI's study found that sanctions screening at participating banks produced true matches at an overall median of 0.00004%. A high hit rate with a near-zero true match rate usually points to name-matching configuration, not risk, which is the subject of our piece on sanctions screening name matching.
12. Cost per alert
Cost per alert is total alert review cost, including people, tooling, and outsourcing, divided by alerts reviewed. Cost per SAR is the more honest companion, since it charges the whole review effort to the reports that came out of it. These two numbers turn the metrics above into a budget conversation. A program that halves cost per alert but doubles the false positive rate has not become cheaper. It has moved the cost into the queue.
The 12 Metrics at a Glance
What Changes When Agents Do the First Review
We built Sphinx's agents to review alerts the way analysts do, and that changes which of these metrics move and which ones need more attention. Handle time and alert aging fall first. Across our deployments we see 98% of cases resolved same-day and six-month backlogs cleared in days. Those are speed metrics, and on their own they prove nothing about quality.
That is why we treat metrics 7 and 8 as the real test. When an agent closes an alert, the QA sample has to include that closure, and the reviewer has to be able to read the reasoning, the data the agent checked, and why it decided what it decided. If a team cannot answer "what is the critical defect rate on agent-closed alerts," it has not measured automation. It has assumed it.
Some metrics automation does not touch. Rule productivity still depends on scenario design. CDD overdue rates depend on whether customers respond to outreach. Exam findings depend on governance. A program that automates review without fixing those will report faster numbers on the same underlying gaps.
The useful dashboard is short. Twelve metrics, each read next to its counterweight, reported by segment and trended over time. That is the evidence an effectiveness standard asks for, and most of it already sits in your case management system waiting to be counted.
Frequently Asked Questions
What is a good alert-to-SAR conversion rate?
No regulator publishes a benchmark, and peer rates vary widely: Capgemini Invent's benchmark study described SARs as a share of transaction monitoring alerts as very heterogeneous across banks. The more useful measure is your own rate trended by scenario and segment, with explanations for sharp moves in either direction.
When does the 30-day SAR clock start?
Under 31 CFR 1020.320 and the FFIEC BSA/AML Examination Manual, the clock starts at initial detection, which means the point at which a review determines the activity is suspicious, not the moment a system generates an alert. The review itself still has to be completed in a reasonable period of time, which is why alert aging matters.
How should AML KPIs be reported to the board?
Boards need a small set of trended metrics with context: SAR filing timeliness, alert backlog and oldest open alert, critical QA defect rate, overdue high-risk CDD reviews, and open exam findings. Each should come with a short explanation of what changed and what the team is doing about it.
Does a lower false positive rate mean a better AML program?
Not by itself. A false positive rate can fall because thresholds were raised and real activity now sits below the line. Read it next to alert-to-SAR conversion, rule productivity, and QA results, and validate threshold changes with below-the-line testing.
How do you measure the quality of automated alert closures?
Report the auto-closure rate alongside a QA defect rate calculated on a sample of the auto-closed population, and compare it with the human baseline. The automated decision should leave a documented rationale a reviewer can check, or the sample cannot be scored.
