A Broker-Dealer’s Guide to Transaction Monitoring

Broker-dealer transaction monitoring sits at the center of modern compliance programs. It ties customer onboarding, trading activity, and money movement to a single objective: identifying patterns that may require further review or regulatory reporting. 

For fintech broker-dealers, this task becomes more complex as new products and faster transaction flows intersect with long-standing regulatory expectations.

In practice, transaction monitoring is not a single tool or rule set. It is a combination of data, logic, and workflow. Firms need to collect the right inputs, apply risk-based scenarios, investigate alerts, and determine whether activity meets the threshold for escalation or reporting. 

This guide explains how broker-dealer transaction monitoring works, how regulators evaluate it, and where firms commonly run into issues. It also breaks down what effective monitoring looks like in real operations, especially for fintech models that rely on multiple systems, partners, and evolving product structures.

What Is Transaction Monitoring?

Transaction monitoring is the ongoing review of customer activity to spot inappropriate activity such as fraud, manipulation, or other issues that require attention. For broker-dealers, it touches multiple areas at once, including AML, trading oversight, and broader supervisory responsibilities.

What that looks like in practice is pulling activity from different systems, running it against risk-based rules or triggers, and working through alerts as they come in. But spotting questionable behavior is only part of the job. The bigger picture is handling those alerts the same way every time and keeping a clear record of how each decision was made.

Regulatory expectations shape how this process is built and maintained. Requirements under the Bank Secrecy Act, along with FINRA and SEC oversight, require firms to take a risk-based approach. Monitoring should reflect the firm’s business model and be capable of identifying both transactional and trading-related risks.

AML Monitoring vs. Trade Surveillance

Transaction monitoring is often used as a broad term, but in a broker-dealer context, it is important to separate two distinct functions. AML monitoring and trade surveillance serve different regulatory purposes, rely on different data, and are evaluated differently by regulators. Treating them as the same can create gaps in coverage.

AML Transaction Monitoring (BSA Focus)

AML transaction monitoring focuses on customer activity and money movement. The objective is to identify activities that may indicate financial crime, including money laundering, fraud, or sanctions-related risks.

This type of monitoring typically covers:

• Cash movements such as wires, ACH, and journal entries

• Account funding and withdrawals

• Transfers between related or linked accounts

• Activity that does not align with a customer’s profile

The primary goal is to detect suspicious activity that may require escalation or SAR filing under FinCEN rules. As a result, AML monitoring is driven by the Bank Secrecy Act and implemented through FINRA Rule 3310 requirements.

Learn more about AML transaction monitoring →

Trade Surveillance and Market Abuse Monitoring

Trade surveillance focuses on trading behavior rather than money movement. It is designed to detect activity that may indicate market abuse or violations of securities laws.

Common areas of focus include:

• Insider trading

• Spoofing and layering

• Wash trading

• Marking the close

• Coordinated activity across accounts

The objective here is market integrity, not financial crime detection. Surveillance systems often rely on order-level and execution data, sometimes at very high frequency, which differs from the datasets used in AML monitoring.

Trade surveillance is governed by securities regulations and supervisory obligations, including SEC and FINRA rules in the US. It is typically handled as part of a firm’s broader trading supervision framework.

Why Transaction Monitoring Matters for Broker-Dealers

Using “transaction monitoring” as a catch-all term can create confusion, especially in broker-dealers with active trading activity. AML systems are not designed to detect market manipulation patterns such as spoofing or layering, which require a different level of data and analysis.

In practice, firms operate both functions in parallel, often within separate teams and systems. For fintech broker-dealers, the challenge is coordinating these areas without blending their objectives or relying on one to cover the other.

See how Regly’s AML transaction monitoring helps broker-dealers detect risks and flag suspicious activities →

The Regulatory Framework Behind Broker-Dealer Transaction Monitoring

Broker-dealer transaction monitoring is not defined by a single rule. It sits across multiple regulatory layers, each focusing on a different aspect of risk. Firms are expected to connect AML obligations, supervisory controls, and reporting requirements into one working process.

FINRA Requirements (Rule 3310)

FINRA Rule 3310 requires broker-dealers to maintain a written AML program capable of identifying and reporting suspicious activity. In reality, regulators are less focused on the existence of the document and more on how the program functions in practice. The expectation is that firms can show their AML controls are actively used and producing results.

The Rule sets out the core components of an AML program, including internal procedures, a designated AML officer, employee training, and independent testing. These pieces create the structure, but they only become meaningful when applied to real activity. Transaction monitoring plays a central role here, linking policies to actual customer behavior and financial activity.

FINRA leaves the design choices up to you. There's no template for how monitoring systems should be built. What's expected is that your approach reflects your specific risks, which means thinking about the products you offer, who your customers are, and the kinds of transactions running through your platform. And as the business changes, your monitoring needs to keep pace.

During exams, regulators often look for gaps between how a firm operates and how its monitoring is configured. Programs that rely on generic rules or outdated assumptions tend to draw attention, especially when they fail to reflect current business activity.

FinCEN Requirements (BSA and SAR Rules)

FinCEN sets the core AML obligations for broker-dealers under the Bank Secrecy Act. Transaction monitoring plays a direct role in meeting these requirements.

SAR Triggers and Thresholds

Broker-dealers are required to file a Suspicious Activity Report (SAR) when they detect activity that meets certain criteria. This generally applies to transactions of at least $5,000 where there is reason to suspect:

• Funds derived from illegal activity

• Attempts to evade regulations

• Transactions with no apparent lawful purpose

• Use of the firm to facilitate criminal conduct

Transaction monitoring is the primary mechanism used to identify these scenarios. Without it, firms cannot reliably meet their SAR obligations.

SAR Filing Timelines

Timing plays a key role in SAR compliance. Firms are generally expected to file within 30 calendar days of identifying suspicious activity, with limited flexibility to extend to 60 days if no suspect is identified.

This means alerts must be handled quickly and consistently. Delays in review or unclear escalation processes often result in late filings, which regulators tend to flag.

SEC Oversight

The SEC is not responsible for setting AML rules, but it plays a key role in reviewing broker-dealers and identifying gaps in their transaction monitoring programs.

Exchange Act Rule 17a-8

Exchange Act Rule 17a-8 requires broker-dealers to comply with the reporting and recordkeeping requirements under the Bank Secrecy Act.

In practice, this links SEC oversight directly to how AML programs are carried out. Firms are expected to maintain clear records of their monitoring activities and investigations, show how they identify and address suspicious activity, and provide supporting documentation during examinations. 

As a result, transaction monitoring outputs, including alerts and case reviews, form part of the firm’s regulatory record.

SEC Exam Priorities and Risk Alerts

SEC examinations tend to focus on how transaction monitoring functions in real conditions, not just how it’s described in policies. In many cases, regulators identify patterns where monitoring thresholds are set too high, allowing potentially reportable activity to go undetected. 

There is also frequent scrutiny of firms that rely heavily on manual reviews in environments with growing transaction volume, as this can slow down investigations and create inconsistencies.

Another area that draws attention is the quality of SAR narratives, which are often too generic or lack sufficient detail to explain the underlying concern. In addition, firms sometimes overlook specific risk areas, such as low-priced securities, where monitoring expectations are well established.

Across these findings, the underlying issue is execution. Regulators are less concerned with whether systems exist and more focused on how effectively they are used in practice.

Additional Regulatory Considerations

Broker-dealer transaction monitoring is closely tied to other compliance obligations. It works alongside AML controls, sanctions screening, and supervisory processes, all of which influence how firms assess activity and respond to potential risks. Even when handled by different teams, regulators often review these areas together during examinations.

OFAC Sanctions Monitoring

Broker-dealers are required to comply with US sanctions programs administered by the Office of Foreign Assets Control (OFAC). While sanctions screening is often discussed alongside AML, it carries its own set of expectations and enforcement risk.

In practice, firms need to screen customers and, in certain cases, transactions against OFAC lists. Potential matches must be reviewed, resolved, and documented. This process is typically integrated into onboarding and ongoing monitoring workflows. Gaps in sanctions screening or unclear escalation procedures can quickly become regulatory issues, especially when tied to transaction activity.

Supervisory Obligations (FINRA Rule 3110)

FINRA Rule 3110 requires broker-dealers to establish and maintain a supervisory system that oversees their business activities. Transaction monitoring fits within this broader framework, particularly when it comes to escalation, review, and documentation.

Supervisors are expected to understand how monitoring alerts are generated and how they are handled. This includes reviewing investigation outcomes, validating escalation decisions, and maintaining clear procedures. Transaction monitoring is not just an AML function. It is also part of how firms demonstrate effective supervision across their operations.

In exams, regulators often look at how well these responsibilities are connected. Monitoring outputs, supervisory review, and documentation should align. When these pieces operate in silos, it can lead to inconsistencies that are difficult to defend.

What Broker-Dealer Transaction Monitoring Looks Like in Practice

Broker-dealer transaction monitoring becomes more complex at the operational level. It is not a single system or dataset, but a combination of inputs that need to be connected and interpreted together. The effectiveness of monitoring depends largely on how well firms aggregate and use their data across systems.

Core Data Inputs

Transaction monitoring relies on multiple data streams. Each provides a different view of customer behavior, and gaps in any one area can limit visibility into risk. No single dataset is sufficient on its own, which is why coverage across systems is critical.

Customer and Account Data (KYC, CDD, Risk Ratings)

Customer and account data provide the reference point for interpreting activity. Information gathered during onboarding, along with beneficial ownership and risk classification, helps define what typical behavior should look like for each customer.

Monitoring systems use this reference to identify deviations. For instance, when an account categorized as low risk begins to show patterns like frequent transfers or unusually high trading activity, it may indicate a need for further investigation.

Without accurate and updated customer profiles, monitoring decisions can quickly lose context.

Trading Activity and Order Data

Trading data captures how accounts interact with the market. This includes order placement, execution details, and position changes.

While this data is more commonly associated with trade surveillance, it can also support transaction monitoring. Certain trading patterns, especially when combined with funding activity, may indicate broader concerns. Connecting trading behavior with account-level activity can provide a more complete view of risk.

Money Movement (Wires, ACH, Journals, Transfers)

Trading data captures how accounts interact with the market. This includes order placement, execution details, and position changes.

While this data is more commonly associated with trade surveillance, it can also support transaction monitoring. 

Certain trading patterns, especially when combined with funding activity, may indicate broader concerns. Connecting trading behavior with account-level activity can provide a more complete view of risk.

Clearing Firm and Third-Party Data

Many broker-dealers rely on clearing firms or external providers for custody, execution, or payment processing. As a result, key transaction data may not originate within the firm’s internal systems.

Access to this data can vary depending on integrations and reporting setups. Firms need to account for these dependencies when designing their monitoring approach. Limited visibility into third-party activity is a common source of monitoring gaps.

Common Monitoring Scenarios

Rather than focusing on single events, broker-dealer transaction monitoring evaluates how activity behaves over time. Risk indicators typically emerge when there is a mismatch between actual behavior and the expected profile of the account. 

In practice, firms tend to focus on a set of recurring scenarios, including:

• Unusual Deposits and Withdrawals: Rapid movement of funds into and out of accounts, especially when not tied to trading activity or a clear investment purpose.
  
  

• Activity Inconsistent With Customer Profile: Behavior that does not match the customer’s known financial situation, risk tolerance, or expected account usage. These deviations are often one of the first indicators that something may require investigation.
  
  

• Suspicious Wire Activity: Repeated or high-value wire transfers, particularly when they involve higher-risk locations or do not fit the customer’s typical behavior.
  
  

• Low-Priced Securities Patterns: Trading activity involving thinly traded or low-priced securities, often linked to potential manipulation or coordinated behavior.
  
  

• Coordinated Trading Across Accounts: Similar trading or transfer patterns across multiple accounts that may indicate undisclosed relationships or coordinated activity.

Common Broker-Dealer Transaction Monitoring Challenges

Broker-dealer transaction monitoring often breaks down at the operational level rather than at the policy level. Most firms have defined procedures, but execution becomes more difficult as systems, data sources, and transaction volumes grow. 

Data Fragmentation

Data in fintech broker-dealers is often fragmented. Customer information, trading activity, and transaction flows are spread across different systems, including those run by external providers.

Multiple Systems and Vendors

Many broker-dealer firms use an array of internal and external systems to manage their business. These systems include multiple clearing platforms and various third-party applications. Customer information, trade activity, and all related transactional information may be housed in separate places. Each of these systems will also have its own formats for storing and its own schedules for updating this information. As such, there’s significant friction in building a monitoring process that has a complete picture of all relevant activity at a firm. 

This lack of integration may cause firms to be unable to obtain real-time and complete views of their trading activity. This stems from potential delays in receiving data feeds (mismatches) or missing some feeds altogether. Such limited visibility into risks can be challenging for firms to assess their exposures in a timely manner. When systems are not appropriately integrated, monitoring typically relies upon what’s readily available versus what’s necessary for a complete view. That’s why monitoring tends to be more reactionary in nature. 

Clearing and Custody Dependencies

For introducing broker-dealers, the clearing firm is the one actually holding assets and processing transactions. That puts a lot of the data needed for monitoring outside the firm's own systems. You're working with whatever your clearing partner makes available, in whatever format they provide it. 

Additionally, access to reports is limited by availability (i.e., access provided only on an ad-hoc basis). Reports are typically delivered on a set schedule, and the reporting data elements do not usually align perfectly with the reporting requirements of your monitoring activities. Furthermore, when you’re attempting to analyze activity over extended periods of time or specific types of transactions, discrepancies in reporting capabilities begin to appear as "gaps." 

These dependencies can limit how effectively firms monitor risk. When data is delayed or incomplete, it becomes harder to connect transactions and identify patterns, especially in fast-moving environments.

Manual Processes That Don’t Scale

A lot of firms still lean on manual reviews to work through alerts and investigations. At lower volumes, that's manageable. Once activity picks up, it gets harder to keep up. 

Manual review processes can be a limiting factor as the number of transactions increases, and can cause inconsistent case processing. The investigative process may take longer, and documentation often varies based on how an investigator documents their findings. Manual review may eventually lead to backlogs or result in investigators missing escalated timeline deadlines.

Poor Alert Calibration

Transaction monitoring systems depend heavily on how rules and thresholds are configured. If calibration is off, the system either generates too many alerts or fails to capture meaningful activity.

Too Many False Positives

When monitoring thresholds are set too low, systems tend to generate a large volume of alerts, many of which do not require further action. Over time, this can overwhelm compliance teams, especially in environments with growing transaction volume or multiple data sources.

As the number of alerts grows, it’s increasingly difficult to identify "signals" (activity that should be investigated) versus "noise" (routine activity). Investigators may need to spend considerable time investigating low-risk cases before being able to investigate higher-priority ones. Also, excessive numbers of false positive alerts can significantly decrease the effectiveness of the monitoring system, causing distractions and delays in responding to actual threats. 

Missed High-Risk Activity

Systems that provide overly restrictive monitoring capabilities can miss activity that could potentially become a threat. Monitoring systems with high threshold levels or limited rule sets can significantly decrease the amount of activity that results in an alert. However, these types of monitoring systems do not allow the system to capture more subtle or evolving risk patterns. 

This creates blind spots that are difficult to detect in day-to-day operations. 

Issues may only surface later, often during exams or investigations. Calibration remains one of the most common areas where monitoring programs fall short, particularly when rules are not regularly reassessed.

Inconsistent Investigations and Documentation

Even when the right alerts surface, what comes after can look very different from one case to the next. The issue usually is not the alert itself; it's that two reviewers can take the same information and arrive at different conclusions, mostly because the steps in between aren't laid out clearly enough.

Documentation tends to be the other sticking point. Records that are thin or unclear make it hard to walk anyone through how a decision actually happened. Regulators want to see more than what was reviewed. They want to understand how the firm got from the alert to the outcome. 

How Regly Helps Fintechs Overcome These Challenges

Challenges with many of the broker-dealer transaction monitoring begin at the point of execution. Transaction data is distributed among systems. Broker-dealers receive numerous alerts they have difficulty prioritizing. Manual steps are used in their workflow. In order for broker-dealers to overcome this, they need to create better coordination between data, rules, and investigative processes. Regly is built to bring these pieces together. It centralizes transaction data, applies rules based on real-world compliance experience, and routes alerts through structured workflows. Teams can define rules, monitor activity, and escalate cases within a single system.

The platform also supports ongoing refinement. Rules can be adjusted as risk profiles change, helping reduce unnecessary alerts while capturing meaningful activity. The result is a more practical approach to transaction monitoring that fits how broker-dealers actually operate.

Learn more about Regly’s AML transaction monitoring →

Broker-Dealer Transaction Monitoring Checklist

A strong broker-dealer transaction monitoring program is not defined by one control or system. It is the result of how data, rules, and workflows come together in practice. Gaps often appear when one of these elements is incomplete or not aligned with the firm’s actual activity.

Data and System Coverage

Transaction monitoring depends on having access to the right data across all relevant systems. This includes customer profiles, trading activity, and money movement, as well as data from clearing firms or third-party providers.

Firms should be able to explain what data is included in monitoring, how it is sourced, and whether there are any gaps. 

Incomplete or delayed data is one of the most common reasons monitoring fails to capture relevant activity.

Monitoring Rules and Scenarios

Monitoring logic should reflect the firm’s business model, customer base, and risk exposure. This includes defining thresholds, scenarios, and triggers that are relevant to how accounts are used.

Rules should not remain static. As products evolve or transaction patterns change, monitoring logic should be revisited. Calibration is an ongoing process, not a one-time setup.

Investigation Workflow

Once alerts are generated, firms need a clear process for reviewing and escalating them. This includes defining who reviews alerts, how decisions are made, and when issues are escalated.

Consistency is critical. Different reviewers should be able to follow the same approach and reach similar conclusions based on the same information.

Well-defined workflows help reduce variability and support more defensible outcomes.

SAR Decision Framework

Firms need a defined process for evaluating whether an activity rises to the level of a SAR filing. This typically involves assessing relevant indicators, reviewing the context of the activity, and documenting how the decision was reached within required timeframes. Without a structured approach, these decisions can become inconsistent across cases.

Each determination should be supported by clear, detailed documentation that explains the reasoning behind the outcome, whether a SAR is filed or not. 

Regulators tend to focus on the decision-making process itself, including how conclusions were reached, rather than looking only at the final result.

Recordkeeping and Audit Readiness

Firms should have a structured approach for determining whether activity meets the threshold for a SAR filing. This includes identifying key indicators, documenting reasoning, and tracking timelines.

Decisions should be supported by clear documentation that explains why the activity was or was not reported. 

Regulators often focus on how these decisions are made, not just the final outcome.

—

Broker-dealer transaction monitoring is not defined by a single system or rule set. It is shaped by how well firms connect data, apply risk-based logic, and manage investigations in practice. The gap between policy and execution is where most issues arise.

For fintech broker-dealers, this challenge is amplified by fragmented systems, evolving products, and increasing transaction volume. Monitoring programs need to reflect how the business actually operates, not just how it is documented.

Firms that approach transaction monitoring as an ongoing process, rather than a static setup, are better positioned to adapt to regulatory expectations and operational complexity.