AML alert triage that reads every alert like a short brief, challenges each closure, and leaves the decision to the analyst
Every alert read like a short brief, challenged, then closed or escalated in minutes.
See one case, screen by screen ↓AML alert triage is the Level 1 review of transaction monitoring alerts: deciding whether each one is closed as not suspicious or escalated, and writing down why. AML Alert Triage turns every alert into a short brief, with one sentence on what fired, three questions answered with cited evidence and a proposed decision with its rationale, and a challenger agent that argues for escalation before any closure is proposed. The Level 1 analyst decides.
AI use cases in banking: a buyer's guide to agentic AI for bank and credit union operations →
Updated
AML alert triage is where most of a Level 1 analyst’s day goes. Overnight, the transaction monitoring system runs its scenarios over ACH, wire, cash, card, instant and P2P activity and drops alerts into the queues. For each one the analyst opens the client lifecycle management system for the KYC profile and expected activity, the core for 12 months of statements, the payments hub for counterparties and screening, and the case manager for prior alerts, then types a closure rationale or an escalation summary into a free-text box.
Most of those alerts are false positives, and each still has to be proven normal by hand. Reasons vary from analyst to analyst, QC re-reviews a sample days later against a checklist, and the Level 2 investigator works out the detection date after the fact, with the 30-day SAR clock already running. Examiners look for exactly these gaps: closures with no written reason or a reason the evidence contradicts, different decisions on the same pattern, and backlogs past policy.
Estimated split of the 38-minute median by hand from the demo bank’s time study of 1,150 alerts, and of the 4.1-minute median seen with the solution on its sample results.
Seven agents brief every alert and a challenger argues to escalate; the Level 1 analyst decides and QC checks.
AML alert triage at Corvane National Bank, a fictional US regional bank: about 42,000 monitoring alerts a month for 220 Level 1 analysts. Here is Dana Okafor’s Tuesday, September 15, 2026, screen by screen, in the working solution.
Dana has 26 alerts, 4 due today. The agents prepared the briefs overnight and grouped the queue: three still being worked, three where the challenger disagrees, to read first, eight ready for a decision with a proposed closure and its reason code, and a batch of 12 like alerts. Each row is one line: the customer, the scenario, the agents’ reading, the proposal and the due date.
Alerts never appear on relationship manager, branch or customer views.
Alert 26-0914-118233, rapid movement of funds, on Fenwick Auto Body LLC, a collision repair shop in Carverton, Ohio, and a customer since April 2014. $48,200 came in by ACH from Brightwater Casualty Insurance Co. on Sep 9, and $47,900, 99% of it, went out by Sep 11, above the rule of 90% out within five days. The flow of funds is drawn under the sentence, and the right rail shows the seven agent steps with their sources and times.
Is this normal? Yes: inside the $35,000–$60,000 a month the profile expects from insurers, 3% above the 11-month average of $46,855 (97%). Who are the counterparties? Four, all known, each paid in at least 11 of the last 12 months, none on a watch list, the Sep 8 314(a) list or a sanctions list (98%). Has it happened before? Every month; four earlier alerts were closed (96%). A citation opens the customer profile itself, with the expected activity highlighted.
Opening a source is logged, and the agent reads it read-only.
In “Ask about this alert”, Dana asks “Why is this normal for Fenwick?” The answer comes from the alert’s own evidence, with citations: a repair shop paid by insurers for repairs, then paying for the parts, at 3% above its 11-month average, to the same three suppliers as every month. If the profile ever needs to change, the agents draft the update for the KYC team’s own maker-checker approval.
Proposed: close under C-03, “Activity consistent with the customer’s business”, at 96% confidence, with a written rationale citing the insurer’s claim payment, the three suppliers, the expected activity, the screening and the four prior alerts. A second agent, on a separate model family, argued for escalation over seven checks: no new counterparties, no round or just-below-threshold amounts, no cash, all domestic, three days against the usual two to four, no change of owner, no link to escalated alerts, cases or the 314(a) list.
“I looked for reasons to escalate and found none.”
Dana closes it with this rationale. The dialog shows the reason code, the rationale exactly as it will be kept, and her attestation that she reviewed the evidence for all three questions. The decision is recorded with her name and the time it took: 1 min 52 s, against a 38-minute median by hand for this scenario.
“Insurer payouts passed to parts suppliers”: same scenario, same reason C-03, insurer in and at least 95% out, suppliers paid for 10 or more months, no cash, domestic only, Low risk. Dana can open any brief before she signs, such as Garrison Collision Works or Bayview Auto Body, and each alert keeps its own rationale and record. The challenger removed Quillen Collision, a $14,950 wire to a new payee, and QC samples 3 of the 12.
Alert 26-0914-118247: counterparty 3, Sarvan Trading LLC, received an $18,400 wire on Sep 13 into an account opened 41 days earlier, at an address shared with two parties escalated in July. The investigating agent’s draft, close under C-04 at 74%, is withheld. The agents propose escalation under E-02, “New or unexplained counterparty”, at 91%.
“I disagree with closing: counterparty 3 is new.”
The escalation writer drafts the summary, under E-02, for the Level 2 queue “Payments and trade · Renata Solís”, and records the detection date now: Tuesday, September 15, 2026, with its reason. The SAR decision is due Thursday, October 15, 30 days later, or Saturday, November 14 if no suspect is identified. Case FIU-26-04417 opens.
Level 2 confirms the date; only the Head of FIU can approve a change.
Renata sees case FIU-26-04417, escalated by Dana Okafor, detection date Tue Sep 15, 30 days left, waiting for her to accept, beside five more cases and their SAR clocks. One shows a detection date moved from Sep 9 to Sep 10, the day the counterparty match arrived, with the Head of FIU’s approval. The case and its SAR decision stay inside the FIU.
The same alert, seen by the people who carry it from the queue to the case: what their day looked like, and what it looks like now.
Seven agents brief every alert and a challenger argues to escalate; the Level 1 analyst decides and QC checks.
Reads the alert from the transaction monitoring system and writes one sentence: the scenario, the amounts, the dates and the rule crossed.
Answers the three questions with citations and confidences from the customer profile, 12 months of activity, the counterparties, screening, prior alerts and the 314(a) search log, and drafts the rationale or the escalation summary under a reason code.
Reads the same sources on a separate model family and argues for escalation over seven checks; a closure is proposed only when it agrees.
Groups alerts with the same scenario, reason code and evidence into a batch the analyst signs together, each alert keeping its own rationale.
Writes the escalation summary, records the detection date and opens the Level 2 case in case management.
Draws the risk-weighted QC sample and pre-checks each closure against its evidence and rationale.
Finds alerts closed again and again for the same reason and writes a tuning proposal with its evidence and expected effect for the Head of FIU.
Closes or escalates; QC can reopen. The agents propose; a named person decides.
Every brief has “Ask about this alert”, and the assistant answers about the alerts in the queue, their customers, counterparties and history. Every answer cites the passage it came from.
Why is this normal for Fenwick?
Fenwick is a collision repair shop paid by insurers for repairs, then paying for the parts. The profile expects $35,000–$60,000 a month from insurers; September’s $48,200 is 3% above its 11-month average, and the money went to the same three suppliers as every month.
What would make you escalate this?
Any one of these: a counterparty first paid this month, cash or round amounts just under a threshold, money leaving the country, a change of owner, or a link to an escalated alert, a case or the 314(a) list. The challenger checked all seven and found none.
What did the challenger find on Pellham Logistics?
Counterparty 3 is new. Sarvan Trading LLC received an $18,400 wire on Sep 13, its first payment from Pellham, into an account opened 41 days ago. Its address is a registered-agent address shared with two parties in alerts escalated in July. So no closure is proposed; the agents propose escalation under E-02.
Which alerts in my queue look like Fenwick’s?
Twelve. Same scenario, the same reason, insurer payouts passed to regular parts suppliers, and the same evidence on all three questions, so the agents grouped them as one batch. Quillen Collision was removed: the challenger found a $14,950 wire to a payee first seen this month. QC will sample 3 of the 12.
13 screens from the working solution, on its sample data. Pick one to see it large.
Thresholds, batches, SLAs, sampling and retention are settings. An administrator proposes a change, the BSA Officer approves it, and every version is on the audit trail.
| Setting | Default | Choose from |
|---|---|---|
| Propose a closure only at confidence of at least | 85% | Step up or down; below it, the alert goes to the analyst with no proposal |
| The challenger must agree before any closure is proposed | Required | Cannot be turned off |
| Like-alert batches: what must match | Scenario, reason code, evidence and risk | Scenario, reason code, evidence and risk · Scenario, reason code and evidence |
| Batches allowed for | Low and Moderate risk, at most 25 alerts | Low and Moderate · Low only; largest batch steps up or down |
| Decide within, from the alert date | High 3 · Moderate 5 · Low 10 calendar days | Each risk band steps up or down |
| Escalate past-SLA alerts to | Team lead | Team lead · Team lead and Head of FIU |
| QC sampling | 5% risk-weighted · 20% of batch-signed closures · 100% for analysts in their first 60 days · 100% of closures against the challenger | Each share steps up or down |
| Keep decisions and evidence | 5 years from the decision | 5 years · 7 years |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (85–95% of alerts false positives and 20–60 minutes an alert are commonly reported industry estimates; 4.7 million SARs in fiscal 2024, 2.6 million from banks, are FinCEN’s published figures). Rules named on this page: 31 CFR 1020.320 (SAR timing and confidentiality), 31 CFR 1010.430 (five-year retention), USA PATRIOT Act section 314(a), GLBA. Corvane National Bank, the people, companies, accounts and cases named on this page are fictional: characters and sample data in the working solution.
AML alert triage is the Level 1 review of transaction monitoring alerts: deciding whether each one is closed as not suspicious or escalated, and writing down why. AML Alert Triage turns every alert into a short brief, with one sentence on what fired, three questions answered with cited evidence and a proposed decision with its rationale, and a challenger agent that argues for escalation before any closure is proposed. The Level 1 analyst decides.
The alert reader writes what fired. The investigating agent answers the same three questions on every alert: is this normal for this customer, who are the counterparties, has it happened before. It cites each statement and drafts the rationale under a reason code. The challenger agent then looks for reasons to escalate, and the analyst closes, escalates, edits the rationale or disagrees with a reason.
No. The agents propose and a named analyst decides every alert. QC samples closures and can reopen them, Level 2 accepts every escalation, and agents never file, never contact a customer and never change a customer record, scenario or threshold.
Every alert is still read and decided; nothing is suppressed. A closure is proposed only at 85% confidence or more and only when the challenger agrees, and any closure against the challenger is always checked by QC. The tuning analyst turns repeated closures into proposals for the tuning team, recommends no change where SARs were filed, and never changes a scenario itself.
The escalation records the detection date with its reason, and the SAR decision is due 30 days later, or 60 if no suspect is identified, as 31 CFR 1020.320 sets out. Level 2 confirms the date, and only the Head of FIU can approve a change to it, so the clock cannot be moved quietly.
Yes. Alerts with the same scenario, reason code, evidence and risk band are grouped into a batch of up to 25, which the analyst signs together after opening any brief. Each alert keeps its own rationale and record, the challenger can remove an alert from a batch, and QC samples 20% of batch-signed closures.
No. No alert, escalation, case or SAR status appears on relationship manager, branch, contact center or customer views, and the assistant refuses to discuss monitoring outside the FIU. Alerts are visible only to FIU roles.
The Agentic Solution Engine builds and deploys it from your requirements and documents, such as your Level 1 procedure, reason codes and a sample of past alerts, and it goes live once every quality gate has passed. We will walk you through it on your own alerts first.
Case files that build themselves, and every SAR call approved by a second investigator.
1-min demoSAR Narrative & FilingSARs drafted from the case and checked three ways, ready for the BSA Officer to sign.
1-min demoCTR Filing & ExemptionsEvery cash day stacked by member, and CTRs filed with no blank conductor fields.
1-min demoWe’ll run AML Alert Triage on a sample of your own past alerts and their closures.