Abstract: In some embodiments, a system comprises an interface and one or more processors. The interface receives a potential alert associated with a transaction between a first party and a second party. The processors determine a first subset of same party transactions transacted between the parties during an alert period and a second subset of same party transactions transacted between the parties during a review period. The processors apply a plurality of weighting factors to the first subset of transactions and the second subset of transactions to determine a risk level. The interface communicates the risk level.

Abstract: In some embodiments, a system includes an interface and one or more processors communicatively coupled to the interface. The interface receives current transaction information indicating a proportion of large denomination currency transacted by a customer during a current period. The processors determine historic transaction information and a dynamic threshold for the customer. The historic transaction information indicates a proportion of large denomination currency transacted by the customer during a historic period. The dynamic threshold is based on the historic transaction information and indicates whether a change in the proportion of large denomination currency transacted by the customer is unusual. If the current transaction information exceeds the dynamic threshold, the processors generate an alert and the interface communicates the alert.

Abstract: In some embodiments, a system comprises an interface and one or more processors. The interface receives transaction information for one or more transactions performed using resources of a first financial institution. The processors determine that an originating party associated with the transactions is not a customer of the first financial institution and the originating party is a customer of a second financial institution. The second financial institution is authorized to facilitate access to the resources of the first financial institution. The processors assign a unique identifier to the originating party, associate the transactions with the unique identifier, and monitor the transactions based on a policy that the first financial institution applies to its own customers. in response to detecting suspicious activity, the processors generate an alert and the interface communicates the alert.