Behavioural Analytics in AML: Detecting Suspicious Patterns Beyond Transactions
A Report by CYS Global Remit Legal & Compliance Office
Part 2: Understanding Behavioural Analytics in an AML Context
Introduction
Behavioural analytics is often discussed alongside advanced analytics, machine learning or artificial intelligence, which can make the concept seem abstract or overly technical. In practice, however, behavioural analytics in AML is grounded in a simple principle:
understanding how customers behave over time and identifying when that behaviour changes in ways that may signal financial crime risk.
Most compliance teams already do a version of this informally. An experienced analyst who notices that a long-standing customer has suddenly started behaving differently is applying behavioural thinking. Analytics simply makes that judgement consistent, scalable and auditable.
For compliance professionals, demystifying this concept is key to using it effectively.
What Are Behavioural Analytics in AML?
At its core, behavioural analytics involves three activities:
Profiling normal customer behaviour based on historical activity, so that each customer has a reference point rather than a generic threshold
Monitoring deviations from established behavioural baselines, whether against the customer’s own history or that of comparable customers
Contextualising risk by combining behavioural signals with transactional data, so that alerts reflect the full picture rather than a single data point
Unlike static rules, behavioural models are dynamic. They evolve as customer activity evolves, so the baseline keeps pace with genuine changes in how a customer operates. A business that expands into a new market, for example, should not be flagged indefinitely for behaviour that has since become its norm.
Key Behavioural Dimensions Monitored
In cross-border payment settings, behavioural analytics may assess four broad areas:
Velocity patterns: sudden increases in transaction frequency, or changes in timing, such as activity shifting to unusual hours or clustering within short windows
Geographical behaviour: new or unusual corridors, counterparties or routing behaviour, particularly where these do not fit the customer’s stated purpose or profile
Account usage behaviour: changes in funding sources, payout destinations or device access, which may indicate account takeover, third-party control or the use of mule accounts
Operational behaviour: interaction patterns with the platform, such as a rapid onboarding-to-transaction timeline
Importantly, none of these behaviours is inherently suspicious on its own. Customers change jobs, relocate, travel and grow their businesses. Risk emerges when patterns are inconsistent, unexplained or misaligned with a customer’s profile, and especially when several signals appear together.
Behavioural Analytics vs. Traditional Red Flags
Traditional red flags ask a rule-based question:
Does this transaction breach a predefined rule?
Behavioural analytics asks a contextual one:
Does this behaviour align with what we know about this customer and similar customers?
The two approaches are complementary rather than competing. Rules remain valuable for clear-cut typologies and regulatory expectations, while behavioural analytics adds depth where rules alone are too blunt.
This distinction is especially valuable in environments where legitimate businesses have fluctuating cross-border flows that may otherwise appear anomalous. A fixed threshold may flag a seasonal remittance peak as unusual, whereas a behavioural lens recognises it as part of the customer’s normal pattern. The practical benefits are fewer false positives, more focused investigations and a stronger evidence base when a genuine concern does arise.
Conclusion
Behavioural analytics brings nuance to AML risk detection. By focusing on patterns, not just transactions, it allows compliance teams to better distinguish between legitimate complexity and genuine risk. Understanding this conceptual shift is the first step toward meaningful implementation.
