Batch monitoring reviews transactions in grouped runs on a schedule, such as nightly or daily, instead of checking each one the moment it happens. It fits after-the-fact AML detection, where the goal is spotting patterns over a period, which makes it efficient for pattern work but blind to anything happening right now.
What is batch monitoring, in plain English?
Batch monitoring processes transactions in grouped runs on a schedule rather than one at a time as they occur. Instead of evaluating every payment in the moment, the system gathers a period's worth of activity, often a full day, and runs the monitoring rules over the whole set at once, typically overnight.
That rhythm suits after-the-fact AML detection. Money laundering usually reveals itself as a pattern across many transactions over time, structured deposits, layering, unusual aggregate flows, and those patterns are easier to see when you look at a batch of activity together than at any single payment. Batch monitoring is built for that kind of pattern work.
The tradeoff is timing. Because it runs on a schedule, it is blind to what is happening right now. It cannot stop a payment before it settles, which makes it efficient for detecting trends but unsuitable on its own for anything that requires stopping a transaction in real time.
Batch vs real-time monitoring
What changes | Batch monitoring | Real-time monitoring |
Timing | Scheduled runs, often nightly. | Evaluates each transaction as it happens. |
Best for | Pattern detection over a period. | Stopping a payment before it settles. |
Can interdict? | No; it reviews after the fact. | Yes; it can hold or block in the moment. |
Typical use | AML trend and typology detection. | Fraud and sanctions blocking. |
How a batch run works
- Collect — Gather the period. Accumulate a scheduled window of transactions, such as a full day of activity.
- Run — Apply the rules. Process the whole batch through the monitoring scenarios at once, usually overnight.
- Detect — Surface patterns. Identify aggregate patterns across the batch that single-transaction checks would miss.
- Alert — Queue for review. Generate alerts on the flagged patterns for analysts to investigate after settlement.
What it looks like in practice
In practice
Overnight, the batch run processes the day's transactions for a customer who made several cash deposits, each just under a reporting threshold, at different branches. No single deposit looked remarkable in the moment, so nothing would have stopped them one at a time. Seen together in the batch, they form a clear structuring pattern and the run raises an alert.
An analyst picks it up the next morning and works the pattern toward a possible SAR. That is exactly what batch monitoring is good at. But the team also knows its limit: a sanctions hit or a fraudulent payment that needs to be stopped before it settles cannot wait for the nightly run, so real-time transaction screening runs alongside it for interdiction.
Why it matters for operators
Batch monitoring is the efficient workhorse of AML detection, because laundering shows up as a pattern over time and a scheduled run over grouped activity is the natural way to see it. It uses resources sensibly and surfaces the aggregate behavior that single-transaction checks cannot, which is why it remains a core part of most monitoring programs.
The operator's job is to know its limit. Batch cannot stop a payment before it settles, so it is the wrong tool on its own for real-time fraud or sanctions blocking, where transaction screening and real-time monitoring are required. Use batch for trends and typologies, and pair it with real-time controls for anything that needs interdiction in the moment.
What to watch in the data
- No interdiction. Batch cannot stop a payment before settlement; do not rely on it for real-time fraud or sanctions blocking.
- Detection lag. Activity flagged overnight has already completed, so response time is measured in hours, not seconds.
- Pattern strength. Batch shines on cross-transaction patterns like structuring and layering that single checks miss.
- Coverage pairing. Real-time screening should run alongside batch to handle anything requiring interdiction.
- Run integrity. A failed or delayed batch run means a day of activity goes unreviewed until it completes.
Quick questions
How is batch monitoring different from real-time monitoring?
Batch monitoring reviews grouped transactions on a schedule, such as nightly, after they have occurred. Real-time monitoring evaluates each transaction as it happens and can stop it before it settles. Batch is for patterns; real-time is for interdiction.
Why is batch monitoring good for AML?
Because money laundering typically appears as a pattern across many transactions over time, and those patterns are easier to detect when a period's activity is analyzed together. Batch runs are efficient at that kind of after-the-fact pattern work.
Can batch monitoring stop a fraudulent payment?
No. Because it runs after transactions occur, it cannot stop a payment before it settles. For real-time fraud and sanctions blocking you need transaction screening and real-time monitoring instead.
Should I use batch or real-time?
Usually both. Use batch for trend and typology detection where the goal is spotting patterns over a period, and real-time controls for anything that must be interdicted in the moment. They cover different needs and complement each other.
What is the main risk of relying on batch alone?
You have no ability to interdict. Anything that requires stopping a transaction before it completes, a sanctions match or an in-progress fraud, will settle before the next batch run sees it, leaving you to react after the money has moved.
Go deeper
- FinCEN ↗ — The US financial intelligence unit. Bank Secrecy Act rules, advisories, and SAR and CTR guidance.
- FFIEC BSA/AML Examination Manual ↗ — The manual US examiners use to assess BSA and AML programs.