Systems and methods are disclosed for managing transaction data from a plurality of financial services for a suspicious activity monitor (SAM). In one implementation, transaction data from each financial service is conformed to a standard format for publication. The publication may occur either substantially in real time as each transaction is conducted, at predefined intervals, or in periodic batches. A SAM data manager may then retrieve and process the transaction messages, including filtering non-required transactions, removing levels of hierarchy from the data, arranging the data in a predefined document structure, adding tags that may be required by the SAM tool, and creating SAM messages. The SAM data manager may thereafter forward the SAM messages to the SAM tool for analysis. In some embodiments, the SAM data manager may also send any updates of member and account data contained in the transaction messages to a central repository for such data.