Cadre reference capture
A recorded path through an illustrative case.
Observed path
Get alert
Get customer
Get transactions
Get prior alerts
2 more recorded steps in the full record.
Committed the contracted outcome
Financial Crime · Example
Transaction-monitoring triage
Cadre name · Sift
Closes routine alerts or sends material ones into investigation with a grounded case note.
Operating dossier
The job, permitted decisions, and owner
Mandate
Front-line disposition of a supplied transaction-monitoring alert queue.
- Case arrives with
- Customer · Scenario · Date · Description
- Allowed outcomes
- Close No Action · Close With Note · Escalate
- Where it fits
- Alert to SAR
Operating logic
- 01Front-line triage of transaction-monitoring alerts: clears the false positives efficiently, escalates activity that genuinely warrants investigation.
- 02The central test is fit: can the flagged activity be reconciled with who the customer is, their expected activity, and their history?
- 03Weighs recognized typologies (structuring under reporting thresholds, funnel and pass-through flows, new-account velocity) against benign explanations like a cash-heavy business with a consistent record.
- 04Doubt resolves upward: anything it cannot reconcile goes to investigations rather than being closed to empty a queue.
- 05Hands off with a risk score, reason tags, and a short narrative; it files nothing itself.
Decision logic
- 01Front-line triage of transaction-monitoring alerts: clears the false positives efficiently, escalates activity that genuinely warrants investigation.
- 02The central test is fit: can the flagged activity be reconciled with who the customer is, their expected activity, and their history?
- 03Weighs recognized typologies (structuring under reporting thresholds, funnel and pass-through flows, new-account velocity) against benign explanations like a cash-heavy business with a consistent record.
- 04Doubt resolves upward: anything it cannot reconcile goes to investigations rather than being closed to empty a queue.
- 05Hands off with a risk score, reason tags, and a short narrative; it files nothing itself.
- Must not
- Invent missing evidence or act outside the permitted outcomes.
- Human owner
- Material or ambiguous alerts
- Evidence retained
- Structured outcome, observed path, and the source evidence used.
Case and record
One case, from supplied evidence to recorded decision
Supplied case
Representative case dataSynthetic or simulated data
- Customer
- C6
- Scenario
- structuring
- Date
- 2026-05-15
- Description
- Four cash deposits between $8,900 and $9,700 across two branches within five days, each below the $10,000 CTR threshold.
- Transactions
- T6001, T6002, T6003, T6004
View the case data
Case key A1-structuring
{
"alertId": "A1"
}Recorded path and outcome
Evaluation and limits
Evaluation coverage and stopping points
Published evaluation map
Expected decisions, boundaries, and costly failure modes.
These cases show what the pack is asked to decide, when it should stop, and which plausible errors the evaluation is meant to expose. They are not a reliability score or independent validation.
Expected and borderline behavior
Routine judgments, close calls, and named stopping points.
sub-$10k cash across branches
escalate
Case key
A1-structuringcash-intensive store, consistent
close
Case key
A2-cash-consistentfunnel/pass-through to UAE
escalate
Case key
A3-funnelestablished 18-month remittance
close
Case key
A4-remittanceround invoice wire from known UK client
close (note acceptable given the repeat pattern with A11)
Case key
A5-round-wirenew account, high velocity vs no-income
escalate
Case key
A6-new-velocityscheduled payroll
close
Case key
A7-payrollprofile deviation, new Cyprus beneficiary
escalate
Case key
A8-deviation
Boundary and misuse cases
Plausible inputs that could produce a costly or overconfident decision.
large round cross-border wire from an established client with a prior closed alert
close (over-escalation guardrail)
Case key
adv-A11-benign-trap
Operating fit
Workflow placement and validation
Operating pattern
Decide, refer, or stop
Give the pack a short list of permitted decisions and require referral when the evidence cannot support one.
Decision sequence and workflow placement
- 01Receive the case
- 02Gather named evidence
- 03Apply the decision rules
- 04Decide or refer
- 05Record the decision and owner
Wider workflows
Institution-specific validation
These questions shape how the example fits an institution.
Validation questions
- Policy and legal interpretation
- Source coverage, quality, and freshness
- Thresholds and exception calibration
- Integration and degraded-mode behavior
- Human approval and escalation design
- Performance on the institution’s own case mix
Inputs, actions, and outcomes
Give it
- Customer
- Scenario
- Date
- Description
- Transactions
It does
- Get alertget_alert
- Get customerget_customer
- Get transactionsget_transactions
- Get prior alertsget_prior_alerts
- Record triagecommitrecord_triage
It returns · Disposition
- Close No Action
- Close With Note
- Escalate
Related examples