Key performance indicators in AML: four steps to measuring what really matters

Every year, trillions in illicit funds move through the global financial system, often hidden within legitimate flows. 

Banks and financial institutions face mounting pressure from regulators and the public to prove that their AML programmes do more than operate. They must demonstrate measurable impact.

The challenge is that many organisations still rely on vanity metrics, such as the number of suspicious activity reports (SARs) filed, which say little about whether risk was actually mitigated. 

To truly measure effectiveness, institutions must define and track the right Key Performance Indicators (KPIs) that connect activity to outcomes.

In this article, we outline how to identify meaningful AML KPIs, avoid misleading measures, and build a reporting framework that reflects real progress.

Why AML KPIs matter 

Well-designed AML KPIs bring clarity and accountability to complex compliance operations. 

They show whether systems, teams, and processes are genuinely reducing risk, not just generating reports.

The benefits are:

• Regulatory scrutiny: Supervisors now expect clear, evidence-based indicators of programme effectiveness.
• Operational efficiency: Accurate KPIs reveal where workloads, processes, or alerts require improvement.
• Business reputation:  Transparent compliance performance strengthens confidence among customers, partners, and investors.

Without the right KPIs, institutions risk chasing metrics that look good on paper but leave serious vulnerabilities undetected.

1. Start with Key Risk Indicators (KRI:s)

Before defining performance metrics, assess where your AML exposure lies. Consider:

• Industries and geographies your clients operate in.
• Branch profiles: cash-intensive versus digital-first.
• Products and services offered across business lines.

You must also ensure the risk assessment is regularly updated with new contextual information, including national risk assessments and internal data on customer behaviour, transactions, and more.

For example, if your bank has opened a branch in a country with a higher AML risk, your local customers might be considered high-risk solely because of their area of operations.

The KRIs in that branch are much more nuanced in their local dynamics. In this case, it would be irrational for your resulting KPI to be "reduce the number of high-risk customers," as that would basically mean closing down the branch.

You want to keep those "high-risk" customers while reducing the risk to your institution. 

One way to do this is to establish a KPI that increases the frequency of enhanced due diligence on local customers or increases the level of local risk training of your branch employees.

2. Avoid vanity metrics

Volume-based metrics can be misleading. Counting the number of alerts generated or the total SARs filed doesn’t reflect how well your controls work. 

Many of the figures presented to management, such as false positives, the number of high-risk customers, and the number of alerts generated, are used as "vanity metrics" because they look good when they trend downwards.

Instead, focus on metrics that indicate outcomes. For instance, alert-to-case conversion rates or time-to-resolution for verified suspicious activity.

3. Focus on team-based KPIs

Your compliance team plays a central role in AML effectiveness. Assess their performance holistically through:

• Processing times for onboarding, KYC reviews, and alert resolution.
• Training completion rates and up-to-date knowledge of regulations.
• Quality of investigations, such as SARs that lead to regulator feedback or confirmed cases.

These insights ensure resources are allocated wisely and that staff development aligns with compliance goals.

4. Create a KPI refinement wheel

Your main objective with KPIs should be to constantly fine-tune them. You need to set a wheel in motion: 

• Set KPIs.
• Perform risk assessment.
• Conduct routine monitoring and data analysis.
• Update risk assessment, and update KPIs.

This process keeps your AML programme aligned with current risks, ensuring performance indicators remain meaningful and actionable.

In conclusion

Your work is never done. As mentioned before, this process is not about the numbers. It's about having an effective, working risk management system. Use your KPI journey to upgrade your financial crime prevention strategy as a whole.