Most sophisticated programs use a layered approach: - Rules-based layer: known typologies, regulatory-required scenarios (structuring, CTR-adjacent patterns) - ML layer: novel patterns, risk scoring, alert prioritization - Priority-weighted queue: highest-risk alerts reviewed first regardless of det