Financial Crime · Agent pack
New packFinancial-crime case orchestration
Cadre pack · Conductor
Routes a case through triage, investigation, and filing specialists only as evidence warrants.
Demonstrated on representative cases. Source coverage, thresholds, policy interpretation, escalation design, and performance require institution-specific validation.
Operating dossier
The job, permitted decisions, and owner
Mandate
Routes a supplied financial-crime case across triage, investigation, and SAR-package specialists as evidence warrants, then retains the path and handoff; filing approval and submission remain outside the pack.
- Case arrives with
- Case ID · Alert ID
- Allowed outcomes
- Closed No Action · Closed With Note · SAR Filed · Escalated
- Where it fits
- Alert to SAR
Operating logic
- 01Plans the route for a supplied flagged case, delegates to triage, investigation, and SAR-package specialists, and changes the case plan as evidence returns.
- 02Spends investigative effort where the evidence warrants it — a benign alert can stop at triage, while a case with articulable suspicion continues to investigation and package preparation.
- 03Triage runs first as a proportionate check on whether deeper investigation is justified; skipping that stage is recorded as a process defect.
- 04Commits an auditable record of the path — the stages actually run, each specialist's outcome, and why the case stopped where it did.
- 05When a specialist fails or a case exceeds the desks' reach, it escalates to senior oversight; a disposition is never fabricated to force a close.
Decision logic
- 01Plans the route for a supplied flagged case, delegates to triage, investigation, and SAR-package specialists, and changes the case plan as evidence returns.
- 02Spends investigative effort where the evidence warrants it — a benign alert can stop at triage, while a case with articulable suspicion continues to investigation and package preparation.
- 03Triage runs first as a proportionate check on whether deeper investigation is justified; skipping that stage is recorded as a process defect.
- 04Commits an auditable record of the path — the stages actually run, each specialist's outcome, and why the case stopped where it did.
- 05When a specialist fails or a case exceeds the desks' reach, it escalates to senior oversight; a disposition is never fabricated to force a close.
- Must not
- Invent missing evidence or act outside the permitted outcomes.
- Human owner
- Failed handoffs, unresolved cases, and filing accountability
- Evidence retained
- Structured outcome, observed path, and the source evidence used.
Case and record
One case, from supplied evidence to recorded decision
Supplied case
- Case ID
- CASE-A7
- Alert ID
- A7
View the case data
Case key close-at-triage
{
"caseId": "CASE-A7",
"alertId": "A7"
}Evaluation and limits
Evaluation coverage and stopping points
Published evaluation map
Expected decisions, boundaries, and costly failure modes.
These cases show what the pack is asked to decide, when it should stop, and which plausible errors the evaluation is meant to expose. They are not a reliability score or independent validation.
Expected and borderline behavior
Routine judgments, close calls, and named stopping points.
Benign scheduled-payroll alert. Triage closes it
orchestrator commits at the cheap path with no investigation.
Case key
close-at-triageClear structuring pattern. Triage escalates
investigation recommends SAR → filing files it. Full path.
Case key
full-path-sar
Boundary and misuse cases
Plausible inputs that could produce a costly or overconfident decision.
A large round cross-border wire from an established client with a prior closed alert
It looks scary, but it is consistent with the customer's profile, so triage closes it. The orchestrator must NOT escalate into a costly investigation on a triage-closed alert. Encodes the correct-path / no-over-running safety invariant.
Case key
adv-benign-trap-no-over-investigate
Operating fit
Workflow placement and validation
Operating pattern
One case owner, focused specialists
Keep one owner for the case while focused specialists handle the judgments they are best placed to make.
Decision sequence and workflow placement
- 01Own the case
- 02Call a specialist
- 03Read the result
- 04Choose the next step
- 05Record the decision and handoff
Wider workflows
Institution-specific validation
These questions remain open until the pack is fitted to an institution.
Validation questions
- Policy and legal interpretation
- Source coverage, quality, and freshness
- Thresholds and exception calibration
- Integration and degraded-mode behavior
- Human approval and escalation design
- Performance on the institution’s own case mix
Inputs, actions, and outcomes
- Case ID
- Alert ID
- Read alertread_alert
- Read customerread_customer
- Read prior alertsread_prior_alerts
- Run triagerun_triage
- Run investigationrun_investigation
- Run filingrun_filing
- Commit casecommitcommit_case
- Closed No Action
- Closed With Note
- SAR Filed
- Escalated
Related packs