Monitoring does not stop when a transaction is flagged

What the action actually found

Nine institutions were penalised and the total came to S$27.45 million. MAS cited three areas: shortcomings in customer risk assessments, failures to trace the sources of customers' wealth, and insufficient monitoring of transactions that had been flagged as suspicious.

The framing in the findings is the part worth sitting with. Most of the institutions had established policies. The breaches arose from how those policies were carried out.

A missing control is a visible gap. Somebody writes the policy, it gets approved, the gap closes. Inconsistent execution does not show up in any document.

Why that is harder than a missing policy

The policy says the right thing. The procedure says the right thing. The work just does not always happen that way, on every case, on a Thursday afternoon when the queue is long.

You cannot audit your way out of that by reading the manual, because the manual is fine.

This is also why a finding of this kind rarely produces a useful remediation plan on the first attempt. The obvious response is to rewrite the procedure, and the procedure was never the problem.

The third finding is the operational one

Insufficient monitoring of transactions flagged as suspicious describes a specific failure mode, and it is common.

An alert fires. Someone looks at it, forms a view and dispositions it. The case is closed and the queue moves on.

What frequently does not happen is the follow-through: continuing to watch an account once it has given you a reason to watch it.

Flagging is an event - monitoring is a state. Teams under volume pressure treat the second as though it were the first, because the first one closes a ticket and the second one does not.

What that looks like in a real queue

• The alert was reviewed, but the account was never revisited
• Two alerts on the same customer months apart were handled by different analysts who never saw each other's work
• The rationale was recorded as a sentence, so nobody later could tell what had actually been checked
• A related account surfaced in the review and was noted, then not followed

Every one of those is a queue problem wearing a compliance costume.

The fix is the same one SAFR describes for any consequential action: prepare the evidence in volume, and keep the decision under control.

Consistency is a volume problem

Here is the uncomfortable part. Execution quality is not mainly a function of how good your analysts are. It is a function of how many cases each of them has to get through today.

Give a capable analyst twenty cases and the work is thorough. Give the same analyst eighty and something gets shortened, and it will be the part that takes longest and shows least, which is usually the evidence gathering.

That is why training the team harder rarely fixes an execution finding. The behaviour is rational under the workload.

What actually moves it

Two things change consistency at volume. Reduce what each case costs in analyst time, and make what was done on each case visible.

CaseLEA is built for the first and produces the second. It assembles the evidence a review needs before the analyst opens the case: account history, counterparty picture, transaction trail, CDD records, prior alerts and prior dispositions on the same customer.

The analyst then spends their time on judgement rather than retrieval. And because the preparation is uniform, the eightieth case of the day arrives in the same shape as the first.

The numbers behind the mechanism

Penalty figures: MAS enforcement action of 4 July 2025. Operational figures: results reported across one active deployment, 2026.

The record that comes out the other side answers the question an examiner actually asks. Not whether you have a policy, because they can read that. What was checked, on this case, on this date, and what was not.

What an execution finding does to a remediation plan

The instinct after a finding of this kind is to strengthen the policy. It is the wrong first move and it is almost always the first move.

A stronger policy adds steps to a process that is already being shortened under volume pressure. The new steps get shortened too, and the second review finds the same thing with more documentation behind it.

The plan that works reduces the cost of doing the work properly. That means evidence assembled before the case is opened, a uniform preparation so the eightieth case arrives like the first, and a record that shows what was checked rather than what was concluded.

None of that changes the policy. It changes whether the policy is followed on a Thursday afternoon.

Four questions for your own operation

• How many cases does an analyst handle on a heavy day, and what gets shortened first?
• When an account is dispositioned, what triggers the next look? If the answer is a new alert, there is no monitoring state.
• Can two analysts see each other's prior work on the same customer without asking?
• Does the record show what was checked, or only what was decided?

Answering those honestly will predict the findings of your next review more accurately than a gap analysis against the policy will.