An end-to-end AML transaction-monitoring and alert-investigation project using Python, SQL, Tableau, and Streamlit to analyze customer behavior, transaction patterns, monitoring alerts, risk scores, dispositions, and investigation-prioritization decisions.
Portfolio scope: This project uses synthetic data created for educational and portfolio purposes. Monitoring scenarios, risk scores, thresholds, dispositions, and recommendations are illustrative and do not represent any financial institution's production AML program.
Transaction-monitoring teams must combine customer KYC context with transaction behavior, monitoring scenarios, alert risk, counterparties, geographic exposure, and prior activity before deciding whether an alert can be closed or requires escalation.
This project demonstrates that workflow across:
- 300 synthetic customers
- 15,000 transactions
- 169 AML alerts
- 300 customer-level AML risk records
- A feature-engineered transaction layer containing behavioral and monitoring indicators
The analytical workflow moves from customer and transaction data through EDA, feature engineering, monitoring alerts, investigation review, and decision support.
- Which customers and alerts should investigators prioritize first?
- Which monitoring scenarios generate the most alerts?
- Which alerts carry the highest AML risk scores?
- Which customers show unusual transaction volume relative to expected activity?
- Which customers have elevated cross-border or high-risk-country exposure?
- Which alerts were escalated to cases or SAR consideration?
- Which counterparties and jurisdictions contribute to elevated risk?
- How can customer-level AML risk and transaction behavior support alert disposition?
- Which patterns may indicate structuring, high-risk wires, unusual volume, or rapid movement of funds?
The project uses five interconnected datasets supporting transaction monitoring, behavioral analysis, alert investigation, and customer-level AML risk assessment.
| Dataset | Rows | Purpose |
|---|---|---|
| Customer Reference | 300 | Customer KYC profiles and baseline AML risk context |
| Raw Transactions | 15,000 | Transaction activity used for monitoring and behavioral-pattern analysis |
transactions_enriched.csv |
15,000 | Analytics-ready transaction layer with engineered AML risk and behavioral features |
alerts.csv |
169 | AML monitoring alerts, investigation findings, and disposition outcomes |
customer_risk_features.csv |
300 | Customer-level AML risk indicators, behavioral features, and prioritization metrics |
Data flow: Customer & Transaction Data → Data Quality & Feature Engineering → Transaction Monitoring → Alert Generation → Investigation → Customer Risk Prioritization
See docs/data_dictionary.md for field
definitions and dataset relationships.
The notebook includes a practical AML-focused EDA workflow:
- Dataset/schema review
- Missing-value analysis
- Duplicate validation
- Datatype and range checks
- Summary statistics
- IQR-based outlier review
- KPI and business-rule validation
- Transaction-channel review
- Geographic-risk review
- Alert-scenario analysis
- Final dataset validation
Potentially unusual or extreme transactions are flagged for investigation rather than automatically removed, because outliers may represent meaningful AML activity.
The customer risk layer contains explainable AML features including:
total_transactionstotal_volumeavg_transaction_amountmax_transaction_amountcross_border_ratiohigh_risk_country_ratiocash_ratiowire_ratiounique_counterpartiesmax_expected_ratiorisk_scorerisk_level
The notebook additionally demonstrates:
high_risk_country_flagstructuring_amount_flagamount_bandhigh_customer_risk_flag
These features are intentionally simple and interpretable so they can be clearly explained during an AML or Financial Crime Analytics interview.
The project demonstrates an end-to-end AML transaction-monitoring and alert-investigation workflow, combining customer risk context, transaction behavior, monitoring scenarios, and risk-based decision support.
| Analysis Area | What It Covers |
|---|---|
| Customer Profile Review | Reviews KYC risk, PEP status, expected monthly activity, occupation/industry, and account context |
| Transaction Behavior Analysis | Analyzes transaction volume, channels, direction, counterparties, cross-border activity, cash/wire behavior, and high-risk jurisdictions |
| Monitoring Scenario Analysis | Evaluates alerts involving unusual volume, high-risk wires, structuring-like activity, rapid movement of funds, and related monitoring scenarios |
| Alert Prioritization | Prioritizes alerts using risk scores, alert amounts, customer risk, and relevant behavioral indicators |
| Investigation Decision Support | Combines alert history, customer AML risk, expected activity, cross-border behavior, prior escalations, and PEP status to support investigation decisions |
Investigation workflow: Customer Profile Review → Transaction Analysis → Scenario Detection → Alert Generation → Risk Prioritization → Investigation Review → Disposition
The SQL file contains 12 analytical queries/statements supporting customer risk analysis, transaction-monitoring patterns, scenario review, alert prioritization, geographic exposure, customer behavior, and investigation workflow analysis.
See sql/ for the complete SQL analysis.
The following KPIs were recalculated from the current processed datasets to validate transaction-monitoring volume, alert exposure, risk prioritization, and investigation outcomes.
| KPI | Current Result |
|---|---|
| Total Customers | 300 |
| Total Transactions | 15,000 |
| Total AML Alerts | 169 |
| Alerted Customers | 68 |
| High-Risk Alerts (Score ≥ 80) | 115 (68.0%) |
| Escalation / SAR-Consideration Alerts | 53 (31.4%) |
| SAR-Consideration Alerts | 11 |
| Total Alerted Amount | $9.5M |
| Average Alert Risk Score | 87.5 |
Investigation insight: The monitoring workflow generated 169 AML alerts across 68 customers from 15,000 transactions. Of those alerts, 115 (68.0%) were high risk, while 53 (31.4%) required escalation or SAR consideration, including 11 specifically identified for SAR consideration.
- The portfolio contains 169 AML alerts across 68 alerted customers.
- 115 alerts (68.0%) have risk scores of 80 or above.
- 53 alerts (31.4%) are marked for case escalation or SAR consideration.
- 11 alerts specifically reached SAR consideration.
- The largest alert scenario is Unusual Volume Spike (90 alerts).
- Total alerted transaction activity is approximately $9.5M.
- The customer-risk layer is dominated by Moderate risk (190 customers), with higher-risk customers isolated for focused investigation.
These findings support investigation prioritization and analyst review; they do not automate SAR filing or regulatory decisions.
The Streamlit application provides an interactive investigation environment.
- Scenario
- Disposition
- Minimum Alert Risk Score
The application classifies the selected alert population as:
- Routine Monitoring
- Targeted Investigation Required
- Heightened AML Risk
The decision logic considers High-Risk alert concentration and the share of alerts already at case-escalation or SAR-consideration stage.
For a selected customer, the application combines:
- KYC risk
- AML risk score and level
- PEP status
- Expected monthly volume
- Observed transaction volume
- Cross-border ratio
- Unique counterparties
- Alert history
- High-risk alerts
- Prior escalations
It then produces an explainable recommendation:
- Escalate for Further Investigation
- Enhanced Review Required
- Targeted AML Review
- Close / Continue Routine Monitoring
The recommendation is clearly presented as analyst decision support rather than an automated SAR-filing decision.
- Risk-Ranked Alert Queue
- Customer 360
- Portfolio Analytics
- Tableau Gallery
The Tableau Gallery already follows the preferred portfolio structure and displays only the Executive Dashboard.
The executive dashboard is synchronized to the current processed datasets and presents:
- Alerts Over Time
- Alerts by Scenario
- Top 5 Countries by Alerted Amount
- Customer Risk Distribution
- Top 5 Alerted Customers
- Alert Disposition
Dashboard KPI reconciliation: 300 customers, 15,000 transactions, 169 alerts, 115 high-risk alerts, 68 alerted customers, and approximately $9.5M in alerted amount. Alert dispositions reconcile to 62 Close - No Suspicion, 54 Pending, 42 Escalate to Case, and 11 SAR Consideration.
This dashboard uses synthetic portfolio data for educational and demonstration purposes.
Customer Profile
↓
Raw Transactions
↓
EDA & Data Quality Validation
↓
Feature Engineering
↓
Enriched Transactions
↓
Transaction-Monitoring Alerts
↓
Alert Investigation & Customer Risk Review
↓
Escalation / Closure Decision Support
↓
Tableau + Streamlit Reporting
| Technology | Application in This Project |
|---|---|
| Python / Pandas | EDA, data validation, feature engineering, customer-risk analysis, and AML alert analytics |
| SQL | Transaction monitoring, scenario analysis, alert investigation, customer-risk analysis, and behavioral pattern review |
| Tableau | Executive AML transaction-monitoring dashboard, KPI tracking, and risk visualization |
| Streamlit | Interactive AML investigator workbench, alert review, filtering, and decision support |
| Jupyter Notebook | Reproducible EDA, feature-engineering, validation, and analytical workflow |
| Git / GitHub | Version control, project documentation, and portfolio presentation |
Transaction-Monitoring/
├── app/ # Streamlit investigator workbench
├── data/ # Synthetic raw and processed datasets
├── docs/ # Data dictionary and supporting documentation
├── images/ # Executive dashboard
├── notebooks/ # EDA and feature engineering
├── sql/ # AML analytical queries
├── src/ # Supporting analytical logic
├── tableau/ # Tableau workbook
├── .gitignore
├── .python-version
├── main.py
├── pyproject.toml
├── requirements.txt
├── uv.lock
└── README.md
git clone https://github.com/Denis0242/Transaction-Monitoring.git
cd Transaction-Monitoring
pip install -r requirements.txt
streamlit run app/streamlit_app.py- Transaction Monitoring
- AML Alert Investigation
- Alert Triage & Prioritization
- Customer Risk Assessment
- KYC Context Review
- PEP Risk Review
- Structuring Analysis
- High-Risk Wire Analysis
- Cross-Border Risk
- High-Risk Jurisdiction Analysis
- Counterparty Review
- Alert Escalation
- SAR-Consideration Analysis
- Investigation Documentation
- Exploratory Data Analysis
- Feature Engineering
- Data Quality Validation
- SQL
- Python / Pandas
- Risk Scoring
- KPI Development
- Trend Analysis
- Behavioral Analysis
- Business-Rule Validation
- Tableau
- Streamlit
- Alert Queues
- Customer 360
- Executive Dashboards
- Interactive Filtering
- Investigation Storytelling
This project uses synthetic data created for educational and portfolio purposes. No real customer, transaction, account, AML alert, SAR, bank, or confidential financial-institution information is included.
Monitoring scenarios, thresholds, risk scores, dispositions, engineered features, alert-prioritization logic, and decision-support recommendations are illustrative. They should not be interpreted as actual financial-institution policy, regulatory filing determinations, or production transaction-monitoring rules.