Ongoing monitoring is the only part of a firm's AML work with no natural end. It runs every day, on every client the firm has ever taken on, and nobody is waiting for the result. No fee earner is chasing it and no file is blocked by it. That is exactly why it is the part of the risk policy that most often stops being applied without anyone having decided it should.
When an MLRO describes a monitoring backlog, the explanation is almost always workload. We think the problem sits earlier than that. A backlog is usually what you get when a handful of decisions the policy depends on were never made, or were made once by a vendor and never revisited.
What the rules actually ask for
The duty itself is short. Regulation 28(11) of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, the MLRs, requires a firm to "conduct ongoing monitoring of a business relationship", including scrutiny of transactions through the course of the relationship and "undertaking reviews of existing records and keeping the documents or information obtained for the purpose of applying customer due diligence measures up-to-date". Where the client is a politically exposed person, regulation 35(5)(c) adds "enhanced ongoing monitoring" for the life of the relationship and for at least 12 months after the person leaves office.
The part a COLP or MLRO should keep in mind is a few paragraphs further down. Regulation 28(16) says the firm "must be able to demonstrate to its supervisory authority" that the extent of its measures is appropriate to the risks it has identified. It is not enough that monitoring was switched on at some point. The firm has to be able to show that it ran, on terms the firm chose, and that a person looked at what came back.
Where the policy stops
Look inside most monitoring queues and the trouble is rarely the number of alerts. It is that the queue reflects decisions nobody in the firm remembers taking.
The first is what to watch. Most firms inherit their monitoring from a vendor's defaults: screen against every list, alert on every change, leave it to the reviewers. The firm's written policy will say it cares about sanctions, about PEPs at certain levels, about particular kinds of adverse media. The queue says something broader, and when the two disagree the reviewers learn to skim. A compliance team that skims is not applying a risk appetite. It is working around the absence of one.
The second is who owns the alert. Every alert is a question the policy has asked, and a question needs a person to answer it. In practice alerts go to a shared inbox, or to whoever happened to run the original check, or to a reviewer who left in August and whose account can no longer log in. An alert with no owner is a decision that will not get made, and however hard the team works in November it does not recover the weeks the alert sat there.
The third is whether the firm can show any of it happened. Monitoring that took place and monitoring that can be demonstrated are different things. A regulator, an auditor or an insurer does not ask whether the firm has a monitoring tool. They ask who looked at this client, when, what they had in front of them and what they decided. If that has to be reconstructed from email, the control existed mainly as a paragraph in the policy document.
Will Taylor, chief financial and operating officer at Hall Brown Family Law, put the underlying idea plainly when the firm wrote about its own approach: "It's not about monitoring every transaction daily. It's about having the visibility to catch problems before they become serious, and the audit trail to demonstrate that the firm's processes are robust when regulators ask. It's about 'exception reporting' and not 'everything reporting'" (Hall Brown Family Law customer story).
A worked example
Take a 40-partner firm with roughly 3,000 individual and business clients under monitoring. A senior reviewer leaves at the end of August. Her open alerts stay assigned to her account, and because deactivated users drop out of the dashboard filters, nobody else sees them. In November, with a desk-based review approaching, the MLRO goes looking and finds 140 alerts against the departed reviewer, the oldest from July. Most are routine. A handful need a decision. Two are on clients whose matters completed in September, where the firm's own policy said monitoring should have stopped.
The firm's policy was fine and so were its people. It lost three months of monitoring on 140 clients because one account stopped existing and nothing surfaced the gap. The figures are made up, but anyone who has inherited a monitoring queue will recognise the shape.
Three decisions, made once
None of this is solved by reviewing faster. It is solved by the firm taking three decisions, writing them down, and having the platform apply them to every client from then on. That is why Custom monitoring sits inside Governance in Legl rather than being treated as a feed of alerts.
The first decision is what generates an alert. In Legl an admin chooses which categories the firm monitors for individuals, narrowed to the risk types the policy actually names. For business clients the admin chooses which company changes count as an alert and, where the alert supports it, whether it comes through as high, medium or low priority. Firms can also run new settings against its own monitoring activity from the last 90 days and see how many of those events would have produced an alert. Every change is recorded with who made it and when. Deciding not to alert on something is a policy decision too, and once it is written down it is one the firm can defend.
The second decision is who owns each alert before it arrives. Auto-assignment in Legl routes every new alert to a named person according to its type: a company monitoring alert to whoever created the company report, a business sanctions alert to whoever ran the screening, an individual watchlist alert to the CDD reviewer. The audit trail records that it was assigned automatically and to whom.
Helen Strachan, practice director and MLRO at Burnett & Reid, described what being told directly does for an MLRO, in her case about Legl's high-risk assessment alerts: "Getting that email notification lets me act fast. I am no longer relying on human interaction to be alerted of cases I need to focus on" (Burnett & Reid customer story). The same principle holds for monitoring. If the policy relies on someone remembering to check, it is relying on the one thing that leaves with the person.
The third decision is who sees the whole position, and how often. Every Monday, Legl sends the people the firm names a summary email with the subject line "Your monitoring backlog this week", followed by the number of alerts waiting. One MLRO at a firm that has used Legl for several years told us that monitoring used to be his bugbear. He now gets alerts as they happen and the Monday summary at eight o'clock, and the hour he used to spend each Monday working out what was outstanding goes on deciding what to do about it.
When a reviewer opens an alert, the evidence has already been gathered and the sources recorded. For the purposes of governance the point is narrower: the decision stays with a person, and the record shows which person.
The stakes
Ongoing monitoring is the control that runs for longest and gets looked at least. A backlog is not a sign that the team has fallen behind. It is a sign that the firm's risk policy stopped being applied on a date the record can identify, and that nobody was positioned to notice.
Governance in Legl exists to close that gap: to apply your firm's risk policy and procedures consistently across every client, including the ones you took on three years ago, with the decision staying with a person and the record showing it. If you would like a second opinion on how your own monitoring position would read on a Monday morning, Legl's UK team is happy to have that conversation.
Sources
- The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, regulation 28 (ongoing monitoring, paragraphs (11) and (16))
- The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, regulation 35 (enhanced ongoing monitoring of PEPs, paragraphs (5)(c) and (9))
- Hall Brown Family Law customer story (Will Taylor quote)
- Burnett & Reid customer story (Helen Strachan quote)
