The alert and its scope
The scenario, the period, the accounts and parties swept in, and what the alert does not reach.
For AML investigations and financial crime teams
The alerts you closed are the ones an examiner will sample.
Bring the alert as it fired, the customer profile it lands on, the requests still open, and the explanations competing to account for the activity into one revisable Decision Update. Name the person who owns the filing decision, because a reviewer arriving later will look for them first.
Request accessAccess is limited. A person reviews every request.
The decision problem
A decision not to file is still a decision, and it is the one that gets sampled.
The defects have names. A narrative that repeats the fields the alert already populated. A closure with nothing behind it. An escalation that arrived late because the queue was sized to the staffing rather than to the risk. What independent testing measures is accuracy, timeliness, completeness, and conformance to your own procedures, and what an examiner does is follow one alert through the whole process. Both of those read the file. Neither can read the investigator who closed it.
- 01
The alert, and what it is actually alleging
The scenario that fired, the population it swept in, and the behaviour it alleges, held apart from one another. An alert is a hypothesis about a customer, and the file should be able to say which hypothesis it was.
- 02
What the profile already answers
The due diligence on file, source of funds and source of wealth kept as the separate things they are, and the date each was gathered. An attestation describing a period outside the review cannot speak to activity inside it.
- 03
The request that has not come back
A request for information sits in the record as open, with a recipient and a date, rather than as a gap the narrative writes around. The clock runs from the point the facts are known, and an unanswered request is part of what is known.
- 04
The ordinary explanation, kept alive
Structuring and an ordinary cash cycle can produce the same population. Both readings stay in the record with whatever separates them, so a reviewer can see the alternative was weighed rather than take it on trust.
- 05
The narrative someone reads cold
Who, what, when, where, why, and how the activity was conducted. Whether it completed or was only attempted. Who benefited. Whether it stands alone or continues earlier activity. And what was left out, with the reason it was left out.
The reviewable artifact
A case Decision Update that supports the closure as well as the filing
Most review tooling is built to justify the reports that go out. The harder file to defend is the one where nothing went out, and this is the record that has to carry it.
Profile against activity
The due diligence relied on, when it was gathered, and whether the activity is consistent with what was expected of this customer.
Open requests
Information asked for and not received, who it was asked of, and when, kept visible instead of absorbed into the narrative.
The decision and its owner
Close, escalate, or recommend filing, the named decision maker, and a reason a reviewer arriving cold can test as supported and reasonable.
Example of a held verdict. Not a customer record.
Held. This alert can be neither closed nor escalated on the file as it stands.
Missing proof
- The request to the relationship manager on expected cash volumes is open, and both the closure and the escalation turn on the answer.
- The source of funds attestation was gathered at onboarding and describes a period outside the review, so it cannot speak to the current inflows.
- The screening hit carries a blank date of birth, so it can be neither confirmed nor discounted, and the payment stays held while it is unresolved.
A held verdict is a refusal to settle with the missing proof named. It is the state most tools cannot represent, and it is what makes a Decision Update worth reading when the answer is not ready.
What this does not touch
It does not screen, does not decide a disposition, and does not file. It reaches no case management system and no monitoring platform. The filing decision stays with the person your board designated, in the system of record, and nothing here changes what may and may not be said to a customer under review.
What to bring: Bring the alert as it fired, the transaction population you are permitted to work from, the due diligence on file with its dates, prior alerts on the same relationship and how each was decided, and the requests still outstanding. Bring only what your authorization covers, and nothing that would amount to tipping off.
Access
Start an account, or request access to the cohort.
Request access for a bounded cohort working alert dispositions where the closure has to be as well supported as the filing.
An account is the door to the product as it stands today. Availability of the limited alpha is a separate question: a request is reviewed by a person and does not grant admission, an invitation, an account, a Room, entitlement, or payment access.