Abstract: Event processing for suspicious activity detection is disclosed. Financial events can be detected by receiving data from a plurality of detection channels. The data can optionally be enriched by adding additional details about events. An event or group of events is scored based on pre-defined risk factors and experience, and the resulting score can be compared to a pre-defined threshold. A case for investigation is established when the score is above the pre-defined threshold. Events for which the score is below the pre-defined threshold are sampled to provide the experience for the scoring. Events can be scored by obtaining a plurality of predictors, collecting training data regarding existing cases, and running a logistic regression to obtain weights for the predictors. The likelihood of a case for investigation resulting in a suspicious activity report can then be determined.