14.3 Communicating Monitoring Results: KPIs, KRIs, OKRs, and Management Information
Key Takeaways
KPIs measure performance, such as backlog age and SAR timeliness, while KRIs warn of rising risk, such as fast growth in high-risk segments.
An OKR pairs a qualitative objective with measurable, time-bound key results, often set quarterly.
SAR conversion rates and QA error rates measure the effectiveness of monitoring, not just analyst throughput.
Monitoring MI should explain changes in context, such as rule changes or customer growth, and should never set SAR quotas.
CAFCA sub-topic 3.9 covers best practices for communicating transaction monitoring trends and results, including KPIs, OKRs and other statistics. Monitoring generates a lot of data. The skill lies in turning it into information that leaders can act on, and that partner banks and supervisors trust.
Who needs monitoring MI and why
| Audience | What they need to decide |
|---|---|
| Board or risk committee | Is financial crime risk within appetite? Are resources adequate? Are issues being fixed? |
| Senior management | Where to invest (staff, tools, tuning); which products or corridors to restrict |
| Partner bank | Is the FinTech's programme effective? Are referrals timely? Do they need to step in? |
| Regulators | Evidence of effectiveness, timeliness and governance |
| Operations leads | Daily staffing, queue priorities, quality issues |
Building the metric set
Operational KPIs (efficiency and timeliness):
- Alert volumes by scenario, product and segment.
- Alerts closed per analyst, and handling time.
- Backlog size and ageing, for example 0 to 10, 11 to 20, 21 to 30 and more than 30 days.
- Service-level adherence for triage, investigation and SAR filing.
Effectiveness measures:
- Escalation rate (alert to case) and SAR conversion rate (case to SAR) by scenario.
- SAR timeliness: the share filed within the legal deadline.
- QA error rate: the share of closures that fail quality review.
- True-positive yield by rule: which scenarios produce useful outcomes, and which only create noise.
- Law enforcement feedback, information requests received, and funds frozen or losses prevented, where measurable.
Coverage measures:
- Scenario coverage mapped to the risk assessment: is each high-risk typology monitored?
- Data feed completeness: share of transaction streams ingested, and exceptions.
- Model and rule changes made, tested and validated.
Key risk indicators (KRIs) are forward-looking warnings, such as growth in high-risk customers, new corridors, rising fraud claims, staff turnover in the investigations team, or backlog growth faster than capacity.
OKRs for monitoring improvements
An OKR links a qualitative objective to two to five measurable, time-bound key results. OKRs are often set quarterly.
- Objective: Clear the investigation backlog without lowering quality.
- KR1: Alerts older than 30 days reduced to zero by the end of Q2.
- KR2: QA pass rate at 95% or above every month.
- KR3: Median time from alert to disposition under 5 business days.
- Objective: Improve detection of mule networks.
- KR1: Device-link scenario live and validated by the end of Q3.
- KR2: Share of mule SARs generated by the new scenario reported monthly.
Good OKRs target outcomes and quality, not raw volume. Never set SAR quotas. A target of "file 20% more SARs" pushes defensive filing and weakens the value of the reports.
Communicating trends well
- Show trends over time, not single snapshots.
- Normalise: alerts per 1,000 customers or per million transactions, so that growth does not mislead.
- Explain changes: "SAR conversion fell from 8% to 3% after the new velocity rule went live in March. Most new alerts are low-risk subscription payments, and tuning is scheduled."
- Compare with appetite using clear thresholds, such as red-amber-green status against board limits.
- State actions, owners and dates, so that MI drives decisions.
- Keep SAR-sensitive details out of broad distribution. Report aggregates, not customer-level SAR information, outside the restricted circle.
A sample monthly MI layout
| Section | Content |
|---|---|
| 1. Headline | Three to five sentences: status against appetite, key changes, decisions needed |
| 2. Volumes and capacity | Alerts by scenario (normalised), staffing, handling time, backlog ageing chart |
| 3. Effectiveness | Escalation and SAR conversion by scenario, SAR timeliness, QA results |
| 4. Coverage and data | Feed completeness, rule changes and validation status, open model issues |
| 5. Risk outlook | KRIs, emerging typologies, upcoming product launches that affect monitoring |
| 6. Actions | Open remediation items with owners, due dates and status |
Partner banks often specify the MI they want in the programme agreement. Agree definitions early, so that the FinTech's figures and the bank's own analysis tell the same story.
Pitfalls
- Vanity metrics, such as "alerts closed", without any quality or outcome measures.
- Unexplained spikes or drops, which raise doubts about data integrity.
- Metrics that conflict with each other. Rewarding speed alone can push analysts into shallow closures.
- Different definitions across reports. Fix them in a metric dictionary.
Realistic exam scenario
A neobank's board pack shows "Alerts closed: up 40%" and the status "green". It does not show that alerts older than 30 days doubled, that QA failures reached 18%, or that a payment stream was missing from monitoring for three weeks. The pack misleads. The MLRO should redesign the MI to cover backlog ageing, QA results, data-feed completeness and explained trends against appetite, with actions and owners.
Common exam traps
- Confusing KPIs with KRIs. Performance measures look back; risk indicators warn of what is coming.
- Setting SAR targets.
- Reporting absolute numbers without normalising for growth.
- Including customer-level SAR details in widely circulated reports.
Which metric is a key risk indicator (KRI) rather than an operational KPI?
Monthly growth in customers paying out to high-risk corridors
Percentage of alerts triaged within 24 hours of being generated
Average alerts closed per analyst per day
Average handling time per alert
Which is the best-constructed OKR key result for a monitoring improvement objective?
Have a noticeably better working relationship with the partner bank by the end of the year
Work harder on alerts and aim to be faster than last quarter
File 25% more SARs than last year to show greater vigilance
Zero alerts older than 30 days by end of Q2, with QA pass rate at or above 95%
SAR conversion falls sharply in the month after a new monitoring rule goes live. What should the MI do?
Report the lower figure without any comment, because the board can interpret the data itself
Explain the cause, such as low-value alerts from the new rule, and give the tuning plan and owner
Raise the thresholds of all rules immediately to restore the previous conversion ratio
Remove SAR conversion from the pack until the figure recovers
Sections you finish are checked off in the contents.