False Positives
A false positive is an alert or a decision that flags legitimate activity as suspicious: a transaction-monitoring alert on an ordinary payment, a sanctions hit on a namesake, a fraud rule that declines a real customer. In financial crime compliance most alerts are false positives, and the cost of working them is one of the largest operating costs a fintech carries.
- Also known as
- False alerts, False declines
- Used at
- anti-money-laundering transaction monitoring, sanctions and PEP screening, fraud decisioning at authorisation
- Binding
- no rule sets a rate, but regulators expect a tuned system and a documented reason for every threshold
- Typical rate
- 90–95% of AML alerts at a typical bank are false positives, and rates above 98% are not unusual; fraud systems decline a few per cent of good transactions
- Typical cost
- 20–40 minutes of analyst time per alert; in card fraud, the revenue lost on a wrongly declined sale plus the customer who does not come back
- Parties
- the compliance and fraud teams who work the alerts, the customers who are delayed or declined, and the regulator who reads the backlog
How false positives work in practice
Every screening system trades one error for another. A rule tight enough to catch all laundering flags most ordinary activity; a rule loose enough to leave customers alone misses cases. Regulators punish the missed case, so systems are tuned tight, and the false positives pile up in a queue that analysts clear one at a time. The queue is the problem. A backlog of unreviewed alerts is itself a regulatory finding, and it is what enforcement actions against fast-growing fintechs most often describe.
Reducing the rate is not a matter of loosening rules. It is segmentation — thresholds set for the customer's expected behaviour rather than one figure for everyone — better data, so that a screening hit on a common name can be cleared by date of birth rather than by an analyst, and models that rank alerts so the ones most likely to be real are worked first. Each change to a threshold needs a documented test that it does not lower detection.
In an acquisition, the false-positive rate is read two ways. A high rate with a cleared queue means a costly but controlled operation; a high rate with a backlog is a liability the buyer inherits. The operating model — how many analysts per thousand alerts, and whether the system's tuning has ever been validated — tells the buyer what it will cost to run.
Example
A payments company generates 10,000 monitoring alerts a month, of which 200 lead to a suspicious activity report: a 98% false-positive rate. At 30 minutes an alert that is 4,900 analyst hours — 30 full-time analysts at about £45,000 each, £1.35m a year, to find 200 cases. A segmentation project cuts alerts to 5,500 a month while the reports found stay at 195, and the same team clears the queue with capacity to spare. A buyer looking at the company before the project would have priced the 4,000-alert backlog as a remediation cost; after it, as a functioning control.
Common mistakes
- One threshold for every customer, so the corporate treasurer and the student trip the same rule. - Measuring the team on alerts closed rather than on cases found, which rewards fast closure of everything. - Loosening rules to shrink the queue without testing what detection was lost. - Ignoring false declines in fraud: a declined good customer is a lost customer, and the cost never appears on the fraud team's report. - In diligence, reading the alert volume without the backlog age.