Starling Bank Limited

Transaction Monitoring

Compares what a customer actually does on the account with what they told you they would do at sign-up, and flags when the two no longer match.

Starting threshold:

Monthly throughput > 3x declared expected throughput in a rolling 30 days, OR appearance of a transaction dimension not in the declared profile (e.g. first international payment on a 'domestic only' account, or first business-pattern flow on a personal account).

First-line owner:

Financial Crime Operations Analyst (transaction monitoring team)

Transaction Monitoring

Spots money that arrives and leaves almost immediately, where the account is being used as a channel to move funds on rather than to hold or spend them.

Starting threshold:

Outbound >= 90% of a qualifying inflow within 24 hours, with residual balance returning to < 10% of the inflow, occurring 2+ times in a rolling 7 days.

First-line owner:

Financial Crime Operations Analyst (transaction monitoring team)

Transaction Monitoring

Finds accounts being used by other people to receive and pass on dirty or stolen money, and links them together when they are part of the same ring.

Starting threshold:

Account receiving from 3+ unrelated payers and forwarding >= 80% within 48 hours, scored higher where account age < 90 days; cluster alert where 3+ accounts share a device/IP and forward to a common beneficiary within a rolling 14 days.

First-line owner:

Fraud / Financial Crime Operations Analyst (mule investigations)

Transaction Monitoring

Uses blockchain analytics to check where crypto sent or received by a customer has been, and flags links to mixers, illicit services or sanctioned addresses.

Starting threshold:

Any direct exposure to a sanctioned or darknet address; OR indirect high-risk exposure > 25% of transaction value within 5 hops; OR aggregate mixer-attributed exposure > 10% of a customer's 30-day crypto volume.

First-line owner:

Crypto Financial Crime Analyst (on-chain investigations)

Screening

Checks every customer and payment against official sanctions lists before money moves, so the firm does not deal with a sanctioned person or entity.

Starting threshold:

Fuzzy match score >= 85% auto-routes to a Level 1 review queue; exact identifier matches (passport, IMO, BIC, LEI) hard-block regardless of name score.

First-line owner:

Screening Operations / Onboarding team

Screening

Regularly tests the sanctions screening engine with known good and bad names to prove it actually catches what it should and is not silently letting hits through.

Starting threshold:

Detection rate on seeded exact-name and identifier test cases must be 100%; detection on transliteration and alias variants must be >= 95%; population and list-ingestion reconciliation must show zero unexplained gap.

First-line owner:

Screening Operations / Sanctions tooling team

Screening

Adjusts how loosely or tightly the screening engine matches names so it keeps catching real hits while cutting the flood of false alarms.

Starting threshold:

Auto-review threshold set no higher than the lowest confirmed true-positive score minus a safety margin (typically keeping the review cut-off at 85% unless evidence supports otherwise); any proposed increase requires a passing seeded-detection re-test.

First-line owner:

Screening tooling / Sanctions configuration team

Transaction Monitoring

The firm spots when someone other than the real customer has gained control of an account, by watching for sudden changes in device, login and payment behaviour.

Starting threshold:

Hold and step-up when, within 60 minutes, an account shows a new-device login AND a contact-detail or credential change AND a new-payee payment; force step-up on any new-device login followed by a faster-payment to a new payee exceeding GBP 1,000.

First-line owner:

Fraud Operations / Transaction Fraud team