More alerts is not more thoroughness. Alert fatigue is how real cases get missed.
A common mistake when deploying AML transaction monitoring is to treat alert volume as success: more rules, more alerts, more thoroughness. In practice, alert fatigue is one of the usual ways real suspicious activity gets missed.
Start from typologies that fit your customers, not a generic rule library. Begin with the patterns most plausible for your own business.
Track false positives by rule, not only in total. Totals hide exactly what you need to fix the problem.
Use risk scoring to order the queue. A corporate account with a long history and a newly opened account carry different risk. Static alerting treats them the same.
Feed investigation results back into tuning on a schedule. If an analyst closes fifty alerts from one rule as false positives, that is a signal to tune it.
Do not add a rule for every typology in the news. A quarterly check asking whether each rule still earns its alert volume keeps the ratio from sliding.
The goal is not fewer alerts for their own sake. It is a system where the alerts an analyst sees are worth the attention.