Step 1
A transaction from the core banking system or processing
The payment arrives as a stream via Kafka or the API at the moment it is posted — incoming, outgoing or internal. Format — REST, CSV or ISO 20022.
Payment transaction monitoring for banks and payment services under 115‑FZ
Real-time monitoring of payment transactions: mandatory-control transactions from RUB 1 million, pass-through and structuring, the Bank of Russia’s unusual-transaction indicators in your rules. Every alert becomes a case with the customer’s history, the decision of the responsible officer and an audit log.
Cloud or the bank’s perimeter Russian software registry no. 19972 152‑FZ
What 115‑FZ and the Bank of Russia require from transaction monitoring
A bank and a payment service are responsible not only for checking a customer when the account is opened but also for the customer’s transactions: detect, assess, report on time and keep the grounds.
Since 2025 the requirements for a credit institution’s internal control rules have been set out in Bank of Russia Regulation no. 860‑P, which replaced 375‑P.
- CB signs
Internal control rules
115‑FZ, art. 7, para. 2; 860‑P, ch. 6, para. 12.6
ICR
- Internal control rules and a dedicated compliance officer
- The results are documented and remain confidential
Detection programme
- List of unusual-transaction indicators
- Assessment procedure and enhanced due diligence
- Deadline for deciding how to classify a transaction
Client
- The information is updated at least once a year, and for low risk once every three years
- Risk groups of legal entities and sole proprietors from the Bank of Russia — in the internal control rules
- How a payment flows
Mandatory monitoring
115‑FZ, art. 6, para. 1; art. 7, para. 1, sub-para. 4; para. 4
Threshold
- Transactions from RUB 1 million or the foreign-currency equivalent — of the specific types listed in the law
Deadline
- The information goes to Rosfinmonitoring no later than three business days after the day of the transaction
Storage
- Identification documents and information — at least five years from the day the relationship with the customer ends
- Decision on the alert
Suspicious transactions and refusal
115‑FZ, art. 7, paras. 3, 11, 13
Report
- No later than three business days after the day of detection
- Regardless of whether the transaction is subject to mandatory control
Refusal
- The right to refuse when suspicions arise under the internal control rules
- The decision is made by the head or persons authorised by them
Information on the refusal
- No later than the business day following the day of the decision
Pass-through, structuring, cashing out: what monitoring sees in a customer’s payments
Bank transaction monitoring assesses not a single transaction but a chain: what arrived in the account, where it went and how much it resembles the customer’s normal life.
-
Pass-through
Money arrives and leaves the same day, barely staying in the account. The rule links the credit to the debit and calculates the share of pass-through over the period.
-
Structuring below the threshold
A series of transfers just below RUB 1 million to one recipient or related recipients. The total for the period is visible even if each transaction is below the threshold. Tracing transfer chains is on the investigations page.
-
Cashing out
Large transfers to individuals’ cards and cash withdrawals right after receipt from companies.
-
Off-profile
Transactions do not match the declared business and the purpose of the relationship with the bank: a new type of payment, a new region, a sharp rise in turnover.
-
Counterparty on watchlists
The recipient or payer is on the Rosfinmonitoring watchlist or on sanctions lists. The check runs at the moment of the transaction.
-
High-risk customer
Risk group of a legal entity or sole proprietor from the Bank of Russia is passed from your system as a customer attribute — the rules for such a customer are stricter.
Unusual-transaction indicator codes: how the annex to 860‑P maps to rules
-
1101 · No economic sense
A complicated or unusual transaction with no obvious economic sense. In the rules — complex chains and back-to-back payments between the same parties.
-
1103 · Avoiding mandatory control
Repeated transactions that look like an attempt to avoid mandatory control. In the rules — structuring below RUB 1 million over a period.
-
1106 · No documents
The customer refuses to provide the documents and information the bank has requested. In the rules — the request status in the case and the reply deadline.
-
1138 · Link to a crime
The bank suspects that the customer’s transaction is connected with a crime. In the rules — manual classification by an officer.
-
2301 · Illegal activity
A customer’s transaction involving a company on the Bank of Russia list of companies with signs of illegal activity in the financial market. In the rules — checking the counterparty against the list.
-
9011 · Unreliable information
The customer provided unreliable information or information that cannot be verified. Group 90 indicators alone are not grounds for a report — only together with others.
The Bank of Russia has listed unusual-transaction indicators with codes by group. Each monitoring rule can be linked to a code — then the alert shows at once which indicator was triggered.
Codes and wording — per the annex to Regulation no. 860‑P. Which indicators and thresholds to enable is decided by your bank in its internal control rules: the Rule Engine accepts any rules, and NeuroVision does not classify a transaction in place of the responsible officer.
The payment’s path through monitoring: from an event in the core banking system to a report to Rosfinmonitoring
Step 2
Rules and profile
The Rule Engine checks thresholds and indicators, the AI Engine compares the transaction with the customer’s normal behaviour, and the counterparty is checked against watchlists and sanctions.
Step 3
Alert and case
A triggered rule creates a case: amount, parties, transaction history, indicator code. The case is assigned to an officer, and the status is visible to the whole team.
Step 4
Officer’s decision
The responsible officer carries out enhanced due diligence, requests documents, processes the transaction or passes the refusal decision to an authorised person. Comments and attachments stay in the case.
Step 5
Report and log
For a suspicious transaction the case fills in the report template, and the officer sends the information through the bank’s channel. The log records who made the decision, when and why.
Five laundering schemes in cashless payments: from a pass-through account to circular transfers
Pass-through account
Money does not stay
A company receives payments from dozens of payers and the same day sends almost everything on. The pass-through rule calculates the ratio of debits to credits over a day.
Structuring
Below the threshold, but many
A large sum is split into transfers slightly below RUB 1 million. The total for the period and the common recipient are visible in the profile.
Cashing out through cards
Company → individuals → cash
Transfers from a current account to individuals’ cards and withdrawals at ATMs. The link between recipients and withdrawals forms a single chain.
Payments “for services” with no substance
Turnover without business activity
Payments for consulting and marketing with no taxes, salaries or rent. The rule compares the payment purpose with the customer’s profile.
Circular transfers
The same parties
Money goes round several companies and returns to the first. The link graph shows the closed chain.
115‑FZ
The scheme is visible in the flow, not in a single payment
Rule Engine and behavioural model: why a payment received a high risk score
Every score is explainable
A transaction’s risk is built from the rules your bank sets and from how much the payment differs from the customer’s normal behaviour. The officer sees what was triggered.
- 01
Rules and thresholds
Your own rules, thresholds and filters for the bank’s risk policy: amount, transaction type, country, purpose, link to a Bank of Russia indicator code. A rule can first be run in observation mode.
- 02
Customer profile
The model is trained on your data and knows what is usual for a customer: amounts, counterparties, timing, regions. Anything atypical raises the risk.
- 03
Links
Shared counterparties, repeat recipients and chains between the bank’s customers are visible as a graph, not as a list of payments.
- 04
External lists
The Rosfinmonitoring list and the OFAC, EU and UN sanctions lists — in the same assessment, without a separate request.
- RUB 1 million mandatory-control threshold under art. 6 of 115‑FZ
- 3 business days to report a suspicious transaction
- 1 business day to report a refusal of a transaction
A suspicious transaction is detected: process it, request documents, refuse or report
Detecting suspicious transactions is only the start: next come the decision, the deadline and the grounds. The tag shows who closes the line.
- A false positive is closed with a comment and a reason
- A rule that is often wrong goes into observation mode
- A closed case stays in the log with the author and time
- Requesting documents and information from the customer — from the case
- The reply deadline and the customer’s refusal are recorded in the case
- Documents are attached to the case and visible to the inspector
- The refusal decision is made by the head or an authorised person
- Information on the refusal — no later than the business day after the decision
- The grounds for the refusal and the indicator codes — in the case card
- Information on a suspicious transaction — no later than three business days after detection
- The report template is filled in with the case data
- Sent to Rosfinmonitoring — through the bank’s channel
115‑FZ, 161‑FZ and 210‑FZ: where AML monitoring ends and anti-fraud begins
The same payment flow is checked from two sides: whether the customer is laundering money and whether money is being stolen from the customer. These are different laws, deadlines and actions. This page is about 115‑FZ, transfers without the customer’s consent under 161‑FZ — on the fraud monitoring page, the 210‑FZ deadlines and the Antifraud state information system — on a separate page.
Payment transaction monitoring for banks, NBCOs, electronic money operators and aggregators
The 115‑FZ requirements are the same, but each organisation has its own flow of transactions — from companies’ current accounts to wallet transfers.
-
Universal bank
- Current accounts of legal entities and sole proprietors, cards and deposits — in one flow
- Customer risk groups from the Bank of Russia — in the rules
- Installation inside the bank’s perimeter
-
NBCO and non-bank credit organisation
- Transfers without opening an account and partner settlements
- Pass-through and structuring at recipients
- The same 860‑P requirements for the internal control rules
-
Electronic money operator
- Top-ups and withdrawals of wallets
- Wallets with simplified identification — stricter thresholds
- Linked wallets of one person
-
Payment aggregator and agent
- Merchant monitoring at the partner bank’s request
- Turnover that does not fit the merchant’s profile
- Export for the partner bank
-
Broker and asset management company
- Customer’s deposits and withdrawals of money
- Third-party transactions in the customer’s favour
- Watchlists and sanctions for counterparties
-
How much payment transaction monitoring costs
Monitoring is priced by flow volume and installation option. Customer and counterparty database checks — per the price matrix, with no subscription fee.
- Calculate
Transaction monitoring
on request
Rules and thresholds, Bank of Russia indicators, the behavioural model, cases and the log. The price depends on the number of transactions per month and the hosting.
- Build a set
Database checks
5 ₽
per check: Rosfinmonitoring list, sanctions, passport, taxpayer ID (INN), bankruptcy — for a customer and a counterparty. The extended check package — RUB 50.
- Enable
International screening
36 ₽
PEP, sanctions and negative media for non-residents.
We start the pilot in observation mode on a copy of your flow: the rules calculate but do not interfere. Customer KYC by passport — from RUB 16.
Connection: the transaction flow from the core banking system, the responsible officer’s back office, hosting in your perimeter
- Kafka
- REST API
- ISO 20022
- Webhooks
- On-premise
Pilot in observation mode.
We start the pilot on a copy of your flow: the rules calculate but do not interfere. NeuroVision engineers support the integration; the data retention period is set in the contract.
Glossary of transaction monitoring under 115‑FZ
A short guide to the terms of the law, Regulation no. 860‑P and the responsible officer’s back office.
- Mandatory-control transaction
- A transaction from RUB 1 million of one of the types listed in art. 6 of 115‑FZ; the information is sent regardless of suspicions.
- Mandatory control
- Suspicious transaction
- A transaction about which the bank, under its internal control rules, suspects money laundering or terrorist financing.
- Suspicious transaction
- Internal control rules (ICR)
- An organisation’s document on how it detects transactions, assesses risk and reports to Rosfinmonitoring.
- Internal control rules
- Unusual-transaction indicator
- An indicator from the annex to Regulation no. 860‑P with a four-digit code that a monitoring rule relies on.
- Red flag
- Pass-through
- Money arrives and is almost entirely debited within a short time, with no economic sense for the customer.
- Pass-through
- Structuring
- Splitting an amount into transactions below the control threshold.
- Structuring
- Alert
- A signal about a triggered rule, from which a case is created.
- Alert
- Case
- A card for reviewing an alert: transactions, parties, the customer’s history, comments and the decision.
- Case
- KYC risk group
- The Bank of Russia’s assessment of which suspicious-transaction risk group a legal entity or sole proprietor belongs to. More about the customer risk level.
- KYC platform risk group
- Observation mode
- A new rule calculates risk but does not affect transactions — for tuning without false refusals.
- Shadow mode
Read also
115‑FZ, KYT and financial monitoring — in our blog.
175 16
KYC, AML and Digital Identification
KYT (Know Your Transaction): What It Is, How Transaction Monitoring Works, and Where the Travel Rule Fits In
154 28
KYC, AML and Digital Identification
Financial Monitoring and AML/CFT in Simple Terms: What It Is, Who It Applies To, and How It Works
126 29
KYC, AML and Digital Identification
115-FZ: What Businesses Are Required to Do and How to Meet the Law’s Requirements
384 22
KYC, AML and Digital Identification
Fintech Compliance Under Federal Law 115-FZ: How to Build a KYC and AML Loop Without Overloading the Team
Frequently asked questions about payment transaction monitoring
It is a continuous check of customers’ transactions under the internal control rules: which transactions are subject to mandatory control, which look like laundering, and which must be reported to Rosfinmonitoring. NeuroVision assesses every transaction in real time and creates a case for a triggered rule.
This page covers cashless payments in roubles and foreign currency under 115‑FZ. Digital-currency transfers with payer and recipient data are covered on the page KYT for crypto.
RUB 1 million or the foreign-currency equivalent for the types of transactions in art. 6 of 115‑FZ. The RUB 600,000 threshold from older articles no longer applies.
No later than three business days after the day of detection. For mandatory-control transactions — no later than three business days after the day of the transaction; for a refusal — no later than the business day after the decision.
No. We fill in the report template with the case data and keep the log, while your bank sends the information through its own channel.
Any from the annex to Regulation no. 860‑P: a rule is linked to an indicator code, and the alert shows what was triggered. The set of indicators and thresholds is determined by your bank in its internal control rules.
For monitoring under 115‑FZ — nothing: 210‑FZ does not change it. From 1 March 2027 it changes how transfers without the customer’s consent are detected under 161‑FZ — that is fraud monitoring.
A new rule first runs in observation mode, the behavioural model takes the customer’s normal behaviour into account, and a case closed as false helps to fine-tune the threshold.
Yes, if your system passes it as a customer attribute: the rules are stricter for the high-risk group.
Yes. Cloud or installation on your servers, encryption, audit of actions and access control.
We start the pilot in observation mode on a copy of your flow, and NeuroVision engineers support the integration. The timing depends on the data sources and is agreed at the start.
Monitoring — on request, by transaction volume and hosting. Customer and counterparty database checks — RUB 5, international screening — RUB 36. More in the price matrix.
Let’s discuss transaction monitoring at your bank or payment service
Tell us how many transactions you have per month and which systems they come from. We will propose a pilot in observation mode and calculate the cost.
Can't put your request into words? Book a call and our team will contact you at a convenient time
Book a call
The company is included in the register of IT companies and the register of personal data operators of the Russian Ministry of Digital Development.
Address: Moscow, Presnenskaya Embankment 12 — Moscow City business centre, Federation Tower. Nearest metro stations: Delovoy Tsentr and Mezhdunarodnaya.
