TL;DR: A compliance platform facing high transaction volume fails in the queue: alerts age, analyst minutes go to noise, and the record of a closed case gets thin. Everest Group's December 2025 survey of 50 tier-1 banks found that false positives account for 85–90% of transaction-monitoring alerts, and only 2–4% are actionable for escalation or a SAR. The test that matters is peak-day queue age, minutes per disposition, and whether a closed alert can be reconstructed without the vendor in the room.
The Platform Is the Queue
A compliance platform facing high transaction volume ingests payments, screening hits, and onboarding events, turns them into work, and stores how that work was closed. High volume is the point at which alert arrivals exceed the team's same-day disposition capacity. Above that line, the architecture has to decide what a person sees, what a documented control closes, and what evidence remains when someone asks six months later.
Transaction monitoring compares activity with a customer profile and emits an alert when the two diverge. A platform at volume then has to order the queue so the oldest and riskiest items are worked first, assemble enough context for a disposition, and keep a record that still reads cleanly when an examiner asks why a specific alert was closed.
The inherited design still assumes a person sees every hit. That design holds at a book of a few hundred alerts a week. It folds at a payments firm, an exchange, or a retail bank whose scenarios produce thousands of alerts a day. The FCA's Financial Crime Guide describes the pattern directly: large institutions flag fund movements that exceed rule-driven thresholds for human scrutiny. The same section names the poor-practice twin. Senior management expect automated monitoring to achieve more than it feasibly can, while manual scrutiny of alerts lacks resources and is unable to cope.
Five Things That Break as the Count Rises
Detection keeps producing alerts as volume rises. What gives way is the path from an alert to a defensible close.
Queue latency
An alert reviewed on day nine is a weaker control than the same alert reviewed the day it fired. Ask for time-to-first-touch and time-to-close at the 50th, 90th, and 99th percentile, on a day when volume matches the customer's peak. Everest Group's December 2025 report, drawn from a survey of 50 tier-1 banks, found a 95% median for on-time level-1 closure, and noted that the rate declines when alert volumes rise. A healthy median can hide a tail of alerts that age out of any useful investigation window.
Rule noise
The same Everest Group survey found that false positives account for 85–90% of total alerts, and that only 2–4% of alerts are actionable for further escalation and SAR filing. On those numbers, a high alert count is mostly work that will close as nothing. Analysts learn the shape of the obvious false hit and apply the same thin review to the rest of the queue, including the small share that deserved a case. Tuning that suppresses volume, with no measured change in how many alerts become a real investigation, moves the miss somewhere quieter. Read the false-positive share and the alert-to-case rate together, before and after any rule change.
Analyst throughput
Everest Group put average handling time at 30–45 minutes for a level-1 review and over 200 minutes once a case reaches level 3. The report also found that 10–15% of alerts escalate from level 1 to level 2, and a further 8–12% reach level 3. Two thousand level-1 alerts at 30 minutes each, the bottom of that range, is 1,000 analyst-hours: a 25-person team for a full week, on a single day's level-1 work, before escalation. Headcount does not follow that curve. A platform that cannot show minutes per disposition, by alert type, is asking the institution to hire its way out of the architecture.
Audit reconstruction
Closing an alert takes one sitting. Reconstructing it is what examiners test. A record that holds up names the data pulled, the rule or policy version applied, the decision, the person or system that made it, and any override with a reason. Screenshots in a shared drive do not survive a vendor change, and a narrative written from memory three weeks later does not either. At a few dozen alerts a day, someone may still remember the odd case. At a few thousand, that memory is gone by Thursday, and the exam question is simple: show this alert, show what the team knew, show why it was not filed.
A human on every hit
Policy should keep a person on the high-risk tail. Product design is what puts a person on everything else: one analyst, one alert, one write-up, with bulk disposition treated as a shortcut and auto-close left as a toggle. The FCA's guide allows machine learning and other tools to detect suspicious activity or to triage alerts, and it asks firms that decide which alerts receive manual attention to justify that choice inside the overall monitoring approach. When a rule set is retired, the guide points firms at the intelligence value of the alerts and the proportion of false positives. The workable standard is a staffed manual queue plus a documented reason for whatever never reaches it.
Confidence in the Installed Systems Has Already Dropped
PwC's EMEA AML Survey 2026, covering 531 financial institutions, found that confidence in transaction monitoring had roughly halved since 2024, from as high as 75% to below 30%. Close to half of respondents planned a group-level or local review within 24 months. The institutions that already own a monitoring system are the ones calling it unfit. The problem sits inside a live control.
Payment volume, instant rails, and nested fintech programs raised events per customer without a matching rise in investigators. The FCA lists, as poor practice, a rule-driven system the firm cannot explain, and transactions dropped from monitoring because a feeder system changed. Real-time AML monitoring shortens the clock between a payment and an alert. The clock between an alert and a close stays where it was. A faster feed into the same noisy queue fills that queue sooner.
Adding another console splits the work. A second monitoring tool, a separate screening queue, and a case system that receives a subset of both create three places where alerts can age, and the audit trail splits with them. A buyer comparing transaction monitoring software should test "we integrate with your case system" on one closed alert: open the case, find the data the rule saw, and read the disposition without calling the vendor.
What to Test on a Peak Week
Evaluation starts with a production-shaped week: realistically noisy activity, including the scenarios that already over-fire, run at the arrival rate of a busy day. The table is the scorecard. Each row turns one failure above into a measurement a buyer can take during the pilot.
Three questions sit behind the scorecard. The first is where the disposition lives. API-first compliance software matters when the institution's own case system is the system of record. If every close has to happen inside the vendor console, analysts inherit a second queue. The integration test is a disposition written back, reasoning attached, into the system an examiner will be shown.
The second is the month volume doubles. Ask whether detection stays on time while disposition slips, and whether the 99th percentile of queue age blows out while the average still looks calm. A platform that cannot describe its behavior at twice the contracted volume has not been run there. Contracted capacity and demonstrated capacity are different facts.
The third is who owns the policy when behavior changes. Thresholds, suppression lists, and auto-close rules need an owner, a version, and a backtest against history before they reach production. A buyer comparing compliance software for financial services should ask to see a scenario retired: this used to fire, it no longer does, show the evidence. Sampling makes auto-close defensible. By alert type and risk tier, a set share of machine-closed items should go back to a person, and that sample rate should sit in the same record as the close.
Where Sphinx Fits
Sphinx works the queue inside the systems analysts already use. Agents gather the data a procedure calls for, apply the institution's policy, and write the disposition back with the reasoning attached, so a closed alert can be reconstructed from the record. Across customers including Equals Money, Alviere, and Conduit, the production record is 87% fewer false positives, an 80% reduction in case review time, and 98% of cases resolved the same day, including six-month backlogs cleared in days. The high-risk tail stays with a person. The rest of the queue clears.
Frequently Asked Questions
What is a high-volume compliance platform?
A high-volume compliance platform turns transaction-monitoring alerts, screening hits, and related cases into ordered work and a reconstructable decision. High volume means alert arrivals that exceed what the team can close the same day. The proof is a timely disposition once that line is crossed, including a record of anything a person never saw.
What false-positive rate should a buyer treat as a warning?
Everest Group's December 2025 survey of 50 tier-1 banks found that false positives account for 85–90% of transaction-monitoring alerts, with only 2–4% actionable for escalation or a SAR. A rate in that band describes the rule-based installed base. Ask what share of alerts become a useful case after tuning, and whether review minutes fall with the noise.
How do you know a platform will hold when alert volume doubles?
Run a peak week and read time-to-close at the 99th percentile next to the average. Everest Group reported a 95% median for on-time level-1 closure that declines when volumes rise, which is the gap an average conceals. Ask which work auto-closes under a versioned policy, which is sampled back to a person, and which still requires an analyst when the queue doubles for a month.
Can alerts be closed without a human and still satisfy an examiner?
The FCA's Financial Crime Guide treats automated triage, including tools that decide which alerts receive manual attention, as a choice the firm has to justify inside its overall monitoring approach. Poor practice is a control framework where manual scrutiny lacks resources and cannot cope. A defensible machine close names the policy version, the data used, the decision, and a sample of those closes that a person re-reviews.
Does real-time detection solve a volume problem?
Real-time detection shortens the time between a payment and an alert. It leaves the time between an alert and a defensible close where it was. A faster feed into a queue that already takes 30–45 minutes per level-1 review, the range Everest Group reported, fills the backlog sooner. Volume is a disposition problem. Detection speed is a separate control.
.png)
