several variations of the same typology, accumulated over years as new scenarios had been added without retiring old ones - **Alert composition**: reviewing a sample of 80 backlogged alerts, he estimated 3 genuine suspicious activity indicators. The rest were legitimate transactions tripping thresho