Ask a bank CEO what an analyst costs and you'll get a number in seconds. Ask how many alerts are open right now, and how old the oldest one is, and see how long the answer takes.
That second number is a liability. It just doesn't sit on the balance sheet, so nobody prices it.
I call it alert debt: the open, ageing alerts and reviews your controls created and your team hasn't worked yet. Like any debt, it's fine in small amounts and dangerous once it compounds. And it compounds quietly, because every alert that ages makes the next one look normal.
Here's what the interest looks like when a regulator collects it.
In Ireland, the Central Bank found that faults in the configuration of Coinbase Europe's transaction monitoring system left 30,442,437 transactions, about 31% of its transactions in that period and worth over €176 billion, not properly monitored over 12 months. Strictly, that's monitoring that never ran rather than alerts sitting in a queue. The accounting is the same. Completing the monitoring took almost three years and led to 2,708 suspicious transaction reports to the FIU. Then came a €21,464,734 fine, confirmed by the High Court in January.
In the UK, the FCA's Final Notice to Starling Bank describes a customer base that grew from about 43,000 in 2017 to about 3.6 million in 2023, with financial crime controls that "failed to keep pace with its growth." When the bank raised its own financial crime risk rating to red in late 2022, the notice records a backlog of high-risk customer reviews and customer screening alerts as part of the picture. The penalty was £28,959,426.
I read both notices the same way. Volume grew faster than the system built to work it. That's a growth decision, and growth decisions sit with the CEO.
In the UAE, the bill can also carry a person's name. In June, CBUAE fined a foreign bank's branch AED 20 million for "significant, repeated failures" in its AML, CFT and sanctions framework, and fined its Head of Compliance and MLRO AED 300,000. The release doesn't mention a backlog, and I'm not claiming one. My point is narrower. If your MLRO is carrying a queue the business never funded, you've moved firm risk onto one person and booked it as a saving.
My line in the sand: alert backlog belongs in the board pack every month, reported by age. Count shows how busy the team is. Age shows what you owe.
More analysts aren't automatically the fix, and next Wednesday's issue is about exactly that. The fix starts with seeing the debt. At FluxForce, our AI agents investigate each alert and prepare the case, so your analysts make the call faster and every decision leaves evidence an examiner can replay.
Does your board see alert backlog by age, or not at all?
Sources
- Central Bank of Ireland, enforcement action against Coinbase Europe Limited, 6 November 2025: press release
- FCA, Final Notice to Starling Bank Limited, 27 September 2024: final notice (PDF