Investigation playbooks

In short

SpeculaPro tells you that something looks unusual. The playbooks help you decide whether it is suspicious, what to check, what to write down, and what to do next.

They are written for the people who work alerts every day: analysts, senior analysts, and MLROs and compliance officers who review their work. You don’t need a technical background to use them.

Playbooks describe a method; the screen guides show the clicks

The playbooks explain how an investigator thinks and works, using SpeculaPro’s building blocks (alerts and cases, escalation, dispositions, designations, suppressions and reports).

For step-by-step help with the screens themselves (the alert queue, dismissing an alert, opening, working, escalating and closing a case, and approving closures), see Working alerts and cases. Designations and suppressions are managed from the customer’s page, and lists on the Rules page (see Customers and lists); each can also be scripted through the API (Designations, Suppressions, Lists). Reports are drafted, approved and filed under Reports; see Regulatory reporting.

Which playbook do I need?

You are…	Start with
Working your first alert	Investigating an alert
Looking at deposits just under a limit, or cash spread across agents	Structuring
Looking at money that arrives from many people and leaves quickly	Mule accounts
Looking at a mobile money agent’s activity	Agent abuse
Looking at a sudden change of phone, device or details followed by a payout	Account takeover and SIM swap
Looking at a politically exposed person or a high-risk customer	PEPs and high-risk customers
Deciding whether a customer or counterparty is the party on a sanctions or PEP list	Reviewing a sanctions match
Ready to report	Writing an STR
Ready to close	Choosing a disposition
Talking to a customer during an investigation	Tipping off and confidentiality
An MLRO checking the team’s work	Quality assurance

How each typology playbook is laid out

Every typology playbook follows the same shape, so you always know where to look:

1. What it looks like: the pattern in plain words, with a Ghana example.
2. Which rules surface it: the rule library entries that raise this kind of alert. Not every library rule ships in a pack. Pack contents lists exactly which ones each pack contains today, pack by pack.
3. Red flags and innocent explanations: a table to help you weigh what you see. Most alerts have an innocent explanation; your job is to find out which.
4. How to investigate: numbered steps.
5. What to record: the evidence a reviewer, auditor or the FIC will expect to find in the case.
6. When to escalate or report.

Three rules that apply to every investigation

Never tell the customer they are being investigated or reported

Warning a customer that they are under suspicion, or that a report has been or may be filed, is called tipping off. In most AML laws, Ghana’s included, it is a criminal offence. You may need to ask a customer questions; read Tipping off and confidentiality before you do.

Write it down as if a stranger will read it

Every case may be read years later by an auditor, a regulator or a court who knows nothing about it. Your notes on the case timeline can’t be edited afterwards, so write clearly the first time: what you looked at, what you found, and why you decided what you decided.

An alert is a question, not an accusation

Rules are deliberately broad so that real cases aren’t missed. Most alerts turn out to be legitimate. A well-documented “not suspicious, because…” is as valuable as a report: it shows the system is working and helps tune the rules.

Ghana-specific requirements

Where these playbooks mention reporting deadlines, thresholds, record retention or goAML fields, confirm the details with current FIC guidance and your institution’s AML policy. They change, and your policy is what your regulator will hold you to.

Related

• What is transaction monitoring?
• How SpeculaPro works
• Alerts and cases
• Glossary