Investigating an alert

Ce contenu n’est pas encore disponible dans votre langue.

In short

Every investigation, whatever the rule, follows the same five steps:

Understand why the alert fired.
Gather context about the customer.
Look wider: history, counterparties, linked accounts, designations.
Decide: is there a reasonable explanation, or are there reasonable grounds to suspect?
Document what you did and why, then close, escalate or report.

This page explains each step. The typology playbooks add what to look for in specific patterns.

The standard you are applying

You are not trying to prove a crime. That is the job of law enforcement. You are deciding whether you have reasonable grounds to suspect that funds are linked to crime or terrorist financing.

Standard	Meaning	Your role
Certainty / proof	Evidence beyond reasonable doubt	Not your job
Reasonable grounds to suspect	A reasonable person, knowing what you know, would suspect something is wrong, and you can’t find a credible, legitimate explanation	This is the threshold for reporting
Hunch	A feeling you can’t explain	Not enough on its own; dig further

Step 1: Understand why it fired

Start with the alert itself. Every alert groups one or more hits, and every hit records:

which rule and rule version fired,
the parameters that were in force (for example, “threshold GHS 50,000 over 7 days”). These are stored with every hit but not yet shown on the alert screen; the rule’s page in the rule library gives the defaults, and your rule owner can tell you if yours differ,
the feature values the rule saw (for example, “total cash-in GHS 53,200 from 6 agents”),
the transactions involved.

Ask yourself:

What exactly is the rule looking for? Read its page in the rule library if you aren’t sure.
By how much did the customer cross the line? GHS 50,100 against a GHS 50,000 threshold is different from GHS 500,000.
Did several different rules fire for the same customer? Several independent rules agreeing is a much stronger signal than one.

Step 2: Gather context about the customer

Look at what you know about who the customer is and what they told you when they joined.

Select the customer’s name at the top of the alert or case to open their profile: it shows their segment, KYC tier, risk rating, flags, accounts, declared monthly volume and the last 90 days of activity on one page.

Question	Where to look
Individual or business? What do they do?	Customer record: type, segment, occupation or industry
What did they say they would use the account for?	Declared monthly volume, onboarding notes
How long have they been a customer?	Onboarding date, account opening dates
How well do we know them?	KYC level / tier
What risk rating do we give them?	Customer risk rating
Are they flagged?	Active risk designations: PEP, sanctioned, high-risk, adverse media, watchlist

The key question is: does this activity fit the customer? GHS 40,000 a week through a wallet is normal for a busy provisions wholesaler at Makola and very unusual for a student.

Step 3: Look wider

One transaction rarely tells the story. Look at:

History. What did the account look like over the last 3, 6 and 12 months? Is this a sudden change or a steady pattern?
Counterparties. Who sends money in? Who receives it? Are they many unrelated people, a few regular partners, or the customer’s own accounts?
Linked customers. Does this customer share a phone number, device or ID number with other customers? (The D5 rule looks for this.)
Previous cases. Has the customer, or a counterparty, been in a case before? What was the outcome?
Open-source information. A simple web search on a business name can confirm it exists and does what it says. Record what you searched and what you found.

Step 4: Decide

Weigh what you found. Possible outcomes:

What you found	What to do
A clear, documented, legitimate explanation	Dismiss the alert, or close the case, as false positive (see Choosing a disposition)
The activity is unusual and you can’t explain it, but it isn’t suspicious enough to report yet	Keep the case open, gather more information, or ask a senior analyst; consider whether a temporary monitoring period is right
You can’t decide, or the case is outside your authority (PEP, sanctions, very large amounts)	Escalate to the next level (see Escalation and SLAs)
Reasonable grounds to suspect	Escalate for a report following your institution’s process. See Writing an STR
A possible sanctions match	Stop and escalate immediately. Don’t process further transactions until the MLRO decides

Step 5: Document

Write your conclusion on the case so that someone who has never seen it can follow your reasoning. A good note covers:

What triggered the alert, in one sentence.
What you checked: records, history, counterparties, sources.
What you found, with amounts and dates.
Your conclusion and why.
What happens next: closed, escalated, reported, monitoring period.

Example: a good closing note

Alert on B2 (cash-in split across agents): GHS 46,500 cash-in through 5 agents in Kumasi over 6 days. Customer is a registered business (cement and building materials retailer, Adum) onboarded 2023, KYC tier 3, declared monthly volume GHS 180,000. 12-month history shows the same pattern every month around the 20th–26th, matching the declared business of collecting payments from site contractors. Counterparties are the same 8 contractors seen monthly. No designations, no previous cases. Activity consistent with the customer’s known business. Closed as false positive. Suggest reviewing B2 parameters for the building-materials segment.

Example: a poor closing note

Customer is a business. Looks fine. Closed.

The second note gives a reviewer nothing to check and an auditor no reason to trust the decision.

Where each step happens in SpeculaPro

Step	On screen	Guide
Pick the alert	Alerts, Open tab. The riskiest alert is at the top: critical, then high, medium and low, and by score within each	Alert queue
1. Understand why it fired	The alert page: the summary, then Evidence, one card per rule hit with the rule and version, the explanation, the transaction and the feature values. Look up the rule’s parameters in the rule library	Reviewing an alert
Quick look: dismiss or investigate?	If the alert plainly needs nothing further, Dismiss it as False positive, No action needed or Duplicate, with a rationale. Otherwise select Open case. If the customer already has an active case, the alert joins it	How to dismiss, How to open a case
2–4. Gather context, look wider, decide	On the case, select Start work, then record what you check as notes on the timeline as you go, and add the documents you collect as evidence files. The subject card shows the customer’s segment, KYC tier, risk rating and designations; select the name for the full profile with 90 days of activity	Working a case, Customer profile
Beyond your authority?	Escalate, with a reason. The case moves up a level, its priority rises one step, its deadline restarts, and it is unassigned so someone at the next level can take it. Where an escalation policy applies, it joins that level’s team queue	Escalating a case
5. Document and close	Close case with an outcome and your closing note as the rationale. Needs `cases.close` (Senior analyst or MLRO). High and critical cases, and cases whose escalation policy requires it, then wait for a second person to approve	Closing and approving