August 22, 2026

Alert Backlogs: How Compliance Teams Dig Out

Axle Team

Key takeaways

An AML alert backlog is a regulatory finding waiting to happen: aged alerts push SAR decisions past the 30-day filing window and signal a program that isn't commensurate with its risk profile.
Regulators have been explicit that you cannot size alert volume to the team you happen to have — the FFIEC exam manual instructs examiners to verify the opposite.
The FinCEN consent order against TD Bank shows how backlogs compound: understaffing led to 70,000+ backlogged detection alerts and, eventually, pressure to reduce investigative rigor.
Digging out requires working intake and throughput at the same time — tuning scenarios and adding capacity — not a one-time contractor surge.
Work the backlog risk-ranked, not first-in-first-out, and document the ranking methodology before you start. Examiners ask how you prioritized, not just how fast you cleared.

What an AML alert backlog is — and why it compounds

An AML alert backlog is a queue of transaction monitoring alerts that have aged past the institution's internal review deadlines. Backlogs form when alert volume outpaces investigator capacity, and they create regulatory exposure because delayed dispositions push SAR filings past the 30-day window that runs from initial detection of suspicious activity.

Every BSA officer knows the arithmetic. Scenarios fire faster than analysts can disposition, aging thresholds slip from amber to red, and the monthly metrics deck starts needing a narrative. What makes an AML alert backlog dangerous is that it compounds: aged alerts take longer to work because the activity has continued, context has gone stale, and related alerts have stacked up on the same customers.

The deeper problem is what a backlog signals. A queue that grows quarter over quarter tells an examiner that monitoring output and investigative capacity were never matched to each other — and that the institution knew.

What regulators actually expect

The FFIEC BSA/AML Examination Manual is unusually direct on this point. In its examination procedures for suspicious activity reporting, it tells examiners to:

"Verify that staffing levels are sufficient to review reports and alerts and investigate items, and that staff possess the requisite experience level and proper investigatory tools. The volume of system alerts and investigations should not be tailored solely to meet existing staffing levels."
— FFIEC BSA/AML Examination Manual, Suspicious Activity Reporting examination procedures

Read that second sentence again. Suppressing scenarios, raising thresholds, or auto-closing alert populations because the team can't keep up is exactly the move the manual anticipates — and prohibits. Tuning has to be justified by risk analysis, not headcount.

The filing clock makes timeliness non-negotiable: under FinCEN's SAR rule for banks (31 CFR 1020.320), a SAR is due no later than 30 calendar days after initial detection of facts that may constitute a basis for filing, extendable to 60 days only to identify a suspect. An alert that sits unworked for four months has already blown the deadline for anything reportable inside it.

The TD Bank consent order: a backlog case study

FinCEN's October 2024 consent order against TD Bank — part of a record $1.3 billion penalty — is the most detailed public anatomy of an AML alert backlog to date. The order describes the mechanics:

"In 2018, the AML program registered over 70,000 backlogged detection alerts and roughly 3,000 aged subpoena responses and further investigation cases, with less than 60% of alerts falling within benchmarks for timely detection."
— FinCEN Consent Order 2024-02, TD Bank

FinCEN traced the root cause to resourcing, not technology alone:

"The effects of the Bank's persistent under-resourcing and understaffing reverberated throughout every aspect of its AML program, but were especially apparent in the extensive, persistent, and prolonged backlogs within the AML function throughout much of the Relevant Time Period."
— FinCEN Consent Order 2024-02, TD Bank

Two details in the order should worry anyone managing a queue today. First, leadership responded to the backlog in part by looking for ways to scale back investigative rigor — the exact behavior the FFIEC manual warns against. Second, contractors brought in to "gradually reduce" the backlog produced work that internal staff described as creating more confusion, while thousands of alerts still went uninvestigated for almost a year. A surge that fixes throughput without fixing intake buys you a quarter, not a program.

How to dig out: a sequence that survives an exam

Size and stratify the backlog. Count aged alerts by scenario, customer risk rating, and age band. You cannot triage what you haven't measured, and your regulator will ask for exactly this cut.
Write the risk-ranking methodology down first. Decide — and document — the order of work: highest-risk customers and scenarios first, not oldest-first. Get compliance leadership sign-off before anyone touches the queue.
Fix intake in parallel. Run above-the-line/below-the-line testing on your noisiest scenarios. Every tuning change needs documented rationale and validation — threshold moves justified only by capacity are a finding.
Add capacity that produces examinable work. Whether it's overtime, contractors, or AI agents, every disposition needs a documented rationale an examiner can reconstruct. Throughput without audit trail is rework.
Run a lookback on what aged. For alerts that sat past SAR deadlines, assess whether late filings are needed and self-identify to your regulator with a remediation plan. Discovering it yourself is materially better than the exam team discovering it.
Instrument steady state. Track alerts-per-analyst, aging distribution, and intake-versus-disposition rate weekly. A backlog you catch at two weeks is an ops problem; at two quarters it's a governance problem.

The practitioner's note on triage order

Here is the part most dig-out playbooks get wrong: teams default to working the queue first-in-first-out because it feels fair and makes the aging metric improve fastest. It's the wrong order. A 90-day-old alert on a low-risk retail customer matters less than a 30-day-old alert on a high-risk MSB with prior SARs. Risk-rank the backlog — but write the methodology down before you start, because the exam question is never "why did you have a backlog?" (they know why). It's "show me how you decided what to work first." Teams that can hand over a dated, approved triage memo have a defensible remediation; teams that can't have a second finding.

Where AI agents fit

The structural fix for an AML alert backlog is breaking the link between alert volume and human headcount. AI agents like Rose, Axle's transaction monitoring analyst, work L1/L2 alerts end-to-end — gathering context, applying the institution's procedures, and writing a documented disposition for every alert — so capacity scales with volume instead of with hiring cycles. Escalations that warrant filing can flow to Sam, the SAR narrative analyst, keeping the alert-to-SAR chain inside the 30-day window. The point isn't replacing investigators; it's making sure the queue never again gets to decide your risk appetite for you.

FAQ

How big does an alert backlog have to be before it's a regulatory problem?

There's no safe-harbor number. The test examiners apply is whether alerts are reviewed within your own documented timeframes and whether SAR decisions happen inside the 30-day filing window. A few hundred aged alerts at a large institution may be noise; a persistent, growing queue at any size institution is a program-adequacy question.

Can we bulk-close aged alerts to clear the backlog?

Only with a documented, risk-based methodology — and even then, carefully. Auto-closing populations without individual review has featured in enforcement actions as evidence of a broken program. If you close alerts in bulk, you need documented sampling, validation that the closed population was genuinely low-risk, and sign-off you can produce on request.

Should we hire contractors to work down the backlog?

Contractors solve a throughput problem for a while, but the TD Bank order shows the failure mode: quality problems that create rework, and no change to the intake that caused the backlog. If you bring in surge capacity — human or AI — pair it with scenario tuning and QA sampling of dispositions, or you'll be back in the same queue within a year.

Buried under aged alerts? See how Rose, Axle's AI transaction monitoring analyst, clears alert queues with full, examinable audit trails — and use the ROI calculator to size what your backlog is costing you.

Alert Backlogs: How Compliance Teams Dig Out

More from the blog