Red-Team Testing an AML Program

Why red-team

Controls decay as typologies evolve. Red-teaming simulates adversaries: craft realistic transaction patterns (structuring, layering, mule networks) and verify the monitoring stack detects them. A control that passed validation at deployment can be blind to a typology that emerged two quarters later; red-team runs are the only way to prove detection capability against the current threat surface rather than the one the vendor documented.

The loop

1. Scenarios — define 10-20 typologies from FATF and your own SAR history.
2. Injection — generate synthetic transactions with ground-truth labels.
3. Measure — detection rate, false-positive rate, time-to-alert.
4. Tune — adjust thresholds and rules; re-run to prove improvement.

Injection quality determines test validity. Synthetic data must match the account, product, and velocity distributions of real business — random transactions with random amounts test nothing. Replay anonymised historical typology cases where possible, and inject into the live detection path (not a bypass channel) so the test exercises the full stack including data ingestion and alert routing.

Governance

Document every test run with versioned rule sets so examiners can see the control-improvement trail. Red-team findings feed the risk assessment and board reporting. Publish metrics honestly — detection rate gains without false-positive rate context are not evidence of improvement. Keep a known-issues register for accepted gaps: an explicit, dated risk acceptance is defensible in an exam; an undocumented blind spot is not.

Scheduling

Run a full scenario cycle quarterly, with a lightweight subset monthly. Re-run immediately after any rule change or model release, and after every major typology advisory (FATF updates, sanctions list expansions). Treat the red-team function as independent of the monitoring team — the same people who tune the rules should not be the only ones who test them.

References

• FATF — Risk-Based Approach Guidance for the Banking Sector(regulatory)
• Bank of England — Testing of financial crime controls(regulatory)
• Webber, Testing AML Transaction Monitoring Systems(academic)