Choosing a disposition

In short

There are two moments when you record an outcome: when you dismiss an alert that needs no investigation, and when you close a case. Each has its own short list of dispositions.

A case can’t be closed without a disposition: the recorded outcome of your investigation. Choosing the right one matters for two reasons:

• Evidence. Auditors and regulators read dispositions to see that alerts are handled properly.
• Tuning. Disposition statistics show which rules produce useful alerts and which mostly produce noise. See Tuning and calibration.

Dismissing an alert

If a quick look at an open alert shows there is nothing to investigate, you can dismiss it without opening a case. Analysts can do this (it needs cases.work), so it is the usual way level 1 clears obvious noise.

On screen	Stored as	Use it when
False positive	false_positive	The activity has a clear, legitimate explanation that you checked
No action needed	no_action	The alert is accurate, but nothing further is needed, for example activity that is already known and documented
Duplicate	duplicate	Another alert or case already covers the same activity

On the alert, select Dismiss, choose the outcome and write your rationale; see How to dismiss an alert.

A note (the Rationale box) is optional, but write one whenever the reason isn’t obvious from the alert itself. A dismissed alert can’t be reopened, so if you have any doubt, open a case instead.

Dismissing several alerts together

On the Open tab you can tick several alerts and close them at once with one outcome and one reason, which is then required. Use it when the alerts share one explanation that you have checked for each of them, for example the same registered agent’s device or the same payroll run. Don’t use it to clear a backlog.

• Write the reason so that it is true of every alert in the selection. If you would have to write most of these, the selection is too wide.
• Sanctions alerts, critical alerts and alerts about PEPs or sanctioned subjects can’t be closed this way. Alerts about relatives and close associates of PEPs and about high-risk customers can, so leave those out yourself if your policy treats them the same.
• Where your workspace uses the AI assistant, its marker (AI: likely false positive) is a reason to look at an alert, never a reason to close it. Closing everything the assistant marked, unread, is the model deciding under your name.

When to open a case instead

Open a case when you need to look wider than the alert (history, counterparties, linked customers), when you need to ask someone, or when the subject has designations such as PEP. A case keeps your notes on a permanent timeline; a dismissal keeps only one note.

Closing a case: the dispositions

Closing a case needs cases.close, held by Senior analysts and the MLRO by default. If you are an analyst, document your conclusion on the timeline and escalate, or ask a senior analyst to close it.

On the case, select Close case; see How to close a case. The screen shows each outcome by its label:

On screen	Stored as	Use it when	Don’t use it when
False positive	false_positive	The activity has a clear, legitimate explanation that you verified	You simply ran out of time, or you “think it’s probably fine” without checking
Suspicious, no report	true_positive_no_report	The activity is genuinely unusual or matches the pattern, but after investigation you don’t have reasonable grounds to suspect	You do have grounds to suspect. Then you must report
Report filed	report_filed	You have filed (or are filing) an STR or other report linked to the case	The report is still a draft that nobody has approved
Customer exited	customer_exited	Your institution has ended the relationship with the customer, alongside any report decision	It’s being used to avoid the reporting decision. Exiting and reporting are separate questions
Duplicate	duplicate	Another open or closed case already covers the same activity	The other case is about a different period or pattern
Other	other	None of the above fits; explain in the note	As a habit. Frequent use of other hides useful information

Exiting a customer doesn’t replace a report

If you have reasonable grounds to suspect, you must report whether or not you keep the customer. Closing the account without reporting can itself breach your obligations, and closing it in a way that signals suspicion can amount to tipping off. Agree the order and wording with your MLRO.

False positive or true positive, no report?

This is the distinction people find hardest:

• False positive: the rule fired, but the behaviour turned out to be normal for this customer. Example: a wholesaler’s usual month-end supplier payments crossed a threshold.
• True positive, no report: the behaviour was what the rule looks for and is genuinely unusual, but you established it isn’t suspicious. Example: a customer really did receive money from 30 people in two days, because they were collecting contributions for a funeral, and you verified this.

The difference feeds tuning: lots of false positives mean the rule needs adjusting for that segment; true positives without reports mean the rule is detecting the right behaviour.

How to write a good closing note

Every disposition needs a note that lets a reviewer check your reasoning. Include:

1. What the alert was about (one sentence).
2. What you checked.
3. What you found, with figures.
4. Why that leads to this disposition.
5. Any follow-up: a tuning suggestion, a designation added, a linked case.

See the good and poor closing notes for examples.

Make false positives useful

When you close a false positive, say why the rule misfired if you can see it: “Threshold too low for the wholesale segment”, “Fan-in rule doesn’t recognise church collections”. These notes are how the rule owners know what to change.

When closing needs a second person

Closing a high or critical case, a case whose escalation policy requires a second person, or any case if your workspace requires it, doesn’t close it straight away. It goes to Awaiting approval with your outcome and rationale as a proposal, and a second person with cases.approve (by default the MLRO) must select Approve closure. If they select Send back, the case returns to you In progress, and their note says what’s missing. See How to approve or send back a closure.

The database refuses an approval by the person who proposed the closure. See Four-eyes closing.

Reopening

If new information comes to light, someone with cases.approve (by default the MLRO) can reopen a closed case with Reopen, giving a reason. See How to reopen a closed case. It returns to in progress, assigned to them, with a fresh deadline, and must be closed again with a new disposition. The reopening is recorded on the case timeline after the original closure, so nothing is lost.

To record something on a closed case without reopening it, for example a later FIC reference, add a note on the case’s timeline as usual. See How to add a note. The closure itself is unchanged.

Related

• Investigating an alert
• Writing an STR
• Alerts and cases
• Tuning and calibration
• Quality assurance