AUSTRAC Transaction Monitoring for Remittance: Rules, Corridor Thresholds, Alerts and Reviews

A remitter that only watches for cash of AUD 10,000 or more is not monitoring. Threshold reports are a reporting duty, not a monitoring programme. AUSTRAC expects ongoing, risk-based monitoring of customers and transfers: rules that reflect your corridors and customers, alerts that reach the right person, reviews that are consistent and recorded, and suspicions reported on time.

This guide is for compliance officers and analysts at Australian remittance businesses who design, run or tune monitoring. It covers how to build rules, set AUD thresholds by corridor, route alerts, review them and decide when to report. It is general guidance, not legal advice: confirm your obligations against AUSTRAC's guidance or with an adviser. For the full list of obligations and a compliance calendar, see our AUSTRAC compliance guide; if you are not yet registered, start with the money transfer licence in Australia.

Your AML/CTF programme must include systems and controls to monitor customers and transactions on an ongoing basis, so that you can identify activity that is unusual or suspicious and respond to it. In practice an examiner will look for four things:

• Rules that follow your risk assessment. If the assessment says a corridor is higher risk, the rules for that corridor should be tighter. Generic rules copied from elsewhere suggest the assessment was not used.
• Coverage. Every customer, every transfer, every channel. Monitoring that only applies to transfers above a value misses the patterns that matter most in remittance, such as many small transfers.
• Consistent review. Alerts are reviewed by trained people, within set times, with reasons recorded.
• Action. Reviews lead somewhere: a document request, enhanced due diligence, a suspicious matter report, an exit. A system that raises alerts nobody acts on is worse than no system, because it proves you knew.

Monitoring sits between due diligence and reporting. It decides when you need to know more about a customer, and it feeds the suspicions you report.

A good monitoring rule combines several indicators, each of which alone would be weak. A transfer to a new recipient is normal. A transfer to a new recipient, paid with a card used by another customer, from a sign-in IP in a different country to the customer's address, is worth a person's time.

Group your indicators by what they tell you:

• Who: sanctions and watch list matches for customer, recipient and payment holder; possible duplicate customers; mismatches between profile and document data; a name on the payment that does not match the customer.
• Where: identity document, payment details or sign-in IP linked to a high-risk or FATF call-for-action country; IP and payment-instrument country mismatch; IP reputation.
• How much and how often: transaction frequency and volume; frequent transfers to the same recipient; linked transaction patterns across customers.
• How paid: multiple payment methods; payment details reused across customers; card warning signs such as repeated declines or chargeback history.
• History: a previous internal suspicious report; a customer flagged for suspicious behaviour; a new customer with no baseline yet.

Write each rule with a stated purpose ("detect structuring below the source-of-funds tier"), the indicators it combines, what happens when it fires (hold, review, ask for documents) and who reviews it. Our guide to building complex risk rules safely covers testing rules before they go live, and transaction monitoring rules best practice covers rule design in more depth.

A single threshold for every corridor is either too tight for low-risk routes or too loose for high-risk ones. Set limits and document tiers per corridor, and measure them over several windows, so a customer cannot avoid a monthly tier by spreading transfers across months.

Three practical points. First, document what each tier asks for and make sure every corridor can actually collect it; asking for a document a corridor's flow cannot capture leaves customers stuck. Second, allow exceptions per corridor rather than weakening the base rule for everyone. Third, keep a history of every change and its reason; an examiner will ask why a threshold moved. For handling overrides, see AML transaction limits, overrides and exceptions.

Screening at onboarding is not enough. Sanctions lists change, and a customer cleared last month can match a name added today. Screen every sender and recipient on each transfer, include the Australian sanctions list alongside the international lists relevant to your corridors, and re-screen existing customers when lists change.

A possible match should go to a person for a decision, not be silently passed or automatically rejected. Record the decision and reason per person, so the same false positive is not raised repeatedly. For the detail, see sanctions screening for remittance companies.

An alert without an owner waits. Decide who receives each type, how quickly they respond and what they do first.

Keep the number of people who can clear alerts small and trained, and make sure nobody clears an alert on a transfer they created. Routine operations should run by exception, so analysts spend their time on what needs judgement; see running remittance operations by exception.

Consistency is what makes a review defensible. Use the same sequence for every alert:

1. Why did it fire? Read which indicators triggered and their values.
2. Who is the customer? Profile, documents, stated purpose, previous alerts and decisions.
3. What is the pattern? This transfer in the context of the customer's history and any linked customers or recipients.
4. Is there an innocent explanation, and can you evidence it? A payslip, a family relationship, a known event.
5. Decide and record. Release, request documents, apply enhanced due diligence, escalate to the compliance officer, or both hold and report. Write the reason in a sentence someone else could follow.

Measure the process: alerts by type, time to close, how many led to action. A rule that fires often and never leads to action needs tuning. A rule that has never fired may not work at all. See AML investigation and case management for running cases that span several alerts.

When a reviewer forms a suspicion, the reporting clock is running. Suspicious matter reports are generally due within three business days of forming the suspicion, and within 24 hours where terrorism financing is suspected. A review process that needs a week of investigation before anyone admits suspicion is a timing problem.

• Escalate early. Analysts escalate on reasonable grounds; the compliance officer decides whether to report.
• Write the grounds clearly. What you saw, why it is unusual for this customer, and what you checked.
• Do not tip off. Staff must not tell the customer, directly or by implication, that a report is being considered or was made.
• Feed it back into monitoring. A reported customer should be watched more closely afterwards, and the decision recorded either way.

Our guide to suspicious activity reports covers writing a good report.

The details are illustrative, not drawn from any real operator.

A customer onboarded six weeks ago, stating she supports her parents. Her higher-risk corridor has a 90-day source-of-funds tier at AUD 8,000.

Days 1 to 10. She sends AUD 1,900, AUD 1,950, AUD 1,850 and AUD 1,900, each below the per-transfer hold. Her 90-day total reaches AUD 7,600, just under the tier. Each transfer goes to one of three recipients, two of them new.

Day 11. A fifth transfer of AUD 1,900 is attempted. The rule for frequent transfers to the same recipients combines with linked transaction patterns: one of the recipients has also received from two other customers who share a sign-in IP range. The transfer waits for a person and the 90-day tier is crossed, so the app asks for a source-of-funds document.

Day 11, review. The analyst reads the indicators, sees the near-tier pattern and the shared recipient, and checks the other two customers. Their stated purposes do not explain sending to the same person. She escalates.

Day 12. The compliance officer decides there are reasonable grounds for suspicion, prepares a suspicious matter report from the console and submits it within the deadline. The three customers are marked for closer monitoring; customer service is told only that queries go to compliance.

RemitSo's admin panel turns a monitoring design into rules, alerts and records. See the admin features.

• 46 ready-made risk indicators combined into your own rules with logical conditions, and Risk Radar showing evaluated indicators and outcomes: reviewers see why a transfer was flagged.
• Risky transfers wait for a person; everything else flows on its own: analysts spend time on judgement, not routine transfers.
• AML rules per currency, paying country and payout country, including AUD, with corridor exceptions: thresholds fit each corridor's risk.
• Windows for every transaction, 1 day, 1 month, 90 days and 1 year, with document tiers: spreading transfers does not avoid a tier.
• Sanctions screening against 8 lists loaded nightly, including Australian DFAT, with re-screening when lists change and rulings kept per person.
• 43 alert events, each with subscribers, including possible sanction match, manual review, high customer risk score and an AML policy asking for a document the corridor cannot collect: every alert reaches its owner.
• Suspicious activity reports generated, managed and submitted from the console: in Australia, your suspicious matter reports start where the review happened.
• History of changes on AML rules, showing who last changed each rule: you can explain every threshold move to an examiner.

Your team still designs the rules from your risk assessment, reviews every alert, forms the suspicion and decides whether to report. Read the release notes or book a demo.

• AUSTRAC: Overview of ongoing customer due diligence
• AUSTRAC: Enhanced customer due diligence
• AUSTRAC: Suspicious matter reports
• AUSTRAC: Tipping off
• AUSTRAC: Threshold transaction reports
• FATF: High-risk and other monitored jurisdictions

Checked October 2026. Regulations change; confirm current requirements with the regulator or your adviser.