AML case disposition at funding

The only acceptable output at this stage is a case packet an investigator can sign or send back. The packet includes the funding event that triggered review, the enrichment the bank already holds, a narrative that cites those sources line by line, and an explicit recommendation that is still a draft. It is not a SAR. It is not a release instruction.

A funding event that looks like structuring, a sudden inbound wire from a high-risk corridor, or a first large credit into a recently opened account can generate a SAR-trigger candidate in the transaction-monitoring stack. That candidate is an investigation start, not a report. If the agent files, or if operations treat a thin draft as clearance to post the credit, the bank has skipped the human who still owns the SAR decision and the hold.

Keep the work queue separate from the filing channel and from the payments release path. The agent writes into the case system. The investigator decides. Compliance operations files only after that decision. Treasury or payments posts the funds only after a separate, documented release that is not inferred from a draft that merely looks light.

Ingest alerts the bank's own monitoring already raised on the funding event. Typical inputs are the alert ID, the account and customer keys, the credit amount and value date, the payment type (ACH, wire, card load, cash, instant payment), originator and beneficiary identifiers as held on the message, and the rule or typology that fired.

Do not let the agent invent a second monitoring layer that re-scores every inbound credit in parallel and then writes cases the investigators cannot map to a control. The point of this use case is disposition quality on work that already exists. If a related pattern belongs in first-party fraud detection at first deposit or mule account detection at top-up, route those as sibling queues. Do not collapse them into one AML narrative unless the investigator asks for a combined view.

Illustrative example: a same-day inbound wire for a mid-five-figure amount hits a retail account that has been quiet for months. The monitoring system raises a SAR-trigger candidate for unusual inbound activity at funding. The agent should open or attach to that case, pull the message fields the bank stored, and wait. It should not mint a new typology name, invent a second originator, or treat the credit as cleared because a confidence score came back low.

Failure mode to block at ingest: auto-creating a SAR record that is already marked ready to transmit. If the bank uses a pre-fill into the filing form, that form stays unsubmitted and unsigned until the investigator accepts the narrative and a designated filer completes the filing workflow. Pre-fill is a typing aid. It is not permission.

Enrichment is retrieval, not research theater. Pull customer KYC as of the last completed refresh, the beneficial ownership record the bank holds, prior SAR and case IDs for the same customer or account (not their contents pasted into a new report without review), the payment message fields, and any open alerts on the same network of accounts. For media and list hits, use the screening results the bank already stored from its chosen vendors, not a fresh web scrape the exam team cannot reproduce.

Transaction-monitoring, case-management, core, and screening platforms in this class include systems such as NICE Actimize, Dow Jones, and Temenos. Treat them as the systems of record they already are: alert history, watchlist and media hits, and account or customer master. Do not claim a capability those products do not expose in your installation. If the hit lives in the screening file, cite the hit ID and the date the file was last applied. If the payment lives on the core, cite the posting or message reference. If the network view lives in AML transaction network monitoring, attach that graph's case ID rather than restating nodes the investigator cannot open.

Cross-check adverse media screening and perpetual KYC refresh as inputs, not as automatic aggravating factors. A media hit that is stale, unmatched, or already dispositioned as a false positive must appear as such. A KYC refresh that is overdue is a control gap to flag, not a license to invent occupation, source of funds, or counterparties.

Hard stop: if a counterparty name, BIC, account number, or beneficial owner is not in the bank's held messages, KYC file, or vendor screening extract for this customer, the agent must leave the field blank or mark it unknown. Inventing a counterparty because the pattern looks like a mule network is a quality failure even when the guess later proves lucky. The investigator cannot cite a guess in a SAR, and the model must not put words on the record that the bank cannot produce.

The draft narrative is a sequence of statements, each tied to a source the bank holds. A usable structure is: what funding event occurred; why monitoring treated it as a SAR-trigger candidate; what KYC, screening, and prior-case facts the bank actually has; what is missing; and what the investigator is asked to decide.

Every sentence that asserts a fact should carry a cite: alert ID, payment reference, KYC document ID, screening hit ID, prior case ID. Sentences that are inference stay labeled as inference. Matching an originator name to prior inbound wires on this account is allowed when those payment refs exist. Calling the originator a known mule is not allowed unless that label already exists in a bank record the investigator can open.

Do not copy unsourced typology or vendor media into the narrative.

The recommendation line is a draft only: escalate toward SAR, keep the hold and request more information, or recommend release subject to investigator confirmation. The model score, if one exists, is an input to the investigator, not a substitute for the recommendation and not a release code. A low score on a thin file is a reason to keep the hold, not a reason to post the credit.

Returning to the quiet retail account and the mid-five-figure wire: a defensible draft would cite the alert ID, the wire's stored originator and amount, last KYC expected activity, screening hit IDs (including none), and prior case IDs. It would not add a counterparty the message did not carry, recommend release because the score was low, or drop a completed SAR into the transmitter.

Route the packet to the assigned investigator. The investigator either signs the narrative (with or without edits), rejects it back with reasons, or reclassifies the work as fraud, operational, or no-SAR. Signing means the investigator accepts the facts and the cites as the bank's record. It does not transmit a SAR. Filing remains a separate, permissioned step.

Fund release is a second human step. A signed no-SAR narrative can support a release request. An unsigned draft cannot. A draft that says the file is thin cannot. A low model score cannot. If the credit is still held, operations waits on the documented release, not on a polished paragraph.

Rejection should name the defect: missing cite, invented counterparty, omitted screening hit, typology that does not match the rule that fired, or a recommendation that implies auto-file. Do not let a timeout auto-sign. If the investigator has not acted, the hold stays and the SAR stays unfiled.

Refuse auto-filing. A complete-looking narrative is still a draft. Connecting the agent to the SAR transmitter, even for obvious cases, removes the person the bank will defend.

Refuse release-on-score. If the file is thin, the correct posture is hold and ask. Uncertainty is not clearance.

Refuse invented counterparties, occupations, source-of-funds stories, and network members the bank does not hold. Blank is better than a fluent error. Refuse merging unrelated queues into one SAR story without the investigator.

An investigator must reconstruct every cited fact from bank systems, see what is unknown, and put their name on the disposition before anyone files or releases the funds.