Working alerts and cases

In short

SpeculaPro gives compliance teams four screens for day-to-day monitoring work:

Screen	What it is for	Find it in the menu
Command center	Your start page: what needs attention now, the riskiest open alerts and closures waiting for approval	Command center
Analytics	Month-by-month trends: volume by channel, typologies, rule performance, alert outcomes and decision outcomes, over up to 24 months	Analytics
Transactions	Every transaction received in the last 1 to 90 days, with the ones a rule flagged tinted. Search by reference or customer to look up a payment	Transactions
Alert queue and alert detail	Every alert raised by your rules, riskiest first. You review an alert, then dismiss it or open a case	Alerts
Cases	Investigations: who owns them, their deadlines, the evidence, notes and the full history	Cases

A typical day looks like this:

 Command center ──▶ Alerts ──▶ alert detail ──┬──▶ Dismiss (false positive, no action, duplicate)
                                              │
                                              └──▶ Open case ──▶ Cases ──▶ work, escalate, close
                                                                               │
                                                     high or critical case ───▶ second person approves
                                                     (or one whose escalation policy requires it)

If you are new to these ideas, read Alerts and cases first. It explains what an alert and a case are, independently of the screens.

The menu

The menu on the left of every page lists the main areas your role can open. A section you have no permission for isn’t shown: for example, the Alerts item appears only if you have alerts.view, and Cases only if you have cases.view. The same applies to the command palette (⌘K or Ctrl+K) and, on a phone, to the tab bar at the bottom, which shows the first five sections you can open. Which role sees which item is listed in What you see in the menu.

Two items show a small number next to them on wide screens:

• Alerts: the number of open alerts in your workspace (alerts nobody has dismissed or put into a case yet).
• Cases: the number of active cases assigned to you.

A number is only shown when it is above zero.

Screening appears for people who can see or review potential sanctions and PEP matches (screening.view or screening.review). It has no number next to it. See Reviewing a potential match.

The screens refresh themselves

The alert queue, the case list, the menu numbers and the Command center reload their data every 30 seconds, so you don’t need to refresh the page to see new alerts. When you take an action yourself (for example dismissing an alert), the affected lists update straight away.

An open alert or case page reloads every 20 seconds, and straight after any action you take, even one that was refused. So if a colleague changed the case at the same moment (for example took it, or closed it), the page catches up and shows you the current state rather than leaving you with an out-of-date view.

Who can do what

What you see depends on the permissions in your role. Buttons you are not allowed to use are simply not shown.

You want to…	Permission needed	Analyst	Senior analyst	MLRO / Compliance officer	Auditor	Rule author	Rule approver	Administrator
See the alert queue and alert details	alerts.view	✔	✔	✔	✔	✔	✔	–
See customers’ real names on alerts and cases	entities.view	✔	✔	✔	✔	✔	–	–
See the case list and case details	cases.view	✔	✔	✔	✔	–	–	–
Dismiss an alert, close several alerts at once, open a case, take, start, release or escalate a case, change its team queue, add notes, add evidence files	cases.work	✔	✔	✔	–	–	–	–
Read the AI assistant’s advice on an alert, where the workspace uses it (its reasoning also needs entities.view)	alerts.view	✔	✔	✔	✔	✔	✔	–
Ask the AI assistant about an open alert, for a summary of a case, or about the whole queue	cases.work and entities.view	✔	✔	✔	–	–	–	–
Read the AI assistant’s summary of a case and its suggestion (the text and reasons also need entities.view)	cases.view	✔	✔	✔	✔	–	–	–
Download a case’s evidence files	cases.view and entities.view	✔	✔	✔	✔	–	–	–
Close a case	cases.close	–	✔	✔	–	–	–	–
Approve or send back a closure, reopen a closed case	cases.approve	–	–	✔	–	–	–	–

These are the default roles. Your administrator may have given you more than one role, or a custom one.

Assigning a case to a colleague

The screens let you take a case for yourself and release it. Assigning a case directly to someone else needs cases.approve and is only possible through the API for now. On screen, release the case and ask your colleague to take it.

“missing permission …”

If you follow a link to a page your role can’t open (for example a case link a colleague sent you), the page shows a red message such as missing permission cases.view. It isn’t a fault. Ask your administrator or MLRO if you need access. The Administrator role, for example, manages users and settings but deliberately can’t see alerts or cases.

Names hidden for some roles

People whose role can’t view customers (by default, the Rule approver) still see alerts, so they can judge how rules behave, but every customer, account or counterparty is shown under a stable code such as Customer 3f9a1c instead of a name. The same code always means the same subject. Reference numbers, the customer’s segment and counterparty names are left blank for them.

Where to go next

1. Use the Command center to see what needs you.
2. Look up a transaction someone asks about.
3. Work the alert queue.
4. Review an alert, then dismiss it or open a case, with the AI assistant’s advice where your workspace uses it.
5. Work a case.
6. Add evidence files to a case.
7. Escalate a case.
8. Close a case, and approve closures.

For the method an investigator follows (what to check and how to decide), see the playbooks.

Related

• Alerts and cases
• Escalation and SLAs
• Roles and permissions
• Investigating an alert
• Alerts and cases API