The Transaction Monitoring Alerts page is the working queue for transaction monitoring tickets — alerts automatically generated when EFI's risk engine detects suspicious patterns in your customers' transaction activity. Use it to triage new alerts, assign them to investigators, and progress them through the case management workflow.

To open it, go to Alerts in the top navigation and choose the Transaction monitoring alerts tab. The tab is shown to institutions with the Monitoring product, to users holding the Transaction monitoring permission.

Transaction monitoring alerts overview

What's on this page

The page is split into three areas:

  • Severity summary cards at the top — a snapshot of how much open work exists, grouped by severity level. The numbers count every open alert, whatever its age.
  • Alerts table — every open alert in the monitoring queue, with its #, Title, Status, Assigned to, Category, Comments, Created at and Updated at. Closed alerts are hidden by default; the count above the table says how many there are. Each row links to the underlying ticket, where the full investigation happens.
  • Header links to the related Dashboard (trend and category analytics for monitoring), Jobs (the history of every monitoring run) and Settings (where the rules that generate these alerts are configured).

Tick rows to assign them from the list: pick the users and click Assign (N), or click assign yourself. Comments, status changes and closure happen on the ticket.

Triaging by severity

The severity cards double as filters. Click High Severity, Medium Severity, or Low Severity to narrow the table to just that band. The active card stays highlighted and the URL updates with a severity parameter, so you can share or bookmark a filtered view. Click the same card again, or click Total Open, to clear the filter.

High severity filter applied

Severity is set by the rule that produced the alert: the findings it escalates are High, every other finding carries the rule's Default Severity from the Settings page (Medium unless you change it):

Rule High Default Severity
Structuring Total at 95% or more of the reporting threshold 80–95% of it (a total under 80% is Low, possible only when Aggregate Minimum is set lower)
Velocity Abuse More than twice Max Transactions / Hour within one hour Any other breach
High Risk Jurisdictions Country on its High list Country on its Medium list (a country on its Low list is Low)
Invoice Manipulation Over- or under-invoicing Statistical deviation from the pair's own history
Party Clustering Round-tripping, suspicious network Repeated transfers
Sanctions Circumvention Neighbour routing, near-identical name Corridor shift
Shell Companies Score at least 3 above Alert Threshold Score at the threshold or above
Tax Havens Amount at least twice its currency's Amount Threshold and the ratio reached Any other hit
Round Amount Ratio of 90% or more and at least twice Frequency Threshold round transactions Any other hit
Conveyance Risk Chokepoint hit Corridor country only

A rule's Default Severity, and High Risk Jurisdictions' three country lists, are set on the Settings page reached from this page's header.

Reading an alert title

Alert titles are generated by the rule engine as [rule_code] one-line summary; the summary names the party and the figures that triggered the rule. The bracketed prefix tells you which monitoring rule fired:

  • round_amount — disproportionate share of round-number transactions
  • sanctions_circumvention — parties with a sanctioned-country history now routing through a neighbour, names near-identical to such a party, or new corridors next to a sanctioned country
  • velocity_abuse — too many transactions in too little time
  • high_risk_jurisdictions — transactions involving the countries on the module's High, Medium or Low list
  • tax_havens — concentration of payments to known tax havens
  • party_clustering — repeated transfers between the same parties or unusual networks
  • structuring — multiple transactions kept just below a reporting threshold
  • invoice_manipulation — trade values inconsistent with expected ranges
  • shell_companies — cumulative shell-company indicators (jurisdiction, flow-through, round amounts, generic names)
  • conveyance_risk — Central Asia–China corridor geography combined with dual-use goods

The same code is shown more readably in the Category column.

Narrowing the queue with filters

Click Show Filters to open the filter panel on the right. Filters apply on top of any active severity selection. To jump straight to one alert, type its number into the Search by ID box next to the filters and press Enter — an ID search finds the alert even when it is closed.

Filters panel

Filter When to use it
Title / Description Free-text search inside the alert title or its description. Useful for finding all alerts mentioning a specific party name or country code.
Status All Statuses, Open or Closed. Closed alerts stay hidden — even under All Statuses — while Exclude completed tickets is ticked; untick it, or choose Closed.
Closure Reason Combine with Closed to review why alerts were dismissed: False Positive, Expected Activity, Below Threshold, Investigated & Resolved or Escalated / SAR Filed.
Sequence Number Jump to a specific alert by its # ID.
Assigned To Show only alerts assigned to a particular investigator, or unassigned alerts.
Label Match one label added during investigation. Has no effect while a severity card is selected — the severity is itself a label.
Category Limit the queue to one or more rule types — multi-select.
Created After / Created Before Scope the list to a creation period.
Exclude completed tickets Ticked by default; untick to include closed alerts.
Only show my tickets Restrict the list to alerts assigned to you (disables Assigned To).

Click Apply Filters to run the search and Clear Filters to empty the panel. Reset filters in the toolbar clears everything in one go; it is disabled when no filters are active.

Working an alert

Click the magnifier icon or the #<number> link to open the ticket; Ctrl/Cmd-click or middle-click opens it in a new tab, and clicking elsewhere on the row only highlights it. Investigation, comments, status changes, and closure all happen on the ticket page — see the Ticket guide for that workflow.

The ticket shows the evidence behind the alert: the evaluation window, the computed values, and every transaction the rule looked at, marked as Triggering or Considered, with the party name linking to its customer record — see What the rule looked at.

The Comments column shows the running discussion count on each ticket; an alert with several comments has typically already been picked up by someone.

Exporting

Export opens a dialog for the current view (with all active filters and severity selection applied): choose CSV or Excel, export all records or limit the count, pick the columns, then download the file or, where the environment offers it, send it to Google Sheets. This is the standard way to hand a batch of alerts to an external auditor or to feed them into a separate reporting workflow.

Where the data comes from

Monitoring alerts are produced by EFI's transaction monitoring engine, which runs the rules configured on the Monitoring Settings page (the Settings link in this list's header) against the transactions you submit. New alerts appear here as soon as the engine finishes a run — there is no manual creation flow on this page. A rule that fires again for the same party while its ticket is still open updates that ticket (hit count, description, linked transactions) rather than raising a second alert; once you close the ticket, the next hit opens a new one. If the queue looks unexpectedly empty or full, the Dashboard page shows volume trends over time and is a good starting point for diagnosing the upstream pipeline.