November 6, 2026

Alerts per Analyst per Day: Capacity Planning Without a Benchmark

Axle Team

Key takeaways

No regulator publishes a target for alerts per analyst per day, and industry figures you hear at conferences don't transfer between programs. The FFIEC standard is "adequate staff" given your risk profile and transaction volume.
The number is an output, not an input. Derive it from your alert mix, how your tiers are split, average handle time per alert type, and how much capacity QA and rework take.
A single blended throughput target pushes analysts toward the easy alerts and thin closures. Set targets by alert type and tier instead.
Under-staffing is a real enforcement theme. FinCEN's March 2026 Canaccord action specifically cites staff who were "overwhelmed by the number of transactions" they were assigned.
Once you have your own capacity model, you can test what changes it: tuning, tiering, or automating Level 1 review.

Why there's no standard for alerts per analyst per day

How many alerts per analyst per day is reasonable? There is no regulatory or industry-standard number. The right figure comes from your own alert mix, average handle time per alert type, the share of time spent on QA and rework, and how much analyst time goes to non-alert work. Calculate it bottom-up, by alert type, and document the method.

That isn't a dodge. The FFIEC manual deliberately ties staffing to each institution's own facts, not to a ratio:

"The bank should assign adequate staff to the identification, evaluation, and reporting of potentially suspicious activities, taking into account the bank's overall risk profile and the volume of transactions. Additionally, a bank should ensure that the assigned staff possess the requisite experience levels and are provided with comprehensive and ongoing training to maintain their expertise."
— FFIEC BSA/AML Examination Manual, Suspicious Activity Reporting

Think about what a "typical" number would have to average across. A sanctions name-match alert on a domestic ACH, a structuring alert on a cash-intensive business, and a crypto exposure alert involving a mixer are not the same unit of work. A program that gets mostly the first kind and one that gets mostly the third could both be properly staffed at wildly different daily throughputs.

What happens when the number is wrong

Examiners rarely ask, "How many alerts per analyst per day?" They ask what your backlog is, how long alerts sit before anyone looks at them, and whether closure quality held up. Too few analysts shows up there first. FinCEN's Canaccord action spelled out what that looks like:

"This was particularly apparent in Canaccord's transaction monitoring policies, procedures, and internal controls, which relied on an insufficient number of inexperienced staff who were poorly trained and overwhelmed by the number of transactions Canaccord tasked them with reviewing through unreasonably designed surveillance reports."
— FinCEN, press release on the $80 million Canaccord Genuity penalty (March 6, 2026)

Note the pairing: too few staff and poorly designed surveillance. Workload is the result of both headcount and detection design. That's why capacity planning and tuning belong in the same conversation.

How to build your own capacity model

Here's the method we use with compliance teams. It takes a few days of data pulls, not a consulting engagement.

Segment the alert population. Group 6–12 months of alerts by source and type: TM scenario family, sanctions/screening, fraud referrals, 314(a) hits, employee referrals. Then split by tier: Level 1 triage, Level 2 investigation, and cases that went to SAR decisioning.
Measure handle time per segment. Use case-management timestamps where you trust them, and time-studies where you don't. Measure active work time, not time from open to close. An alert that sits in a queue for four days and takes 20 minutes to clear is a backlog problem, not a productivity one.
Measure the escalation rate per segment. The share of Level 1 alerts that go to Level 2 and the share of Level 2 cases that become SARs drive most of the downstream workload.
Net out non-alert time. Training, QA feedback sessions, meetings, 314(a) searches, lookbacks, and audit support all come out of the same hours. Most teams overestimate how many hours a day actually go to alerts.
Add QA and rework load. If QA samples a share of closures and a portion fail, the rework comes back to the same analysts. Count it.
Solve for capacity by segment. Productive alert hours per analyst, divided by weighted handle time, gives sustainable daily throughput for each segment. Sum against forecast volume to get required FTEs.

A simplified worked example, using illustrative inputs rather than benchmarks:

Screening name-match (L1) — Share of volume: 50%. Active handle time: 6 min. Escalates to L2: low.
TM rule alert (L1) — Share of volume: 35%. Active handle time: 20 min. Escalates to L2: moderate.
TM investigation (L2) — Share of volume: 12%. Active handle time: 90 min. Escalates to L2: —.
SAR decision + narrative — Share of volume: 3%. Active handle time: 4 hrs. Escalates to L2: —.

Plug in your own figures. What usually comes out of this exercise is that the small L2/SAR segments eat most of the hours, so a team's daily alert count barely moves when you change triage tooling on the high-volume L1 segments. It moves a lot when you cut unnecessary escalations.

The trade-off nobody puts in the staffing memo

Practitioner insight: The single fastest way to break a TM program is to put one blended "alerts per day" number on a team scorecard. Analysts learn which alert types close fast, and the queue quietly gets cherry-picked. The complex alerts age and the easy ones get closed in volume. The headline number looks great right up until QA or the independent tester samples the aged cases. If you must measure throughput, measure it per segment, pair it with a QA pass rate, and track queue age by segment, not just in total.

Documentation standards also drive handle time, and they're often stricter than necessary. FinCEN's October 2025 SAR FAQs addressed no-file decisions directly:

"In most cases, a short, concise statement documenting a financial institution's SAR decision will likely suffice, although a financial institution may consider more documentation to explain the factors that the institution considered in reaching a SAR filing determination in more complex investigation scenarios."
— FinCEN and federal banking agencies, SAR FAQs (October 2025)

If your procedures require a page-long write-up for every closed L1 alert, you're spending capacity that guidance doesn't require. Tighten the template for routine closures and keep the depth for complex cases.

Where automation changes the math

Once the model is built, you can test levers honestly. Tuning a scenario family reduces volume in one segment. Better tiering shifts alerts from L2 to L1. AI agents that prepare L1 investigations — pull the data, check the KYC file, draft the disposition for analyst review — change handle time for the largest segment, freeing hours for the cases that need judgment. That's the workflow behind Axle's transaction monitoring agent and screening alert review.

Whatever lever you pull, re-run the model with your own handle times rather than vendor claims. The AI readiness playbook covers how to set up that before-and-after measurement so it holds up with your model risk and audit teams.

FAQ

What is a good number of alerts per analyst per day?

There's no regulatory benchmark. A sustainable number depends on alert type, tier, and documentation standards. Calculate it bottom-up from active handle time per alert segment and productive hours, then validate it against QA pass rates and queue age.

How do you calculate AML analyst capacity?

Segment alerts by type and tier, measure active handle time and escalation rates for each segment, subtract non-alert time and QA rework, then divide productive hours by weighted handle time. Compare the result with forecast alert volume to get required FTEs.

Do regulators set AML staffing ratios?

No. The FFIEC manual expects banks to assign adequate staff given their risk profile and transaction volume, with appropriate experience, training, and tools. Examiners judge adequacy by outcomes: backlogs, timeliness, and quality of decisions.

Put your own numbers in

Once you have handle times and volumes by segment, see what changes when Level 1 review is agent-assisted. Run your figures through the Axle ROI calculator.

See how Axle's agents work

Axle's AI agents investigate compliance alerts and document every decision for your analysts to review.

See Axle in action

The Alert Queue

Get the next issue in your inbox

Every other Tuesday, one short read for compliance and risk teams.

Every other Tuesday. No pitches. Unsubscribe anytime.

Alerts per Analyst per Day: Capacity Planning Without a Benchmark

Related reading

See how Axle's agents work

Get the next issue in your inbox

More from the blog