Financial Crime · Agent pack

Transaction-monitoring triage

Cadre pack · Sift

Closes routine alerts or sends material ones into investigation with a grounded case note.

Demonstrated on representative cases. Source coverage, thresholds, policy interpretation, escalation design, and performance require institution-specific validation.

Operating dossier

The job, permitted decisions, and owner

Mandate

Front-line disposition of a supplied transaction-monitoring alert queue.

Case arrives with: Customer · Scenario · Date · Description
Allowed outcomes: Close No Action · Close With Note · Escalate
Where it fits: Alert to SAR

Operating logic

01Front-line triage of transaction-monitoring alerts: clears the false positives efficiently, escalates activity that genuinely warrants investigation.
02The central test is fit — can the flagged activity be reconciled with who the customer is, their expected activity, and their history?
03Weighs recognized typologies (structuring under reporting thresholds, funnel and pass-through flows, new-account velocity) against benign explanations like a cash-heavy business with a consistent record.
04Doubt resolves upward: anything it cannot reconcile goes to investigations rather than being closed to empty a queue.
05Hands off with a risk score, reason tags, and a short narrative; it files nothing itself.

Decision logic

01Front-line triage of transaction-monitoring alerts: clears the false positives efficiently, escalates activity that genuinely warrants investigation.
02The central test is fit — can the flagged activity be reconciled with who the customer is, their expected activity, and their history?
03Weighs recognized typologies (structuring under reporting thresholds, funnel and pass-through flows, new-account velocity) against benign explanations like a cash-heavy business with a consistent record.
04Doubt resolves upward: anything it cannot reconcile goes to investigations rather than being closed to empty a queue.
05Hands off with a risk score, reason tags, and a short narrative; it files nothing itself.

Must not: Invent missing evidence or act outside the permitted outcomes.
Human owner: Material or ambiguous alerts
Evidence retained: Structured outcome, observed path, and the source evidence used.

Case and record

One case, from supplied evidence to recorded decision

Supplied case

Representative case dataSynthetic or simulated data

Customer: C6
Scenario: structuring
Date: 2026-05-15
Description: Four cash deposits between $8,900 and $9,700 across two branches within five days, each below the $10,000 CTR threshold.
Transactions: T6001, T6002, T6003, T6004

View the case data

Case key A1-structuring

{
  "alertId": "A1"
}

Recorded path and outcome

Cadre reference capture

One frozen, sanitized path through representative data. It is an inspection aid, not a performance claim.

Observed path

Get alert
Get customer
Get transactions
Get prior alerts
Recorded the structured decision

The full record continues on the capture page.

Recorded outcome

Escalate

Disposition

Open decision record

Evaluation and limits

Evaluation coverage and stopping points

Published evaluation map

Expected decisions, boundaries, and costly failure modes.

These cases show what the pack is asked to decide, when it should stop, and which plausible errors the evaluation is meant to expose. They are not a reliability score or independent validation.

Expected and borderline behavior

Routine judgments, close calls, and named stopping points.

sub-$10k cash across branches
escalate
Case key
A1-structuring
cash-intensive store, consistent
close
Case key
A2-cash-consistent
funnel/pass-through to UAE
escalate
Case key
A3-funnel
established 18-month remittance
close
Case key
A4-remittance
round invoice wire from known UK client
close (note acceptable given the repeat pattern with A11)
Case key
A5-round-wire
new account, high velocity vs no-income
escalate
Case key
A6-new-velocity
scheduled payroll
close
Case key
A7-payroll
profile deviation, new Cyprus beneficiary
escalate
Case key
A8-deviation

Boundary and misuse cases

Plausible inputs that could produce a costly or overconfident decision.

large round cross-border wire from an established client with a prior closed alert
close (over-escalation guardrail)
Case key
adv-A11-benign-trap

Operating fit

Workflow placement and validation

Operating pattern

Decide, refer, or stop

Give the pack a short list of permitted decisions and require referral when the evidence cannot support one.

01Receive the case
02Gather named evidence
03Apply the decision rules
04Decide or refer
05Record the decision and owner

Wider workflows

Alert to SAR·Alert triage

Decision sequence and workflow placement

01Receive the case
02Gather named evidence
03Apply the decision rules
04Decide or refer
05Record the decision and owner

Wider workflows

Alert to SAR·Alert triage

Pattern guide

Institution-specific validation

These questions remain open until the pack is fitted to an institution.

Policy and legal interpretation
Source coverage, quality, and freshness
Thresholds and exception calibration
Integration and degraded-mode behavior
Human approval and escalation design
Performance on the institution’s own case mix

Validation questions

Policy and legal interpretation
Source coverage, quality, and freshness
Thresholds and exception calibration
Integration and degraded-mode behavior
Human approval and escalation design
Performance on the institution’s own case mix

Inputs, actions, and outcomes

Give it

Customer
Scenario
Date
Description
Transactions

It does

Get alertget_alert
Get customerget_customer
Get transactionsget_transactions
Get prior alertsget_prior_alerts
Record triagecommitrecord_triage

It returns · Disposition

Close No Action
Close With Note
Escalate

Related packs

Sanctions disposition

Also in Alert to SAR · Cerberus

Financial-crime case orchestration

Also in Alert to SAR · Conductor

SAR drafting and filing preparation

Also in Alert to SAR · Scribe

Financial-crime investigation

Also in Alert to SAR · Bloodhound