Choosing a transaction monitoring solution in Australia is a different decision than it is anywhere else in the world — not because the technology is different, but because the regulatory and payment infrastructure context is.

AUSTRAC has one of the most active enforcement programmes of any financial intelligence unit globally. The New Payments Platform (NPP) makes irrevocable real-time transfers the default for domestic payments. And Australia's AML/CTF framework is mid-way through its most significant legislative reform in fifteen years, with Tranche 2 expanding obligations to lawyers, accountants, and real estate agents.

For compliance teams at Australian reporting entities, this means a transaction monitoring solution needs to do more than pass a vendor demonstration. It needs to perform under AUSTRAC examination and keep pace with payment infrastructure that moves faster than most legacy monitoring systems were designed for.

This guide covers what AUSTRAC actually requires, the criteria that matter most in the Australian market, and the questions to ask before committing to a solution.

What AUSTRAC Requires from Transaction Monitoring

The AML/CTF Act requires all reporting entities to implement and maintain an AML/CTF programme that includes ongoing customer due diligence and transaction monitoring. The specific monitoring obligations sit in Chapter 16 of the AML/CTF Rules.

Three points from Chapter 16 matter before any vendor evaluation begins:

Risk-based calibration is mandatory. Monitoring thresholds must reflect the institution's specific customer risk assessment — not vendor defaults. A retail bank, a remittance provider, and a cryptocurrency exchange each need monitoring calibrated to their own customer profile. AUSTRAC does not prescribe specific thresholds; it assesses whether the thresholds in place are appropriate for the risk present.

Ongoing monitoring is a continuous obligation. AUSTRAC expects transaction monitoring to be a live function, not a periodic review. The language in Rule 16 about real-time vigilance is not advisory — it reflects examination expectations.

The system must support regulatory reporting. Threshold Transaction Reports (TTRs) over AUD 10,000 and Suspicious Matter Reports (SMRs) must be filed within regulated timeframes. A monitoring system that cannot generate AUSTRAC-ready reports — or that requires significant manual handling to produce them — creates compliance risk at the reporting stage even when the detection stage works correctly.

The enforcement record illustrates what happens when monitoring falls short. The Commonwealth Bank of Australia's AUD 700 million AUSTRAC settlement in 2018 and Westpac's AUD 1.3 billion settlement in 2021 both named transaction monitoring failures as direct causes — not the absence of monitoring systems, but systems that failed to detect what they were required to detect. Both cases involved institutions with significant compliance investment already in place.

The NPP Factor

The New Payments Platform reshaped monitoring requirements for Australian institutions in a way that most global vendor comparisons do not account for.

Before NPP, Australia's payment infrastructure gave compliance teams a window between transaction initiation and settlement — a clearing delay during which a flagged transaction could be investigated before funds moved irrevocably. NPP eliminated that window. Domestic transfers now settle in seconds.

Batch-processing monitoring systems — even those with short batch intervals — cannot catch NPP fraud or structuring activity before settlement. The only viable approach is pre-settlement evaluation: risk assessment at the point of transaction initiation, before the payment is confirmed.

When evaluating vendors, ask specifically: at what point in the NPP payment lifecycle does your system evaluate the transaction? Vendors frequently describe their systems as "real-time" when they mean near-real-time or fast-batch. That distinction matters both for fraud loss prevention and for AUSTRAC examination.

6 Criteria for Evaluating Transaction Monitoring Solutions in Australia

1. Pre-settlement processing on NPP

The technical requirement above, stated as a discrete evaluation criterion. Ask for a live demonstration using NPP transaction scenarios, not hypothetical ones.

2. Alert quality over alert volume

High alert volume is not a sign of effective monitoring — it is often a sign of poorly calibrated thresholds. A system generating 600 alerts per day at a 96% false positive rate means approximately 576 dead-end investigations. That is not compliance; it is operational noise that crowds out genuine risk signals.

Ask for the vendor's false positive rate in production at a comparable Australian institution. A well-calibrated AI-augmented system should be below 85% in production. If the vendor cannot provide production data from a comparable client, that is itself informative.

3. AUSTRAC typology coverage

Australia has specific financial crime patterns that global rule libraries do not always cover — cross-border cash couriering, mule account networks across retail banking, and real estate-linked layering using NPP for settlement. These typologies are documented in AUSTRAC's annual financial intelligence assessments and should be represented in any system deployed for an Australian institution.

Ask to see the vendor's AUSTRAC-specific typology library and when it was last updated. Ask how the vendor tracks and incorporates new AUSTRAC guidance.

4. Explainable alert logic

Every AUSTRAC examination includes review of alert documentation. For each sampled alert, examiners expect to see: what triggered it, who reviewed it, the analyst's written rationale, and the disposition decision. A monitoring system built on opaque models — where alerts are generated but the logic is not traceable — makes this documentation impossible to produce correctly.

Explainability also improves investigation quality. An analyst who understands why an alert was raised makes a better disposition decision than one who cannot reconstruct the reasoning.

5. Calibration without constant vendor involvement

AUSTRAC requires monitoring thresholds to reflect the institution's current customer risk profile. Customer profiles change: books grow, customer mix shifts, new products are launched. A monitoring system that requires a vendor engagement to update detection scenarios or adjust thresholds will always lag behind the institution's actual risk position.

Ask specifically: can your compliance team modify thresholds, create new scenarios, and adjust rule weightings independently? What is the governance process for documenting calibration changes for AUSTRAC audit purposes?

6. Integration with existing case management

Transaction monitoring does not exist in isolation. Alerts feed into case management, case management informs SMR decisions, and SMR decisions must be filed with AUSTRAC within regulated timeframes. A monitoring solution that requires manual data transfer between systems at any of these stages creates delay, error risk, and audit trail gaps.

Ask for the vendor's standard integration points and reference implementations with Australian case management platforms.

Questions to Ask Before Committing

Most vendor sales processes focus on features. These questions get at operational and regulatory reality:

Do you have current AUSTRAC-supervised clients? Ask for references — not case studies. Speak to compliance teams at comparable institutions running the system in production.

How did your system handle the NPP real-time payment requirement when it was introduced? A vendor's response to an infrastructure change already in the past tells you more about adaptability than any forward-looking roadmap.

What is your typical time from contract to production-ready performance? Not go-live — production-ready. The gap between those two dates is where most implementation budgets fail.

What does your model retraining schedule look like? Transaction patterns change. A model trained on 2023 data that has not been retrained will underperform against current fraud and laundering patterns.

How do you handle Tranche 2 obligations for our institution? For institutions with subsidiary or affiliated entities in Tranche 2 sectors, the monitoring solution needs to be able to extend coverage without a separate implementation.

Common Mistakes in Vendor Selection

Three patterns appear consistently in post-implementation reviews of Australian institutions that struggled with their monitoring solution:

Selecting on cost rather than calibration. The cheapest system at procurement often becomes the most expensive when AUSTRAC examination findings require remediation. Remediation costs — additional vendor work, internal team time, reputational risk management — typically exceed the original licence cost difference many times over.

Underestimating integration complexity. A system that performs well in isolation but requires significant custom integration with the institution's core banking platform and case management tool will consistently underperform its demonstration capabilities. Ask for the implementation architecture documentation before signing, not after.

Treating go-live as done. Transaction monitoring requires ongoing calibration. Banks that deploy a system and then do not actively tune it — adjusting thresholds, adding new typologies, reviewing alert quality — see performance degrade within 12–18 months as their customer profile evolves away from the profile the system was originally calibrated for.

How Tookitaki's FinCense Works in the Australian Market

FinCense is used by financial institutions across APAC including Australia, Singapore, Malaysia, and the Philippines. In Australia specifically, the platform is configured with AUSTRAC-aligned typologies, supports TTR and SMR reporting formats, and processes transactions pre-settlement for NPP compatibility.

The federated learning architecture allows FinCense models to incorporate typology patterns from across the client network without sharing raw transaction data — which means Australian institutions benefit from detection intelligence learned from cross-institution fraud patterns, including coordinated mule account activity that moves between banks.

In production, FinCense has reduced false positive rates by up to 50% compared to legacy rule-based systems. For a team managing 400 daily alerts, that translates to approximately 200 fewer dead-end investigations per day.

Next Steps

If your institution is evaluating transaction monitoring solutions for 2026, three resources will help structure the process:

• AUSTRAC Transaction Monitoring Requirements — detailed breakdown of Chapter 16 obligations and what AUSTRAC examines in practice
• Transaction Monitoring Software Buyer's Guide — the 7 questions to ask any vendor before you sign
• What Is Transaction Monitoring? — the complete technical and regulatory overview

Or talk to Tookitaki's team directly to discuss your institution's specific requirements.

When authority is fabricated and trust is engineered, even the most implausible promises can start to feel real.

The Scam That Made Headlines

In a recent crackdown, the Philippine National Police arrested 15 individuals linked to an alleged investment scam that had been quietly unfolding across parts of the country.

At the centre of it all was a man posing as a “King” — a self-styled figure of authority who convinced victims that he had access to exclusive investment opportunities capable of delivering extraordinary returns.

Victims were drawn in through a mix of persuasion, perceived legitimacy, and carefully orchestrated narratives. Money was collected, trust was exploited, and by the time doubts surfaced, the damage had already been done.

While the arrests mark a significant step forward, the mechanics behind this scam reveal something far more concerning, a pattern that financial institutions are increasingly struggling to detect in real time.

Inside the Illusion: How the “King” Investment Scam Worked

At first glance, the premise sounds almost unbelievable. But scams like these rarely rely on logic, they rely on psychology.

The operation appears to have followed a familiar but evolving playbook:

1. Authority Creation

The central figure positioned himself as a “King” — not in a literal sense, but as someone with influence, access, and insider privilege. This created an immediate power dynamic. People tend to trust authority, especially when it is presented confidently and consistently.

2. Exclusive Opportunity Framing

Victims were offered access to “limited” investment opportunities. The framing was deliberate — not everyone could participate. This sense of exclusivity reduced skepticism and increased urgency.

3. Social Proof and Reinforcement

Scams of this nature often rely on group dynamics. Early participants, whether real or planted, reinforce credibility. Testimonials, referrals, and word-of-mouth create a false sense of validation.

4. Controlled Payment Channels

Funds were collected through a combination of cash handling and potentially structured transfers. This reduces traceability and delays detection.

5. Delayed Realisation

By the time inconsistencies surfaced, victims had already committed funds. The illusion held just long enough for the operators to extract value and move on.

This wasn’t just deception. It was structured manipulation, designed to bypass rational thinking and exploit human behaviour.

Why This Scam Is More Dangerous Than It Looks

It’s easy to dismiss this as an isolated case of fraud. But that would be a mistake.

What makes this incident particularly concerning is not the narrative — it’s the adaptability of the model.

Unlike traditional fraud schemes that rely heavily on digital infrastructure, this scam blended offline trust-building with flexible payment collection methods. That makes it significantly harder to detect using conventional monitoring systems.

More importantly, it highlights a shift: Fraud is no longer just about exploiting system vulnerabilities. It’s about exploiting human behaviour and using financial systems as the final execution layer.

For banks and fintechs, this creates a blind spot.

Following the Money: The Likely Financial Footprint

From a compliance and AML perspective, scams like this leave behind patterns — but rarely in a clean, linear form.

Based on the nature of the operation, the financial footprint may include:

• Multiple small-value deposits or transfers from different individuals, often appearing unrelated
• Use of intermediary accounts to collect and consolidate funds
• Rapid movement of funds across accounts to break transaction trails
• Cash-heavy collection points, reducing digital visibility
• Inconsistent transaction behaviour compared to customer profiles

Individually, these signals may not trigger alerts. But together, they form a pattern — one that requires contextual intelligence to detect.

Red Flags Financial Institutions Should Watch

For compliance teams, the challenge lies in identifying these patterns early — before the damage escalates.

Transaction-Level Indicators

• Sudden inflow of funds from multiple unrelated individuals into a single account
• Frequent small-value transfers followed by rapid aggregation
• Outbound transfers shortly after deposits, often to new or unverified beneficiaries
• Structuring behaviour that avoids typical threshold-based alerts
• Unusual spikes in account activity inconsistent with historical patterns

Behavioural Indicators

• Customers participating in transactions tied to “investment opportunities” without clear documentation
• Increased urgency in fund transfers, often under external pressure
• Reluctance or inability to explain transaction purpose clearly
• Repeated interactions with a specific set of counterparties

Channel & Activity Indicators

• Use of informal or non-digital communication channels to coordinate transactions
• Sudden activation of dormant accounts
• Multiple accounts linked indirectly through shared beneficiaries or devices
• Patterns suggesting third-party control or influence

These are not standalone signals. They need to be connected, contextualised, and interpreted in real time.

The Real Challenge: Why These Scams Slip Through

This is where things get complicated.

Scams like the “King” investment scheme are difficult to detect because they often appear legitimate — at least on the surface.

• Transactions are customer-initiated, not system-triggered
• Payment amounts are often below risk thresholds
• There is no immediate fraud signal at the point of transaction
• The story behind the payment exists outside the financial system

Traditional rule-based systems struggle in such scenarios. They are designed to detect known patterns, not evolving behaviours.

And by the time a pattern becomes obvious, the funds have usually moved.

Where Technology Makes the Difference

Addressing these risks requires a shift in how financial institutions approach detection.

Instead of looking at transactions in isolation, institutions need to focus on behavioural patterns, contextual signals, and scenario-based intelligence.

This is where modern platforms like Tookitaki’s FinCense play a critical role.

By leveraging:

• Scenario-driven detection models informed by real-world cases
• Cross-entity behavioural analysis to identify hidden connections
• Real-time monitoring capabilities for faster intervention
• Collaborative intelligence from ecosystems like the AFC Ecosystem

…institutions can move from reactive detection to proactive prevention.

The goal is not just to catch fraud after it happens, but to interrupt it while it is still unfolding.

From Headlines to Prevention

The arrest of those involved in the “King” investment scam is a reminder that enforcement is catching up. But it also highlights a deeper truth: Scams are evolving faster than traditional detection systems.

What starts as an unbelievable story can quickly become a widespread financial risk — especially when trust is weaponised and financial systems are used as conduits.

For banks and fintechs, the takeaway is clear.

Prevention cannot rely on static rules or delayed signals. It requires continuous adaptation, shared intelligence, and a deeper understanding of how modern scams operate.

Because the next “King” may not call himself one.

But the playbook will look very familiar.

In August 2023, Singapore Police Force executed the largest money laundering operation in the country's history. S$3 billion in assets were seized from ten foreign nationals who had moved funds through Singapore's financial system for years — through banks, through licensed payment institutions, through corporate accounts holding everything from luxury cars to commercial property.

For compliance teams at Singapore-licensed financial institutions, the question that followed was not abstract. It was: would our transaction monitoring have caught this?

MAS has been examining that question across the industry since, through an intensified supervisory programme that has put transaction monitoring under closer scrutiny than at any point in the past decade. This guide covers what Singapore law requires, what MAS examiners actually check, and what a genuinely effective transaction monitoring programme looks like in a Singapore context.

Singapore's Transaction Monitoring Regulatory Framework

Transaction monitoring obligations in Singapore flow from three regulatory instruments. Understanding the differences between them matters — particularly for payment service providers, whose obligations are sometimes confused with bank requirements.

MAS Notice 626 (Banks)

MAS Notice 626, issued under the Banking Act, is the primary AML/CFT requirement for Singapore-licensed banks. Paragraphs 19–27 set out monitoring requirements: banks must implement systems to detect unusual or suspicious transactions, investigate alerts within defined timeframes, and document monitoring outcomes in a form that MAS can review.

The full obligations under Notice 626 are covered in detail in our [MAS Notice 626 Transaction Monitoring Requirements guide](/compliance-hub/mas-notice-626-transaction-monitoring). What matters for this discussion is that Notice 626 sets a floor, not a ceiling. MAS expectations in examination have consistently run ahead of the minimum text.

MAS Notices PSN01 and PSN02 (Payment Service Providers)

Since the Payment Services Act (PSA) came into force in 2020, licensed payment institutions — standard payment institutions and major payment institutions — have had AML/CFT obligations that mirror the core requirements of Notice 626, adapted for the payment services context.

A cross-border remittance operator has the same obligation to monitor for unusual activity as a bank. The typologies look different — faster transaction cycling, higher cross-border transfer volumes, shorter customer history — but the regulatory requirement is equivalent.

This matters because some licensed payment institutions still treat their monitoring obligations as lighter than bank-grade. MAS examination findings published in the 2024 supervisory expectations document specifically noted that AML controls at payment institutions were "less mature" than at banks — which means this is now an examination priority.

MAS AML/CFT Supervisory Expectations (2024)

The 2024 MAS supervisory expectations document is the most direct signal of what MAS is looking for. It followed the 2023 enforcement action and a broader review of AML/CFT controls across supervised institutions.

Transaction monitoring appears in three of the five priority areas in that document:

• Alert logic that is not calibrated to the institution's specific risk profile
• Insufficient monitoring intensity for high-risk customers
• Weak documentation of alert investigation outcomes

None of these are technical failures. They are process and governance failures — which is what makes them significant. An institution can have sophisticated monitoring software and still fail on all three.

What MAS Examiners Actually Check

Notice 626 describes what is required. MAS examinations test whether requirements are met in practice. Based on examination findings and regulatory guidance, MAS reviewers focus on four areas in transaction monitoring assessments.

Alert calibration against actual risk

MAS does not expect every institution to use the same alert thresholds. It expects every institution to use thresholds that reflect its own customer risk profile.

An institution whose customers are predominantly high-net-worth individuals with complex cross-border financial structures should have monitoring rules calibrated for that population — not rules designed for retail banking that happen to flag some of the same transactions.

In practice, examiners ask: how were these thresholds set? When were they last reviewed? What changed in your customer book since the last calibration, and how did the monitoring reflect that? Institutions that cannot answer these questions specifically — with dates, documented rationale, and sign-off from a named senior officer — are likely to receive findings.

Alert investigation documentation

This is where most examination failures occur, and it is not because institutions failed to review alerts.

MAS expects a written record for each alert: what the analyst found, why the transaction was or was not considered suspicious, and what action was or was not taken. A disposition of "reviewed — no SAR required" without supporting rationale does not satisfy this requirement. The expectation is closer to: "reviewed the customer's transaction history, the stated purpose of the account, and the counterparty profile. The transaction pattern is consistent with the customer's documented business activities and does not meet the threshold for filing."

Institutions that have good detection logic but poor investigation documentation often present worse in examination than institutions with simpler detection that document everything carefully.

Coverage of high-risk customers

FATF Recommendation 10 and Notice 626 both require enhanced monitoring for high-risk customers. MAS examiners check whether the monitoring programme reflects this operationally — not just in policy.

A specific check: do high-risk customers generate more alerts per capita than standard-risk customers? If not, one of two things is happening: either the monitoring programme is not applying enhanced measures to high-risk accounts, or it is applying enhanced measures but they are not generating additional alerts — which means the enhanced measures are not actually detecting more.

Either way, the institution needs to be able to explain the distribution clearly.

The audit trail

When MAS examines a monitoring programme, examiners review a sample of alerts from the past 12 months. For each sampled alert, they should be able to see: which rule or model triggered it, when it was assigned for investigation, who reviewed it, what the disposition decision was, the written rationale, and whether an STR was filed.

If any of these elements cannot be produced — because the system does not log them, or because records were not retained — the examination finding is straightforward.

Post-2023: What Changed

The 2023 enforcement action changed the operational context for transaction monitoring in Singapore in three specific ways.

Typology libraries need to reflect the patterns that were missed. The S$3 billion case involved specific patterns: shell companies receiving large transfers followed by property purchases, multiple entities with overlapping beneficial ownership, cash-intensive businesses used to layer funds into the formal banking system. These are not novel typologies — FATF and MAS had documented them before 2023. The question is whether monitoring rules were actually in place to detect them.

MAS has increased examination intensity. Following the 2023 case, MAS publicly committed to strengthening AML/CFT supervision, including more frequent and more intrusive examinations of systemically important institutions. Compliance teams that previously experienced relatively light-touch monitoring reviews should expect more detailed examination engagement going forward.

The reputational context for non-compliance has shifted. Before 2023, AML failures in Singapore were largely a technical compliance matter. After an enforcement action that received global coverage and led to diplomatic implications, the reputational consequences of a significant AML failure for a Singapore-licensed institution are much more visible.

Transaction Monitoring for PSA-Licensed Payment Institutions

For firms licensed under the PSA, there are specific practical considerations that bank-focused guidance does not address.

Shorter customer history. Payment service firms typically have shorter customer relationships than banks — sometimes months rather than years. ML-based anomaly detection models need historical data to establish baseline behaviour. When that history is limited, rules-based detection of known typologies needs to carry more weight in the alert logic.

Cross-border transaction volumes. PSA licensees handling international remittances have inherently higher cross-border exposure. Monitoring typologies must specifically address: structuring across multiple corridors, unusual shifts in destination country distribution, and dormant accounts that suddenly receive high-volume cross-border inflows.

Account lifecycle monitoring. New accounts that begin transacting immediately at high volume, or accounts that show no activity for an extended period before suddenly becoming active, are specific patterns that PSA-specific monitoring rules should address.

MAS has stated directly that it expects payment institutions to "uplift" their AML/CFT controls to a level closer to bank-grade. For transaction monitoring specifically, that means investment in calibration, documentation, and governance — not simply deploying a vendor system and assuming requirements are met.

What Effective Transaction Monitoring Looks Like in Singapore

Across MAS guidance, examination findings, and the post-2023 supervisory environment, an effective Singapore TM programme has six characteristics:

1. Documented calibration rationale. Alert thresholds are set with reference to the institution's customer risk assessment and reviewed when the customer book changes. Every threshold has a documented basis.

2. Coverage of Singapore-specific typologies. Beyond generic AML typologies, the monitoring library includes patterns documented in Singapore enforcement actions: shell company structuring, property-linked layering, cross-border transfer cycling across high-risk jurisdictions.

3. Alert investigation documentation that can survive examination. Every alert has a written disposition, not a checkbox. High-risk customer alerts have enhanced documentation. STR filings link back to specific alerts.

4. Defined escalation process. When an analyst is uncertain, there is a clear path to the Money Laundering Reporting Officer. Escalation decisions are recorded.

5. Regular calibration review. The monitoring programme is tested — whether through independent review, internal audit, or structured self-assessment — at least annually. Results and follow-up actions are documented.

6. Model governance for ML components. Where ML-based detection is used, model performance is tracked, validation is documented, and retraining triggers are defined. The validation record sits with the institution.

Taking the Next Step

If your institution is preparing for a MAS examination, reviewing its monitoring programme post-2023, or evaluating new transaction monitoring software, the starting point is a clear-eyed assessment of where your current programme sits against MAS expectations.

Tookitaki's FinCense platform is used by financial institutions across Singapore, Malaysia, Australia, and the Philippines. It is pre-configured with APAC-specific typologies — including patterns documented in Singapore enforcement actions and produces alert documentation in the format MAS examiners review.

Book a discussion with Tookitaki's team to see FinCense in a live environment calibrated for your institution type and region.

For a broader introduction to transaction monitoring requirements across all five APAC markets — Singapore, Australia, Malaysia, Philippines, and New Zealand — see our [complete transaction monitoring guide].