Financial Crime · Agent pack

Financial-crime investigation

Cadre pack · Bloodhound

Builds an evidence packet and recommends SAR, no SAR, or continued monitoring.

Demonstrated on representative cases. Source coverage, thresholds, policy interpretation, escalation design, and performance require institution-specific validation.

Operating dossier

The job, permitted decisions, and owner

Mandate

Builds the investigation packet on escalated cases and makes a SAR / no-SAR recommendation.

Case arrives with: Case ID · Alert ID
Allowed outcomes: SAR · no-SAR · Continue Monitoring
Where it fits: Alert to SAR

Operating logic

01Picks up escalated alerts and assembles the investigation packet the SAR drafter and human reviewer rely on, ending in a SAR / no-SAR recommendation.
02Screens every material party — the account holder and the significant counterparties — against sanctions and adverse media, delegating to the sanctions specialist when a candidate surfaces.
03The illustrated decision rule requires articulable suspicion: every red flag has to anchor to something concrete in the record — a transaction, a profile mismatch, or a screening or adverse-media result.
04Treats defensive over-filing as a failure in its own right — activity that reconciles with a legitimate explanation is recommended no-SAR or continue-monitoring, with the reasoning on record.

Decision logic

01Picks up escalated alerts and assembles the investigation packet the SAR drafter and human reviewer rely on, ending in a SAR / no-SAR recommendation.
02Screens every material party — the account holder and the significant counterparties — against sanctions and adverse media, delegating to the sanctions specialist when a candidate surfaces.
03The illustrated decision rule requires articulable suspicion: every red flag has to anchor to something concrete in the record — a transaction, a profile mismatch, or a screening or adverse-media result.
04Treats defensive over-filing as a failure in its own right — activity that reconciles with a legitimate explanation is recommended no-SAR or continue-monitoring, with the reasoning on record.

Must not: Invent missing evidence or act outside the permitted outcomes.
Human owner: Filing decision and unresolved evidence
Evidence retained: Structured outcome, observed path, and the source evidence used.

Case and record

One case, from supplied evidence to recorded decision

Supplied case

Representative case dataSynthetic or simulated data

Case ID: CASE-A3
Alert ID: A3

View the case data

Case key A3-funnel-sar

{
  "caseId": "CASE-A3",
  "alertId": "A3"
}

Recorded path and outcome

Cadre reference capture

One frozen, sanitized path through representative data. It is an inspection aid, not a performance claim.

Observed path

Get alert
Get customer
Get transactions
Get prior alerts
Recorded the structured decision

The full record continues on the capture page.

Recorded outcome

SAR

Recommendation

Open decision record

Evaluation and limits

Evaluation coverage and stopping points

Published evaluation map

Expected decisions, boundaries, and costly failure modes.

These cases show what the pack is asked to decide, when it should stop, and which plausible errors the evaluation is meant to expose. They are not a reliability score or independent validation.

Expected and borderline behavior

Routine judgments, close calls, and named stopping points.

Funnel account: unrelated inbound aggregated, paid out to UAE counterparty with adverse media
SAR.
Case key
A3-funnel-sar
Structuring across branches
SAR.
Case key
A1-structuring-sar
New-account velocity against no-income profile
SAR or continue-monitoring.
Case key
A6-velocity

Boundary and misuse cases

Plausible inputs that could produce a costly or overconfident decision.

Round invoice wire from an established UK client
investigation reconciles to no-SAR (over-escalation guardrail).
Case key
adv-A5-reconciles-no-sar
Listed party is the COUNTERPARTY, not the account holder
must screen the beneficiary and surface the SDN hit.
Case key
adv-A9-sanctions-counterparty

Operating fit

Workflow placement and validation

Operating pattern

One case owner, focused specialists

Keep one owner for the case while focused specialists handle the judgments they are best placed to make.

01Own the case
02Call a specialist
03Read the result
04Choose the next step
05Record the decision and handoff

Wider workflows

Alert to SAR·Case investigation

Decision sequence and workflow placement

01Own the case
02Call a specialist
03Read the result
04Choose the next step
05Record the decision and handoff

Wider workflows

Alert to SAR·Case investigation

Pattern guide

Institution-specific validation

These questions remain open until the pack is fitted to an institution.

Policy and legal interpretation
Source coverage, quality, and freshness
Thresholds and exception calibration
Integration and degraded-mode behavior
Human approval and escalation design
Performance on the institution’s own case mix

Validation questions

Policy and legal interpretation
Source coverage, quality, and freshness
Thresholds and exception calibration
Integration and degraded-mode behavior
Human approval and escalation design
Performance on the institution’s own case mix

Inputs, actions, and outcomes

Give it

Case ID
Alert ID

It does

Get alertget_alert
Get customerget_customer
Get transactionsget_transactions
Get prior alertsget_prior_alerts
Screen subjectscreen_subject
Search adverse mediasearch_adverse_media
Compile packetcommitcompile_packet

It returns · Recommendation

SAR
no-SAR
Continue Monitoring

Related packs

Financial-crime case orchestration

Also in Alert to SAR · Conductor

Sanctions disposition

Also in Alert to SAR · Cerberus

SAR drafting and filing preparation

Also in Alert to SAR · Scribe

SAR narrative quality

Also in Alert to SAR · Redliner