How to run a case
How to scope an investigation, what order to establish facts in and how to tell when you have enough.
Most alerts have an innocent explanation. A good investigation finds it quickly when it exists, and builds a defensible record when it does not. Both halves matter: a team that cannot close cases confidently drowns, and a team that closes them carelessly files nothing until the regulator asks why.
Start by writing down the question
An alert tells you something tripped a rule. It does not tell you what you are trying to establish. Before opening anything else, write one sentence: what would have to be true for this to be suspicious, and what would have to be true for it to be fine.
This sounds like a formality. It is the habit that pays back most. An investigation without a stated question expands until the analyst runs out of time, and what gets recorded is whatever they happened to look at.
Establish facts in order of cost
Cheap facts first. Not because they matter more, but because one of them often ends the case.
- 1
What does your own record say
Who is the customer, how long have they been one, what did they tell you they do, and does this activity match it. This costs nothing and resolves a surprising number of alerts on its own.
- 2
What is the counterparty
Attributed to a known service, or unattributed. Check when the attribution was established, not just what it says.
- 3
What is the pattern
One transfer or many, over what period, in what amounts. A pattern is usually more informative than any single transfer in it.
- 4
What does the customer say
Expensive, slow and sometimes the only thing that settles it. Leave it until the cheaper facts have narrowed what you need to ask. Asking can be tipping off. Your SOP says when.
What the obligation is
In Australia the trigger is suspicion on reasonable grounds, and reasonable grounds is judged objectively: what a reasonable person in your position would think, not what you personally feel certain about. You do not need to be sure a crime occurred. AUSTRAC sets out the trigger and the timeframes(AUSTRAC — suspicious matter reports), and the timeframes are short enough that an investigation which drifts for a fortnight has already failed regardless of what it concludes.
Three features of the obligation change how you should work, and all three surprise people arriving from other kinds of financial crime work.
- The service does not have to happen
A declined transfer, an abandoned onboarding, an enquiry that went nowhere. The duty can arise even where you never provided anything, so a case closed because nothing happened still needs the suspicion question answered.
- A new suspicion means a new report
Having reported a customer once does not cover you for the next thing. Each fresh suspicion is its own report, cross-referenced to the earlier ones.
- You cannot tell the customer
Tipping off is a separate offence. It constrains how you ask the questions in step four above, and your SOP should say what you may and may not put to a customer once suspicion has formed.
Knowing when you have enough
You have enough when you can answer the question you wrote down, and when someone reading your record six months from now would reach the same conclusion without asking you anything.
That second test is the useful one. It rules out the two failure modes at once. An investigation that stopped too early fails it because the record does not support the conclusion. An investigation that never stopped fails it too, because a reader cannot tell which of forty findings the decision rested on.
How investigations go wrong
- Deciding first, then looking
The strongest pull in the job. Once you have formed a view, every subsequent fact gets read as supporting it. The defence is the written question: it was recorded before you had a view, so it is still neutral when you come back to it.
- Treating a score as a finding
A risk score is a vendor’s opinion with a number attached. It tells you where to look. Recording it as the reason for a decision means recording somebody else’s judgement as your own.
- Confusing absence with evidence
A check that did not run is not a check that passed. If a screening call failed or a list was unavailable, that is missing information, and closing on it is the error that is hardest to defend afterwards.
- Investigating the alert instead of the activity
The alert is one transfer that crossed a threshold. The behaviour worth understanding is usually the pattern around it, including the transfers that did not trip anything.
Write as you go
Record each fact as you establish it, with where it came from. Reconstructing an investigation at the end produces a tidier narrative and a worse record, because the things you discarded along the way are exactly what a reviewer needs in order to trust the things you kept.
It also protects you. An investigation that was reasonable on the information available at the time is defensible even if it later turns out to have been wrong. That defence only exists if the record shows what you knew and when.
Related
The investigation loop
The shape of an investigation from open to report. Every other page in this section is one step of it, closer up.
What a typology is
A typology is a named pattern of financial crime, written down precisely enough that two people looking at the same case reach the same view about whether it fits.
Why an agent does the first pass
The first pass of an investigation is gathering. Cogentic does that part before you open the case, and shows its working so you can check it.
Last checked against the product on .