# What is Batch monitoring? Batch monitoring reviews transactions in grouped runs on a schedule, such as nightly or daily, instead of checking each one the moment it happens. It fits after-the-fact AML detection, where the goal is spotting patterns over a period, which makes it efficient for pattern work but blind to anything happening right now. ## What is batch monitoring? Batch monitoring processes transactions in **grouped runs on a schedule** rather than one at a time as they occur. Instead of evaluating every payment in the moment, the system gathers a period's worth of activity, often a full day, and runs the monitoring rules over the whole set at once, typically overnight. That rhythm suits **after-the-fact AML detection**. Money laundering usually reveals itself as a pattern across many transactions over time, structured deposits, layering, unusual aggregate flows, and those patterns are easier to see when you look at a batch of activity together than at any single payment. Batch monitoring is built for that kind of pattern work. The tradeoff is timing. Because it runs on a schedule, it is **blind to what is happening right now**. It cannot stop a payment before it settles, which makes it efficient for detecting trends but unsuitable on its own for anything that requires stopping a transaction in real time. ## Batch vs real-time monitoring | | | | | --- | --- | --- | | What changes | Batch monitoring | Real-time monitoring | | Timing | Scheduled runs, often nightly. | Evaluates each transaction as it happens. | | Best for | Pattern detection over a period. | Stopping a payment before it settles. | | Can interdict? | No; it reviews after the fact. | Yes; it can hold or block in the moment. | | Typical use | AML trend and typology detection. | Fraud and sanctions blocking. | ## How a batch run works 1. **Collect** — Gather the period. Accumulate a scheduled window of transactions, such as a full day of activity. 2. **Run** — Apply the rules. Process the whole batch through the monitoring scenarios at once, usually overnight. 3. **Detect** — Surface patterns. Identify aggregate patterns across the batch that single-transaction checks would miss. 4. **Alert** — Queue for review. Generate alerts on the flagged patterns for analysts to investigate after settlement. ## What it looks like in practice Overnight, the batch run processes the day's transactions for a customer who made several cash deposits, each just under a reporting threshold, at different branches. No single deposit looked remarkable in the moment, so nothing would have stopped them one at a time. Seen together in the batch, they form a clear structuring pattern and the run raises an alert. An analyst picks it up the next morning and works the pattern toward a possible SAR. That is exactly what batch monitoring is good at. But the team also knows its limit: a sanctions hit or a fraudulent payment that needs to be stopped before it settles cannot wait for the nightly run, so real-time transaction screening runs alongside it for interdiction. ## Why it matters for operators Batch monitoring is the efficient workhorse of AML detection, because laundering shows up as a pattern over time and a scheduled run over grouped activity is the natural way to see it. It uses resources sensibly and surfaces the aggregate behavior that single-transaction checks cannot, which is why it remains a core part of most monitoring programs. The operator's job is to know its limit. Batch cannot stop a payment before it settles, so it is the wrong tool on its own for real-time fraud or sanctions blocking, where transaction screening and real-time monitoring are required. Use batch for trends and typologies, and pair it with real-time controls for anything that needs interdiction in the moment. ## What to watch in the data - **No interdiction.** Batch cannot stop a payment before settlement; do not rely on it for real-time fraud or sanctions blocking. - **Detection lag.** Activity flagged overnight has already completed, so response time is measured in hours, not seconds. - **Pattern strength.** Batch shines on cross-transaction patterns like structuring and layering that single checks miss. - **Coverage pairing.** Real-time screening should run alongside batch to handle anything requiring interdiction. - **Run integrity.** A failed or delayed batch run means a day of activity goes unreviewed until it completes. ## Quick questions ### How is batch monitoring different from real-time monitoring? Batch monitoring reviews grouped transactions on a schedule, such as nightly, after they have occurred. Real-time monitoring evaluates each transaction as it happens and can stop it before it settles. Batch is for patterns; real-time is for interdiction. ### Why is batch monitoring good for AML? Because money laundering typically appears as a pattern across many transactions over time, and those patterns are easier to detect when a period's activity is analyzed together. Batch runs are efficient at that kind of after-the-fact pattern work. ### Can batch monitoring stop a fraudulent payment? No. Because it runs after transactions occur, it cannot stop a payment before it settles. For real-time fraud and sanctions blocking you need transaction screening and real-time monitoring instead. ### Should I use batch or real-time? Usually both. Use batch for trend and typology detection where the goal is spotting patterns over a period, and real-time controls for anything that must be interdicted in the moment. They cover different needs and complement each other. ### What is the main risk of relying on batch alone? You have no ability to interdict. Anything that requires stopping a transaction before it completes, a sanctions match or an in-progress fraud, will settle before the next batch run sees it, leaving you to react after the money has moved.