AI vs Rules in Crypto Transaction Monitoring

If you run a regulated crypto service, the short answer is simple: use both. Rules are best for fixed checks like sanctions and threshold alerts. AI is better at spotting linked behavior across wallets, chains, and borders that rules often miss.

Here’s the full takeaway in plain English:

• Rules-based monitoring is easier to audit and explain
• AI-based monitoring is better for messy, multi-step behavior
• False positives can be high with rules if thresholds are broad
• AI can cut alert noise, but only if your data and model controls are solid
• Cross-border crypto is harder to monitor because one transfer can touch many wallets, countries, chains, and fiat rails
• U.S. timing matters: SARs are generally due within 30 calendar days, or up to 60 days if no suspect is identified at first
• Records usually need to be kept for five years
• The best fit for most firms is a hybrid setup: rules for must-have controls, AI for behavior-based review

You should judge any monitoring setup on a few simple things:

• Can it catch suspicious activity?
• Can it keep false positives in check?
• Can analysts explain why an alert fired?
• Can it help with SAR review and exams?
• Can it keep up as transaction volume grows?

Quick Comparison

Criteria	Rules	AI	Hybrid
Best for	Sanctions, fixed thresholds, direct policy checks	Linked behavior, anomalies, multi-hop activity	Most regulated crypto services
Explainability	High	Medium to low without strong documentation	High for rules, medium for AI-supported alerts
False positives	Often higher with broad thresholds	Can be lower, but depends on data quality	Often the best balance
Setup work	Lower at first, but tuning still takes time	Higher due to data, testing, and model controls	Medium to high
Audit trail	Easier to show	Needs model/version records and score details	Strong if both sides are logged well
Cross-border coverage	Limited unless many rules are added	Better at linking many weak signals	Best overall coverage

Bottom line: if you need control, audit records, and better detection across cross-border crypto flows, a hybrid model is usually the safest choice.

sbb-itb-0796ce6

How rules-based monitoring works

A rules-based system checks cross-border transaction, wallet, customer, and geographic data against preset conditions. Each rule follows a simple pattern: indicator, threshold, time window, and action.

So a rule might trigger an alert when a customer sends more than $10,000 to a high-risk service within 24 hours. Or it might block a transfer to or from a wallet tied to a sanctioned entity or address.

FATF lists transaction size, frequency, geographic risk, privacy tools, customer profiles, and source of funds as virtual-asset risk indicators. The table below shows common rule types a regulated crypto service needs:

Rule type	Risk indicator addressed	Transparency level	Main limitation
Sanctioned-wallet screening	Direct or indirect exposure to sanctioned addresses or entities	Very high	Address attribution can be incomplete, and false matches may occur
Sanctioned-jurisdiction screening	Transactions, IP activity, or customer activity linked to prohibited jurisdictions	High	VPNs, intermediaries, and inaccurate location data can reduce reliability
Structuring detection	Multiple transactions divided into smaller amounts to avoid reporting, review, or record-keeping thresholds	High	Legitimate customers may make frequent smaller transfers
Transaction-velocity rules	Unusually frequent deposits, withdrawals, or transfers over a defined period	High	A fixed threshold may not account for customer-specific behavior
Rapid deposit-and-withdrawal rules	Possible layering, account takeover, fraud, or funds moving through an account without real use	High	Fast legitimate trading, arbitrage, or liquidity activity can look suspicious
High-risk-service exposure rules	Interaction with mixers, tumblers, darknet-linked wallets, scams, ransomware addresses, or other high-risk services	High for direct exposure; lower for indirect links	Blockchain labels can be incomplete, stale, or probabilistic
Cross-chain or multi-hop rules	Rapid movement through several wallets, chains, or bridges to obscure fund flow	Medium	Simple rules struggle with graph complexity and incomplete attribution

Where rules perform well

Rules work best when the requirement is explicit, repeatable, and mandatory from a legal or operating standpoint. Sanctions screening is the clearest case. OFAC recommends that virtual-currency businesses screen wallet addresses, IP addresses, and geographic indicators against applicable sanctions data.

That’s where rules shine. They apply the same logic to every transaction, every time. And when an examiner asks what happened, the compliance team can show the exact trigger, the list version used, and the timestamp. That kind of audit trail makes life much easier.

Where rules fall short

The biggest issue is rigidity. A fixed threshold can’t tell the difference between a first-time retail user and a professional market maker. It also has trouble following funds as they move through several wallets, bridges, or blockchains before ending up somewhere suspicious.

FATF specifically flags transfers sent immediately to multiple virtual-asset service providers, including providers in other countries, with no logical explanation, as a suspicious indicator. A basic rule that looks at one transaction at a time can miss that whole chain of activity.

False positives are the other headache. Broad thresholds can sweep in legitimate international customers, active traders, and businesses making normal cross-border payments. You can tune thresholds to cut the noise, but that work needs documented back-testing and investigator feedback. Lower noise sounds good on paper, but if thresholds are pushed up just to cut alert volume, false negatives can slip in.

And there’s the bigger problem: typologies change. Bad actors don’t stand still. Rule libraries need regular updates, but fixed logic on its own struggles to keep up with layered, multi-hop cross-border behavior.

That’s the point where AI starts to help.

How AI-based monitoring works

AI monitoring doesn't rely on one model. It uses several: supervised models, unsupervised models, graph analysis, and scoring tools. Each one picks up a different kind of risk signal. That's very different from fixed thresholds, which apply the same logic to every transaction.

That difference matters most when activity moves across wallets, chains, counterparties, and jurisdictions all at once.

Supervised learning trains on labeled past cases: confirmed suspicious activity, sanctions hits, fraud, and cleared alerts. The model learns which feature combinations tend to show up in risky activity, such as transaction amount, wallet age, counterparty risk, and geographic exposure. It then scores new transactions based on how closely they match those past patterns.

Unsupervised anomaly detection learns what normal behavior looks like and flags sharp deviations. So if a wallet usually sends small domestic payments but then starts moving large transfers through several jurisdictions, that change stands out even if no rule directly matches it.

Graph and relationship analysis maps wallets, customers, exchanges, and transactions as connected nodes. This can bring indirect links to the surface, along with shared funding sources and multi-hop flows across chains and counterparties that a one-transaction rule may miss. Risk scoring then pulls together model outputs, customer risk, geography, and counterparty links to rank alerts.

AI method	Data requirements	Detection capability	Explainability	Operational risk
Supervised learning	Labeled historical cases, reliable features, consistent investigation outcomes	Strong for known typologies and patterns resembling prior cases	Moderate; feature importance may be available, but complex models can be hard to interpret	Label bias, concept drift, overfitting, missed new typologies
Unsupervised anomaly detection	Sufficient behavioral history, stable baselines, suitable peer groups	Strong for novel or unusual behavior without complete labels	Low to moderate; analysts may see the deviation but not always why it matters	High false-positive rates, sensitivity to volume changes, legitimate activity flagged as anomalous
Graph and relationship analysis	Accurate wallet attribution, entity resolution, transaction history, relationship data	Strong for indirect links, clusters, layering, shared funding, multi-hop exposure	Moderate; visual paths can support explanation, but attribution may remain uncertain	Incorrect clustering, incomplete off-chain data, privacy tools, complex investigations
Risk scoring and alert prioritization	Outputs from models and rules plus customer, geographic, counterparty, and case data	Strong for ranking investigative effort and combining multiple signals	Moderate to high if score components and thresholds are documented	Analysts may over-rely on the score; poorly calibrated scores can hide low-frequency risks

Where AI improves detection

AI works best when it combines weak signals that a rule system would brush past.

Take a customer who receives funds from several newly created wallets, converts assets across multiple blockchains within hours, routes them through unrelated intermediaries, then sends them to a high-risk exchange using amounts just below current alert thresholds. On their own, those steps may look ordinary. Put together, they form a pattern a trained model can spot.

Graph analysis adds another layer. A two- or three-hop connection between a customer wallet and a sanctioned cluster may not trigger a direct-match rule. But that kind of indirect tie is exactly what graph models are built to find. FATF guidance notes that AI and machine-learning tools can process transactions in near real time and reduce manual review.

AI can also help with false positives by looking at customer history, peer-group baselines, and multiple risk signals at the same time. Instead of firing an alert every time a transfer goes above a fixed dollar amount, a model can ask a better set of questions: Has this customer made similar transfers before? Is the counterparty established? Does the activity fit the customer's peer group?

Industry-standard monitoring can still create a heavy alert load. Better-calibrated AI models can cut some of that noise, but only if the underlying data is solid.

That edge still depends on governance, documentation, and model discipline.

Where AI needs stronger controls

A model can flag risk, but an investigator still has to verify context, attribution, and escalation. Explainability is a real limit here. An alert is not a finding. Document the signals, the baseline, and the analyst decision path. NIST links explainability with effective oversight and recommends that models be validated, documented, and interpreted in context.

Data quality is the other pressure point. Supervised models are only as good as their labels. If alert closures are treated as proof of low risk, instead of proof that an investigation happened, the training data becomes misleading.

Unsupervised models can also misfire when customer behavior changes for valid reasons, when new products launch, or when blockchain usage patterns shift. Document validation before launch, monitor performance continuously, and version every retraining cycle.

Those trade-offs show up next in false positives, setup effort, and audit trails.

False positives, setup effort, and audit trails

How each approach affects false positives

The first place you see the gap is in alert volume and the time it takes to review those alerts.

Rules fire when preset conditions are met. That makes them useful for clear red flags. But they can also generate too many alerts when normal activity happens to look like a known typology. AI can help cut down on duplicate or low-value alerts by looking at customer history, wallet links, counterparty relationships, and transaction context. Still, if the labels are poor or the attribution is weak, AI can get noisy too.

The better comparison isn't raw alert count. It's measured outcomes. That means tracking:

• precision
• confirmed-case yield
• false-positive rate
• investigation time
• missed-case performance

A lower alert count doesn't mean things got better if missed-case performance gets worse. Too much noise also slows teams down, especially when they're trying to review higher-risk cross-border flows.

What setup and governance actually require

The next gap is implementation burden.

Rules are often faster to launch when the risk scenario is already clear. But that doesn't mean setup is light. Each rule needs a policy rationale, a threshold, test data, an escalation path, and a documented tuning history. In cross-border monitoring, rules can sprawl fast across country, corridor, asset, counterparty, and exception logic. Compliance teams need rules and models they can still manage when exam pressure hits.

AI governance covers the full model life cycle. Teams need to document data sources and gaps, define labels, validate features, test performance, monitor drift, retrain when behavior changes, and log each model version and change.

Then comes the part that tends to settle the debate: can the system stand up in an exam?

Both methods need a full audit trail. Each alert record should preserve the input transactions and the customer, wallet, counterparty, and geography data tied to them. It should also keep the rule version or model version, the feature set, and the threshold used. On top of that, the file should show the alert reason, score, or triggered conditions, every analyst action with timestamps, and the change history for rules, thresholds, models, labels, features, permissions, and workflows. For blockchain investigations, that also means keeping transaction hashes, wallet addresses, chain and asset identifiers, and any relevant originator or recipient information.

Without that record, a firm can't reconstruct how it made a decision during an exam or an enforcement review.

Criterion	Rules-based	AI-based
Known typologies	Strong for clear, threshold-driven red flags	Strong when known patterns are represented in reliable training data and features
Novel patterns	Weak without a new rule being written	Can identify behavioral or network anomalies, but may miss patterns absent from the data
False positives	Often high when legitimate activity resembles a typology	May improve precision; errors remain sensitive to labels, data quality, and thresholds
Explainability	Direct - shows the exact rule and value that triggered it	Requires documented features, score logic, and model limitations
Cross-border complexity	Requires explicit country, corridor, asset, counterparty, and exception logic	Can combine many variables, but depends on complete cross-border data
Setup effort	Faster for defined scenarios; policy mapping and testing still matter	Higher initial effort: labeling, feature design, validation, and governance
Maintenance	Manual tuning as typologies, products, and regulations change	Drift monitoring, retraining, data-quality controls, and ongoing validation
Auditability	Strong when rule versions, inputs, and analyst actions are preserved	Defensible only with preserved versions, scores, explanations, and change history

When rules, AI, or a hybrid model fits best

Use the trade-offs around control, coverage, and auditability to pick the lightest monitor that still meets the obligation.

When rules are the better fit

Rules make the most sense when a decision must be fully explainable and tied to a clear rule or obligation. They’re the right fit for mandatory controls like sanctions screening, prohibited addresses, and Travel Rule data checks.

Rules also work well as the first layer when labeled data is limited. You can defend thresholds and scenarios long before a model is ready to use.

But there’s a catch. When activity spreads across wallets or chains, fixed rules start to miss more of the picture.

When AI or a hybrid model is the better fit

AI makes more sense when risk stretches across multiple transactions, wallets, chains, or time periods, and fixed thresholds fail to spot the pattern.

For most regulated cross-border services, a hybrid model tends to work best. Rules handle mandatory controls, while AI ranks behavior-based risk for review.

That’s why most regulated services use both methods instead of picking just one.

Conclusion: control, coverage, and defensibility

The choice comes down to one question: which method gives the most defensible coverage for the risk?

Criterion	Rules-based	AI-based	Hybrid
Detection scope	Strong for predefined scenarios, sanctions, and prohibited-address checks; weaker for new or distributed behavior	Strong for anomalies, behavior shifts, relationships, and complex cross-chain patterns	Broadest coverage when rules provide mandatory controls and AI expands behavior-based detection
False-positive management	Easy to tune; static thresholds may trigger too many alerts across varied activity	Can cut repetitive alerts; errors depend on data quality and labels	Rules handle clear-cut cases; AI ranks ambiguous ones
Explainability	High; each alert maps to a condition or policy	Varies; needs documentation and human review	High for mandatory controls; documented explanations for AI-assisted prioritization
Suitability for a regulated cross-border crypto service	Strong first layer; needed for mandatory controls	Best for mature, high-volume services with strong data and governance	Often the best fit when the service needs control, coverage, and defensibility

Choose the design that matches the risk. A hybrid design often gives the best balance, but only when data quality, governance, and review are clearly documented.

FAQs

Why is a hybrid monitoring model usually the safest choice?

A hybrid monitoring model is often the safest choice because it combines the reliability of fixed rules with the flexibility of AI.

Fixed rules help meet clear regulatory requirements. AI, on the other hand, can spot complex fraud patterns and unusual activity that manual reviews may miss.

Used together, they can cut false positives, ease pressure on operations teams, and keep monitoring strong without slowing everything down.

How can AI reduce false positives without missing real risk?

AI cuts false positives with risk-based, real-time monitoring that adjusts to context, such as transaction size, geography, and customer risk, instead of treating every transaction the same.

Machine learning models can flag anomalies and unusual patterns across fraud and AML signals. That helps teams spend their time on the activity that looks most suspicious, while still catching real risk fast. Detailed monitoring and immutable records also make it easier to review alerts, fix mistakes, and keep training models over time.

What audit records should a crypto monitoring system keep?

A crypto monitoring system should keep complete, tamper-resistant records for compliance and transparency.

That means storing:

• Customer and transaction data
• User activity and access logs
• Originator and beneficiary details for large transactions

These records should be kept for at least five years. They should also help with investigations, tax reporting, official requests, and both internal and external audits.

Related Blog Posts

• How AI Analyzes Stablecoin Market Risks
• Cross-Border Crypto: Legal Risks Explained
• Top Challenges in Cross-Border KYC Compliance
• Sanctions Screening in Crypto: Ultimate Guide