Monitoring rule review: stages and deadlines
A monitoring rule review moves through five stages: trigger identification, evidence gathering, rule testing, sign-off and rollout. In most obliged entities the full cycle takes between two and six weeks, depending on how many rules are affected and whether senior management approval is required. The clock starts at the trigger, not at the first meeting.
Why the rule comes up for review
A transaction monitoring rule is reviewed when something changes its performance or its risk relevance. Typical triggers include a spike in false positives, a new product line, a supervisory finding, or a change in customer base. None of these triggers pause other obligations running in parallel. The review clock and the reporting clock are separate.
The point of no return in this procedure is the sign-off. Before sign-off, a draft rule can still be reshaped without formal consequence. After sign-off, any further change is itself a new review, with its own record and its own timeline.
Stages and timeline
| Stage | Typical duration | Owner | Output |
|---|---|---|---|
| Trigger identification | 1–3 days | Monitoring analyst | Trigger log entry |
| Evidence gathering | 3–7 days | Compliance team | Data pack, alert sample |
| Rule testing | 5–10 days | Monitoring analyst / IT | Test results, tuned thresholds |
| Sign-off | 1–5 days | MLRO or senior management | Approval record |
| Rollout | 1–3 days | IT / operations | Live rule, change log |
Delays cluster at evidence gathering, when the data pack depends on other teams, and at sign-off, when the approver is unavailable. Building in a named deputy approver removes most of that delay.
What to do
- Record the trigger the day it appears. The monitoring analyst logs the source, the date and the affected rule.
- Assemble the evidence pack. The compliance team pulls alert volumes, false-positive rates and any relevant customer feedback.
- Run the test on a defined sample. The analyst compares old and new thresholds side by side, not sequentially.
- Draft the change note before the sign-off meeting. The note states what changes, why, and what the expected effect is.
- Obtain sign-off from the named approver. The MLRO or senior management signs a dated record, not a verbal approval.
- Deploy and log. IT confirms the go-live date and the change log entry closes the review.
Who decides
The MLRO, or an equivalent senior compliance function, owns the final decision on whether a rule change goes live. For changes with material risk impact, senior management sign-off is added before deployment. There is no external forum for this decision: it is internal, and it must be documented internally, with a dated record that a supervisor can request later.
Where the review is triggered by a supervisory finding rather than an internal metric, the same internal process applies, but the resulting change note is usually referenced in the entity's response to the supervisor. That response follows its own separate procedure and its own separate deadline.
If your situation differs
The stages above assume the review runs on its own. In practice it often runs alongside another process, and the two clocks do not merge.
- If the review coincides with a change in ownership structure, the internal sign-off for the rule can proceed independently, but the underlying data used for testing may need to reflect the new structure once A shareholder change requires approval authorisation who decides and is resolved.
- If the monitoring system itself runs on licensed software and a vendor dispute arises over reuse rights, that question runs on a separate track: see When a sublicence appears without consent. It does not pause the rule review clock.
- If the monitoring engine relies on a patented detection method and a family-wide procedural deadline is approaching, that deadline is unrelated to the internal review but worth tracking in parallel: When the opt-out window is closing on a family.
- If the hosting arrangement behind the monitoring platform is changing region during the review, confirm the new processing location before sign-off, since the change note should reflect where the data actually sits: When a hosting provider changes region.
What this page does not cover
This page describes the internal stages of a rule review. It does not set out the specific reporting deadlines that apply once a rule change leads to a suspicious activity finding, and it does not cover the substantive design of the rule itself. It also does not address what happens when a review is triggered directly by a formal regulatory questionnaire; that process has its own stages and its own deadlines.
Verified
This overview reflects internal review practice observed among obliged entities operating monitoring systems in the EU. It is checked periodically against publicly available supervisory guidance and updated when practice shifts. It does not cite specific statutory provisions, because the stages described here are internal procedure, not a statutory requirement.
Related reading
A closely related procedure, with its own stages and deadlines, covers the entity's response to a formal request from a supervisor: Supervisory questionnaire response step by step.
FAQ
How long does monitoring rule review take in practice?
Most reviews close within two to six weeks from trigger to rollout. The range depends on how many rules are affected and whether senior management sign-off is required in addition to the MLRO's approval.
Which documents are needed to start?
A dated trigger log entry, an evidence pack of alert volumes and false-positive data, and a named owner for the review. Without these three, the stages above cannot begin in any meaningful sequence.
What happens if the responsible team does not respond?
If the team holding the evidence pack does not respond within the expected window, the review stalls at gathering, not at testing. Escalating to a named deputy, rather than waiting, is what keeps the timeline intact.