The same transaction can mean something completely different depending on where, how and why it happens.

A customer receives ten payments in one day.

Another customer sends money to five different people.

A small business receives hundreds of low-value transactions every month.

An individual makes regular cash withdrawals.

A mobile-money agent processes an unusually high number of transactions.

Should these activities trigger an AML alert?

The answer is not always straightforward.

And this is one of the biggest challenges facing financial institutions and fintechs operating across Africa.

A transaction-monitoring threshold that works well in one market may be completely inappropriate in another.

Africa is not one financial market.

Nigeria is not Kenya.

Kenya is not Ghana.

Ghana is not Senegal.

Senegal is not South Africa.

Customer behaviour, payment infrastructure, levels of financial inclusion, use of cash, remittance patterns, informal commerce and legitimate transaction volumes can vary enormously.

Yet financial institutions sometimes approach transaction monitoring as if the same rules can simply be copied from one market to another.

That creates two problems.

Too many false positives.

And potentially:

Too many false negatives.

The solution is not necessarily more alerts.

It is better understanding of what “unusual” actually means.

The problem with a universal threshold

Imagine a financial institution establishes a rule:

“Alert when a customer receives more than 20 incoming transactions in a month.”

That might sound reasonable.

But what happens when the customer is a legitimate small merchant operating through mobile money?

Twenty transactions could be completely normal.

For another customer, five unrelated incoming payments followed by immediate transfers to several third parties might be much more concerning.

The number itself is not necessarily the risk.

The context is.

This is consistent with the FATF’s broader approach to AML/CFT: institutions should identify and understand the risks they face and apply controls proportionate to those risks rather than relying purely on mechanical rules.

That principle becomes particularly important in African markets, where financial behaviour can differ substantially from the assumptions built into monitoring systems developed elsewhere.

Africa’s financial activity is changing rapidly

One reason transaction monitoring is becoming more complicated is the growth of digital financial services.

Mobile money has transformed the way people send, receive and store money across much of the continent.

For many customers, particularly those with limited access to traditional banking, mobile money is not simply an alternative payment method.

It may be their primary financial infrastructure.

That means a legitimate customer could potentially have:

Frequent low-value transactions
Multiple counterparties
Regular cash-in and cash-out activity
Transfers to family members
Payments from customers
Cross-border transactions
Mobile-money and bank-account activity occurring simultaneously

A monitoring model that treats these characteristics as inherently unusual can quickly become overwhelmed.

The result is predictable:

Alert fatigue.

Investigators spend time reviewing legitimate activity while potentially more meaningful patterns become harder to identify.

The same transaction can mean different things

Consider a hypothetical £500 incoming payment.

In one customer profile, it could be:

A salary payment
A family remittance
A legitimate business payment
A payment for goods

In another, it could be:

Proceeds from fraud
A mule-network transfer
An unexplained third-party payment
Part of a layering pattern

The amount itself tells us relatively little.

Now consider a £50 transaction.

A monitoring system might regard it as low risk because the amount is small.

But imagine that an account receives 200 payments of £50 from unrelated individuals over a short period.

The total value is now significant.

More importantly, the structure of the activity has changed.

This illustrates why transaction monitoring should not focus exclusively on individual transaction values.

Velocity, frequency, counterparties, sequencing and relationships can be much more informative.

Informal economies complicate the picture

One of the biggest challenges for African transaction monitoring is the scale of informal economic activity.

A trader may sell clothing through WhatsApp.

A farmer may receive payments from multiple buyers.

A small importer may pay suppliers through several channels.

A freelancer may receive payments from customers in different countries.

A market trader may regularly deposit cash.

None of these activities automatically indicate money laundering.

But they can look unusual when compared with traditional banking profiles.

A customer might have no formal payslip.

No website.

No corporate bank account.

No sophisticated accounting system.

Yet the customer may have a genuine and economically active business.

This creates a fundamental AML question:

Are we identifying financial crime, or simply identifying customers whose economic reality does not fit the assumptions of the monitoring model?

The distinction matters.

A risk-based approach is intended to make controls more proportionate, including reducing unnecessary burdens on lower-risk activity and supporting financial inclusion.

Mobile money is a perfect example

Consider a mobile-money agent.

The agent may process hundreds of transactions.

Customers deposit money.

Others withdraw it.

Funds move through the agent’s account.

The transaction volume may look extraordinary compared with a normal retail customer.

But the agent’s business model explains it.

Now imagine the same transaction pattern occurring on an ordinary personal account.

The risk picture changes considerably.

This demonstrates why monitoring models need to understand customer type and expected activity.

A high-volume account is not automatically suspicious.

A high-volume account that is inconsistent with the customer’s profile may be.

One country does not necessarily equal one risk profile

Even within the same country, transaction behaviour can vary.

Consider:

An urban fintech customer

They may use:

Cards
Mobile wallets
Online payments
Bank transfers
International platforms

A rural customer

Their activity may involve:

Cash deposits
Mobile money
Agent transactions
Family transfers
Agricultural payments

A small trader

They may receive:

Dozens of customer payments
Supplier payments
Mobile-money transfers
Cash deposits

A salaried professional

Their account may be dominated by:

One salary
Household expenses
Rent
Utilities
Savings

A single threshold applied across all four profiles would be unlikely to perform equally well.

The danger of copying thresholds from another market

This is where global fintech and financial institutions need to be careful.

A monitoring framework developed for a mature banking market may contain assumptions about:

Average transaction values
Banking penetration
Customer behaviour
Cash usage
Digital payment adoption
Merchant activity
Remittance behaviour

Those assumptions may not translate directly into another African market.

Copying the rules without recalibrating them can create a serious operational problem.

The institution may suddenly generate thousands of alerts because legitimate activity looks abnormal according to a foreign benchmark.

This is not necessarily evidence of a higher level of financial crime.

It may simply indicate a poorly calibrated model.

False positives are not just an operational inconvenience

It is easy to think about false positives as a productivity issue.

They are much more than that.

If investigators receive large numbers of low-quality alerts, several things can happen.

Investigators become overloaded

Time is spent reviewing transactions that have perfectly reasonable explanations.

Customers experience unnecessary friction

Legitimate customers may be asked for additional information repeatedly.

Financial inclusion can suffer

Customers whose behaviour differs from conventional banking models may find themselves facing additional restrictions.

Important cases can become harder to identify

When everything looks suspicious, genuinely suspicious activity becomes harder to prioritise.

This is why the objective should not be:

“Generate as many alerts as possible.”

It should be:

“Generate useful alerts that investigators can act on.”

But lower thresholds are not automatically better

There is another side to the problem.

It would be wrong to conclude that African markets simply need higher thresholds.

Criminal networks adapt.

A fraudster or money-laundering network may deliberately keep transactions below established thresholds.

Instead of one large transfer, they may use:

£900
£850
£780
£920
£870

The individual transactions may appear relatively ordinary.

The combined pattern may not be.

This is why threshold-based monitoring should be only one component of a broader transaction-monitoring framework.

Look beyond the amount

Modern transaction monitoring should increasingly consider several dimensions simultaneously.

1. Velocity

How quickly are transactions occurring?

2. Frequency

How often is the customer transacting?

3. Counterparties

Who is sending or receiving the money?

4. Geographic behaviour

Does the geographic activity make sense?

5. Transaction sequencing

What happens immediately before and after the transaction?

6. Customer profile

Is the behaviour consistent with the customer’s occupation, business or expected activity?

7. Network relationships

Are apparently unrelated accounts connected through common beneficiaries, devices, phone numbers or other indicators?

8. Historical behaviour

Is this normal for the customer?

Or is there a sudden change?

The combination can be much more powerful than a single monetary threshold.

Behavioural change can be more important than absolute value

Imagine a customer normally receives five transactions per month.

Suddenly they receive 80.

The average transaction value has not changed.

Nothing has crossed a traditional high-value threshold.

But something has clearly changed.

That change could have many explanations.

Perhaps the customer started a new business.

Perhaps they are collecting money for a legitimate event.

Perhaps they have become a merchant.

Or perhaps the account has been compromised or recruited into a money-mule network.

The important point is that the monitoring system has identified a behavioural change.

That is potentially much more valuable than simply asking whether a transaction exceeds £10,000.

Africa needs locally calibrated transaction monitoring

The answer is not to abandon global AML standards.

Quite the opposite.

The FATF framework is explicitly built around understanding national and institutional risks and applying proportionate controls.

The challenge is translating that principle into operational monitoring.

A financial institution operating across several African markets could consider:

Global standards + local risk intelligence + customer-specific behaviour.

For example:

Global layer

Common controls covering:

Sanctions
PEPs
Fraud
Suspicious activity
High-risk jurisdictions
Terrorist financing indicators

Country layer

Local understanding of:

Payment systems
Cash usage
Remittance corridors
Informal commerce
Local fraud typologies
National risk assessments
Regulatory expectations

Customer layer

Understanding:

Occupation
Expected activity
Customer type
Geographic footprint
Transaction history
Business model

This creates a much more meaningful monitoring environment.

Data quality matters just as much as thresholds

There is another issue that sometimes receives less attention.

A sophisticated monitoring model is only as good as the information available to it.

If a customer’s occupation is outdated, the model may misunderstand their activity.

If merchant information is incomplete, legitimate commercial payments may appear unusual.

If counterparties cannot be linked effectively, the institution may miss relationships between accounts.

If transaction descriptions are poor, investigators may have little context.

This means improving transaction monitoring is not always about building a more complicated algorithm.

Sometimes the biggest improvement comes from improving the underlying data.

Regulators also have a role

The issue is not only for banks and fintechs.

Supervisors and regulators have an important role in encouraging effective risk-based monitoring.

FATF guidance has emphasised moving away from purely tick-box approaches and towards supervision that focuses resources where risks are highest. It also recognises that risk-based supervision can reduce unnecessary burdens on lower-risk sectors and support financial inclusion.

For African regulators, this can mean encouraging institutions to demonstrate:

Why particular thresholds were selected
How scenarios were calibrated
Whether false-positive rates are monitored
How local risks are incorporated
How emerging typologies are reflected
Whether vulnerable customers are disproportionately affected

The objective should be effective AML controls—not simply more controls.

A better question for investigators

Perhaps the most important change is conceptual.

Instead of asking:

“Is this transaction above our threshold?”

investigators should increasingly ask:

“Does this activity make sense for this customer in this market?”

And then:

“If it doesn’t, why?”

That approach encourages investigators to consider both risk and legitimate economic behaviour.

A mobile-money agent should not be assessed like a salaried employee.

A small trader should not necessarily be assessed like a corporate executive.

A remittance recipient should not automatically be treated like an international business.

Context changes the meaning of the transaction.

The future of transaction monitoring in Africa

Transaction monitoring in Africa will probably become increasingly sophisticated as digital financial services continue to expand.

We can expect greater use of:

Behavioural analytics
Machine learning
Network analysis
Device intelligence
Real-time monitoring
Fraud and AML data integration
Customer segmentation
Dynamic risk scoring

But technology will not eliminate the underlying challenge.

If the assumptions behind the model are wrong, a more sophisticated model can simply produce sophisticated false positives.

The technology must therefore be supported by local knowledge.

Final Thoughts

Africa’s financial system is evolving rapidly.

Mobile money, fintech, digital banking, cross-border payments and informal digital commerce are creating new opportunities for millions of people.

They are also creating new challenges for AML professionals.

The biggest mistake would be to assume that unusual automatically means suspicious.

A transaction that looks unusual in one market may be completely normal in another.

And a transaction that looks insignificant in isolation may become highly relevant when viewed as part of a wider behavioural or network pattern.

The answer is not to abandon thresholds.

Thresholds still have an important role.

But they should be treated as signals—not conclusions.

The future of transaction monitoring in Africa should therefore move away from the question:

“How much money moved?”

And towards a more useful set of questions:

Who moved it?

Why did they move it?

Who else is connected?

Is this normal for this customer?

Is it normal for this market?

And what changed?

Because in a continent where financial behaviour can vary dramatically between customers, sectors and countries, one threshold will never fit every market.

Effective AML is not about making every customer behave like a conventional banking customer.

It is about understanding what legitimate behaviour actually looks like—and being able to recognise when it genuinely stops making sense.

AML Transaction Monitoring in Africa: Why One Threshold Does Not Fit Every Market