Alert Backlog

An alert backlog is the accumulated stock of alerts from transaction monitoring, sanctions screening or fraud systems that have been generated but not reviewed within the time a firm's own procedures allow. It builds up when the number of new alerts each day is greater than the number analysts can review and close, and it is one of the most common operational problems in financial crime compliance.

"Alert backlog" is an industry working term, not a legal definition. Compliance teams use it in management reports, regulators use it in exam findings, and it appears in consent orders where a firm is told to clear unreviewed alerts by a deadline. It is closely tied to alert ageing (how long each open alert has waited) and to staffing plans for the investigations team.

Imagine a post office counter where ten people join the queue every hour but the clerk can only serve eight. Nobody is doing anything wrong in a single hour, but by the end of the week the queue is out the door. Some of the people waiting have urgent parcels, and the longer they wait the more harm is done.

An alert backlog is that queue. Each alert is a possible problem that a person has to look at. If the system raises more alerts than the team can handle, the unread ones pile up. Hidden in the pile may be a real case of money laundering or fraud, and every day it sits unread is a day the criminal money keeps moving and a day closer to a reporting deadline.

The size of the backlog changes each day by the difference between new alerts and closed alerts:

• $B_{t}$ is the number of open alerts past the review target at the end of day $t$.
• $A_{t}$ is the number of alerts that reach the review target unworked on day $t$.
• $C_{t}$ is the number of overdue alerts closed on day $t$.

If daily capacity $c$ exceeds the daily inflow $a$, the time needed to clear an existing backlog $B$ is:

For example, a team with 6,000 overdue alerts that receives 1,000 new alerts a day and can close 1,250 a day has a net reduction of 250 a day, so it needs $6{,}000 \div 250 = 24$ working days to clear the backlog. If capacity falls below inflow, the backlog grows without limit, which is why management reports track inflow, closures and the age profile of open alerts together.

• Poorly calibrated scenarios. Thresholds set too low, or not segmented by customer risk segmentation, can generate huge volumes of false positives.
• Growth without staffing. Fast-growing fintechs and neobanks often add customers faster than they hire analysts.
• System changes. A new transaction monitoring system, a data fix or a new scenario can release a wave of alerts at once.
• Lookbacks. A regulator may require a firm to re-run monitoring over past months, producing a one-off batch of historical alerts.
• Slow tooling. Analysts who must gather data from many systems instead of one case management system close fewer alerts per day.

A backlog is treated by supervisors as a control failure because suspicious activity may go unreported. In the US, a suspicious activity report is generally due within 30 calendar days of initial detection, and alerts that wait months make that standard hard to meet. Large backlogs have been cited in consent orders and other enforcement actions against banks and payment firms in the US and UK, often with requirements to hire independent consultants, clear the queue and report progress. A backlog is also a sign of wider weakness in the AML program, and supervisors may limit a firm's growth, for example by restricting new high-risk customers, until it is resolved.

Firms usually combine short-term and structural measures:

• Triage. Work the highest-risk and oldest alerts first, using alert scores, so that the most serious items are not left at the back of the queue.
• Extra capacity. Bring in contractors or outsourced review teams, with quality checks on their alert dispositions.
• Tuning. Use transaction monitoring tuning to cut false positives, while testing that changes do not raise the false negative rate.
• Automation. Group related alerts on the same customer into one review, pre-fill evidence, or auto-close narrowly defined low-risk alerts under documented rules, often with regtech tools.

Regulators generally accept triage and automation if they are documented and tested, but they do not accept bulk-closing alerts without review simply to shrink the numbers. A firm that does so may face a second finding for misleading reporting.

• Financial Crimes Enforcement Network (FinCEN)
• Financial Conduct Authority