How Real-Time Rails Work
InstaPay, the Philippines' real-time payment rail, processed 4.7 billion transactions in 2025, roughly 12.9 million transactions per day, or about 149 per second, continuously. Under AMLC's GoTRACS, Suspicious Transaction Reports must be filed by the next working day following determination of suspicion.
Batch AML monitoring, where rules run on a scheduled cycle (nightly, every four hours) rather than evaluating each transaction as it arrives, can consume a large share of that filing window before an analyst ever sees the alert. On a rail that never stops, a monitoring architecture that pauses is a structural compliance risk, not just a technology preference.
The STR filing requirement under GoTRACS is next working day. The relationship between InstaPay's volume and that filing window determines whether a batch AML architecture is compliant or not, and for institutions still running overnight monitoring cycles, the answer is already no.
InstaPay clears and settles transactions in real time and irreversibly, for transfers up to ₱50,000, continuously, there's no overnight window, no batch cutoff, no pause in the rail for a monitoring system to catch up on. Once a transfer settles, the funds have moved; there is no end-of-day reconciliation step where a flagged transaction can be quietly held back the way it might be on a slower-settling rail.
QR Ph, the national interoperable QR standard, processed 2.5 billion person-to-merchant transactions worth ₱1.2 trillion in 2025, and adoption is still accelerating: one payment platform reported QR Ph volume growing more than 510% year-on-year in the first half of 2026 alone as merchants consolidated multiple bank and e-wallet QR codes into a single interoperable one.
Both rails point the same direction: volume is growing faster than most institutions' monitoring infrastructure was sized for, on a settlement model that doesn't pause.
The transaction never stops. The monitoring obligation runs around the clock with it, a different operating assumption than the one most legacy AML architectures were built on, back when overnight and batch-file processing was simply how core banking systems worked.
How Batch AML Monitoring Works
Batch AML monitoring runs rules against accumulated transactions at a scheduled interval: nightly, every four hours, or some similar cadence. A transaction happens; it sits in the queue until the next scheduled run; if it trips a rule, an alert is generated in that batch cycle, not at the moment the transaction occurred. An analyst typically sees the alert hours after the event that triggered it, sometimes the next morning, if the cycle runs overnight.
This isn't a design flaw so much as an inherited constraint. Batch processing made sense when core banking systems themselves ran on overnight cycles, when transaction volumes were a fraction of what they are today, and when the STR filing window was measured in days rather than hours. The architecture was matched to the regulatory and technical environment it was built for. That environment has changed underneath it, institutions weighing that older batch model against a fully event-driven rebuild are, in effect, asking whether the old architecture can be patched or needs to be replaced.
The Compliance Gap This Creates
Map that timing against the next-working-day STR requirement and the exposure is arithmetic, not theoretical. A transaction occurs at 11 p.m. A nightly batch cycle runs at 2 a.m. and generates an alert. The alert reaches an analyst's queue the next morning. The analyst reviews the transaction history, cross-references the customer's risk profile, and determines suspicion, and only at that point does the next-working-day clock actually start. Every hour spent between the transaction occurring and the determination being made is an hour the institution's own process consumed before the regulatory clock even began; on a rail processing roughly 149 transactions every second, that queue doesn't clear itself between cycles, it grows.
149/sec — InstaPay's average transaction rate in 2025, continuously, with no overnight pause for monitoring to catch up.
The practical effect compounds with volume. An institution running a four-times-daily batch cycle isn't four times better positioned than one running nightly, it's still generating alerts in discrete bursts rather than continuously, which means the backlog an analyst faces after each run scales with how many transactions accumulated in that window. As transaction volume grows year over year, the queue behind each batch cycle grows with it, even if the cycle frequency stays the same.
There's a second, harder problem batch rules struggle with regardless of cycle speed: structuring, sometimes called smurfing when it's spread across a network of accounts. InstaPay's per-transaction cap is ₱50,000; a series of transfers just under that cap, ₱49,500 say, spread across several accounts controlled by the same network, is a classic structuring pattern, and it's invisible to a rule that only evaluates one transaction in isolation. No single ₱49,500 transfer looks suspicious on its own. The pattern only becomes visible when the system can see that the same beneficiary, or a cluster of connected accounts, received a dozen transfers just under the threshold within a short window, which requires aggregating behavior across accounts and across time, a fundamentally different kind of computation than a single-transaction threshold check. It's exactly the kind of pattern a smurfing network is built to exploit, and exactly the kind a batch cycle evaluating transactions one at a time will keep missing regardless of how often it runs.
The Three Architecture Requirements
Closing this gap requires three specific things, not a general commitment to "going real-time."
- Event-driven detection: Every transaction evaluated at the moment it arrives, scored against the active rule set within the transaction's own processing path, rather than queued for the next batch cycle. This is an architectural choice, not a configuration setting: a system built around scheduled jobs querying a transaction database can be tuned to run more frequently, but it can't be tuned into true event-driven evaluation without being rebuilt.
- Rule types that model behavior across time windows: Not just single-transaction thresholds, but sums, counts, and patterns aggregated across days or weeks. This is the only way to see structuring, layering, and coordinated activity across multiple accounts, since none of those patterns are visible from a single transaction viewed in isolation.
- A safe deployment path for new rules: A new typology rule can't be validated by running it directly against live production transactions with no testing layer; that approach either floods analysts with untested noise or risks missing real activity while the rule is tuned. Institutions need a way to test a rule against historical data first, then watch it run against live transactions without yet acting on its output, before trusting it with production alerts.
What Event-Driven AML Architecture Looks Like
An event-driven AML platform evaluates each transaction as it arrives, scoring it in sub-second time against active rules and generating alerts immediately when a threshold is crossed, not on the next scheduled run. Rules that model behavior across time windows need to aggregate transaction data continuously, not query a historical batch after the fact. And a new rule needs to be testable against historical data, then against live transactions in a non-alerting simulation mode, before it's trusted with production alerts.
FT AML Solution's Transaction Monitoring module is built on this architecture: sub-second real-time evaluation of every transaction, five rule types including graph-based, dynamic, and pre-certified regulatory-triggered templates, and variables and aggregation across configurable time windows to catch structuring and smurfing patterns a single-transaction rule would miss. Dry Run tests a new rule against historical data before it goes live; Shadow Mode runs it against live transactions in parallel without generating real alerts, validating performance before full activation. The Suppression Window blocks repeat alerts for a risk already under investigation, reducing alert volume by up to 75%.
Volume and priority are handled together rather than as separate problems: alerts are automatically sorted by severity so analysts work the highest-risk cases first, and a unified alert detail view brings the rule that triggered, the breach amount, the variable logic, the transaction history, and every related open case into one screen, rather than requiring an analyst to reconstruct that context from separate reports after each batch run.
Migration: Phased, Not Rip-and-Replace
Institutions don't shut down a legacy AML system and switch overnight, and a credible architecture conversation has to acknowledge that rather than pretend otherwise. A realistic path runs parallel: old and new systems evaluating the same transactions side by side for a defined period, so results can be compared before the legacy system is retired, with migration handled module by module rather than as a single cutover. Transaction Monitoring might move first, with Case Management and Regulatory Reporting following once the new detection layer has proven itself against real volume.
That phased approach depends on how quickly a new system can actually integrate with what's already running. FT AML Solution's API-first architecture and pre-built connectors for Temenos, Mambu, and Finacle are built around that reality, with a stated go-live of 2–4 weeks against the 3–12 months typical of traditional enterprise AML implementations, which is what makes a parallel-running migration practical instead of a multi-quarter commitment before an institution sees any results.
Frequently Asked Questions
What's the difference between batch and real-time AML monitoring?
Batch monitoring evaluates transactions in scheduled cycles, generating alerts after the fact. Real-time monitoring evaluates each transaction as it happens, generating alerts immediately.
How many transactions does InstaPay process per day?
InstaPay processed 4.7 billion transactions in 2025, an average of roughly 12.9 million per day, or about 149 per second.
Why does GoTRACS's next-working-day STR requirement matter for AML architecture?
A next-working-day filing clock leaves little margin for delay between a transaction occurring and an analyst reviewing it, which a slow batch cycle can consume before a human sees the case.
What is transaction structuring, and why is it hard to detect with batch rules?
Structuring is splitting a large transaction into smaller transfers to stay under a reporting threshold. Detecting it requires aggregating activity across accounts and time windows, which single-transaction batch rules are not built to see.
What is smurfing, and how does it relate to structuring?
Smurfing is structuring carried out across a network of accounts or individuals rather than a single account, splitting a large transaction into many smaller ones spread across multiple beneficiaries to avoid detection.
Can institutions migrate from batch to real-time AML monitoring gradually?
Yes. A phased approach running old and new systems in parallel and migrating module by module is a realistic path that does not require a full rip-and-replace.