Santander UK Plc

Transaction Monitoring

Flags when a customer pays in cash that does not fit their declared business or income, so unexplained cash can be reviewed before it disappears into the system.

Starting threshold:

Cumulative cash deposits > 3x declared expected monthly cash turnover in a rolling 30 days, OR cash > 80% of total credits where the declared profile is not cash-intensive.

First-line owner:

Financial Crime Operations Analyst (transaction monitoring team)

Transaction Monitoring

Compares what a customer actually does on the account with what they told you they would do at sign-up, and flags when the two no longer match.

Starting threshold:

Monthly throughput > 3x declared expected throughput in a rolling 30 days, OR appearance of a transaction dimension not in the declared profile (e.g. first international payment on a 'domestic only' account, or first business-pattern flow on a personal account).

First-line owner:

Financial Crime Operations Analyst (transaction monitoring team)

Transaction Monitoring

Spots money that arrives and leaves almost immediately, where the account is being used as a channel to move funds on rather than to hold or spend them.

Starting threshold:

Outbound >= 90% of a qualifying inflow within 24 hours, with residual balance returning to < 10% of the inflow, occurring 2+ times in a rolling 7 days.

First-line owner:

Financial Crime Operations Analyst (transaction monitoring team)

Transaction Monitoring

Finds accounts being used by other people to receive and pass on dirty or stolen money, and links them together when they are part of the same ring.

Starting threshold:

Account receiving from 3+ unrelated payers and forwarding >= 80% within 48 hours, scored higher where account age < 90 days; cluster alert where 3+ accounts share a device/IP and forward to a common beneficiary within a rolling 14 days.

First-line owner:

Fraud / Financial Crime Operations Analyst (mule investigations)

Transaction Monitoring

Regularly tests and adjusts monitoring rule settings so the firm catches real risk without drowning analysts in pointless alerts, with evidence for every change.

Starting threshold:

Trigger a tuning review for any scenario whose true-positive yield falls below 5% (over-alerting) or whose below-the-line sample shows any productive (SAR-worthy) activity in the just-missed band (under-alerting); each change requires simulated impact and documented sign-off.

First-line owner:

TM Optimisation / Detection Engineering Analyst

Governance & Reporting

A clear, fast route for staff to raise a suspicion, for the MLRO to decide, and for a report to reach the authorities on time without tipping off the customer.

Starting threshold:

Internal report acknowledged by the nominated officer within 1 business day; SAR submitted to the NCA within 5 business days of the decision to disclose; DAML requested before any consent-dependent act, with no transaction processed against a pending defence.

First-line owner:

Financial Crime Operations / investigators raising and drafting internal reports

Governance & Reporting

Regular, honest numbers and trends about financial crime risk put in front of senior leaders, so problems are seen and acted on instead of being buried.

Starting threshold:

A defined financial crime MI pack delivered to the relevant committee at least quarterly and to the board at least twice a year; every red indicator accompanied by cause, owner and dated remediation; no material adverse trend reported without narrative.

First-line owner:

Financial Crime Operations / MI team compiling the pack

Governance & Reporting

Stop financial crime alerts and cases piling up unworked by tracking how old they are, fixing the cause, and stepping in fast when the queue grows.

Starting threshold:

Standard alerts worked within their queue SLA (e.g. 5 business days); high-risk and sanctions items within 1-2 business days; backlog trigger at a defined threshold (e.g. >2% of open items past SLA, or any sanctions item past SLA) invoking the remediation playbook; oldest open item tracked and capped.

First-line owner:

Financial Crime Operations team lead (queue management and throughput)