AML alert disposition: what a closed alert must show an examiner

AML alert disposition is the outcome an analyst records when an alert from the transaction monitoring system has been reviewed: closed because the activity has an explanation, or escalated because it may be suspicious. The decision is usually quick. What makes it defensible is what is written down with it, because a closed alert is the unit an examiner, an auditor or a quality-control reviewer pulls from a sample months later and must be able to follow without asking anyone. Botminds' AML Alert Triage turns each alert into a short brief with cited evidence and a drafted rationale under the bank's reason code; the Level 1 analyst decides, and the closure keeps the evidence that decision rested on.

The rules on documentation moved in October 2025, and many procedures have not caught up. The interagency SAR FAQs now say that a bank does not have to document its decision not to file a SAR. They say nothing to make a closed alert with no reason defensible. The checklist below is what a closure should carry so that it survives a sample.

What is AML alert disposition?

An alert disposition is the final status of an alert and the reason for it. The two outcomes at Level 1 are closure with no further action, often labelled "not suspicious" or "explained", and escalation to an investigator. Some banks add a third, such as "closed, referred to KYC refresh" or "closed, merged into an existing case". Each outcome comes with a reason code from a list the BSA Officer approves.

Disposition sits at the hinge of the examination manual's five-component process: after the alert is produced and managed, and before anyone decides whether to file. The FFIEC expects a defined path for escalating an alert from the moment it is first detected to the end of the investigation, and expects investigators, once their research is done, to write down what they concluded, including whether they recommend a SAR (FFIEC BSA/AML Examination Manual, Managing Alerts). The disposition is where that documentation starts.

Must a bank still document a decision not to file a SAR?

No. Since October 9, 2025 the answer from FinCEN and the four federal banking agencies is explicit: neither the BSA nor its regulations require or expect a bank to document a decision not to file a SAR, and FinCEN's earlier advice to do so was encouragement, never a requirement (Interagency SAR FAQs, October 2025, Q4). The guide to the October 2025 FAQs quotes the answer in full.

Two details in the same answer matter for practice. The FAQs add that where a bank does choose to document its decision, a brief statement will usually be enough. And the FFIEC manual's SAR section, which still asks banks to record the specific reason for filing or not filing, now carries a banner saying it is to be updated, and tells examiners the FAQs are now the most current guidance on documentation of a decision not to file (FFIEC manual, Suspicious Activity Reporting). Lead with the FAQs.

The FAQ is about the SAR decision, typically made at Level 2 or by a committee. Most alerts never reach that decision. A Level 1 closure says something narrower: this alert did not warrant investigation. Nothing in the FAQs tells a bank to stop recording why, and the reasons to keep doing it are in the next section.

What do examiners look for in closed alerts?

Examiners sample closed alerts to test whether the process works, and a closure with no reason gives them nothing to test. The OCC's community bank procedures, used for examinations from February 2026, list "sampling suspicious activity alerts, discussing at a high level the investigation process with staff, and reviewing the decision-making process regarding SAR filings" as an example of testing (OCC Bulletin 2025-37). The FFIEC tells examiners to judge the bank's SAR decision-making process as a whole rather than second-guess single decisions, though they "may review individual SAR decisions as a means to test the effectiveness" of the process (FFIEC manual).

Independent testing reaches the same alerts. The OCC procedures ask examiners to consider whether a bank's independent test covered how alerts are identified, and how they are then managed, researched, decided, written up, filed and followed for continuing activity. The FFIEC expects auditors to document "the independent testing scope, procedures performed, transaction testing completed, and any findings" (FFIEC manual, Independent Testing). Each of those reviewers opens a closed alert and asks the same three questions: what fired, what did the analyst look at, and does the reason follow from it.

What they are looking for is the pattern behind the sample. Closures with no written reason, reasons the evidence contradicts, the same pattern closed for different reasons by different analysts, and alerts decided long after the bank's own deadline are the findings that turn into a matter requiring attention, because each one says the process is not being followed.

How do you write an alert closure rationale?

Write it so a stranger can check it: state the explanation, then the evidence for it, each piece specific enough to verify. A good rationale answers three questions the analyst should ask of every alert: is this normal for this customer, who are the counterparties, and has it happened before. It uses numbers, dates and names, not adjectives.

The right-hand column is longer, but it is not slower to read, and every claim in it can be checked in a minute. That is the property that matters: the October 2025 FAQs suggest that a short statement will usually suffice for a SAR decision, and a short statement made of verifiable facts is exactly what this is. The alert came from Botminds' sample data, where Corvane National Bank, a fictional regional bank, runs about 42,000 alerts a month.

The disposition as it is kept: reason code, rationale, attestation

What makes an alert closure defensible?

A closure is defensible when its reason follows from evidence a reviewer can open, when the same pattern is closed the same way across analysts, and when it was made within the bank's own timeline. All three can be checked, which is why the strongest quality-control programmes check them on every sampled closure rather than re-reading for general quality.

The most dangerous closure is the one whose reason the evidence contradicts, because it looks complete. In Botminds' sample data, a closure on Hartwell Supply Co. says every counterparty is known. The QC sampler's pre-check finds that counterparty 2, Lockridge Metals LLC, received its first payment 17 days before the alert, that the challenger agent had noted it, and that the analyst closed against the challenger with no explanation. The pre-check advises; the QC analyst decides whether to reopen.

A pre-check that catches a rationale the evidence contradicts

Consistency is the second test. If two analysts close the same insurer pass-through pattern under different reason codes, the codes stop meaning anything and the bank cannot tell an examiner how often it closes that pattern or why. A short reason-code list, each code with a definition and an example, does more for consistency than any amount of training on writing style.

Is a false positive alert in AML the same as a closed one?

In everyday use, yes: a false positive is an alert that did not lead to escalation or a SAR. In the stricter sense it is not the same thing. A closure records that the bank found an explanation, not that the activity was proven legitimate, and researchers point out that many laundering transactions in real data are never detected, so some closed alerts were wrong in ways no one ever learns. That is the strongest argument for writing the reason down: if a later case touches the customer, the closure is the first thing an investigator reads. AML false positive rates looks at what has been measured about how many alerts close this way.

Can like alerts be closed together without losing the individual record?

Yes, if each alert keeps its own evidence and rationale, the grouping rule is strict, and quality control samples batches more heavily than single closures. In Botminds' sample data, a like-alert grouper puts alerts with the same scenario, reason code, evidence and risk band into batches of up to 25 for low and moderate risk only. The analyst opens any brief before signing; the challenger can remove an alert from a batch; and QC samples 20% of batch-signed closures, against 5% of single closures.

Twelve like alerts, one signature, twelve records

When disposition breaks: what consent orders require

When a regulator finds alert handling broken, the remedy it orders is a written disposition standard. The OCC's 2024 order against Blue Ridge Bank required written, enforced deadlines for dispositioning each type of alert (quoted below), procedures that recorded each decision on whether to file a SAR along with the key facts behind every decision not to file, and written reporting of any backlog to the board (OCC, Blue Ridge Bank consent order). That order predates the 2025 FAQs; it shows what a supervisor asks for once trust in a bank's dispositions is gone.

The failures behind such orders are rarely about prose. At CommunityBank of Texas, analysts clearing about 100 alerts a day skipped deposit slips, wire transcripts and check images that were sitting in the bank's own systems (FinCEN, 2021). At TD Bank, management met a backlog of more than 70,000 alerts by looking for ways to cut the depth of each review (FinCEN, 2024). At Shinhan Bank America, a 90-day internal path from alert to SAR stretched past 100 days because procedures were not formalised (FinCEN, 2023). None of these was a writing problem. Each was a closure made without the time or the evidence to earn it.

Standards for timely dispositioning different types of alerts that are reasonable, communicated in writing to relevant staff, and are adhered to by Bank staff.

OCC consent order, Blue Ridge Bank, N.A.

How long should alert documentation be kept?

Five years is the floor for BSA records: the general rule requires records to be kept for five years and filed or stored so they can be retrieved within a reasonable time (31 CFR 1010.430; the guide to BSA record retention sets out what that covers). SAR filings and their supporting documentation are also kept for five years under the SAR rule. Many banks keep alert dispositions on the same schedule, because an alert closed today can become the first evidence in a case two years from now.

In Botminds' AML Alert Triage the retention period is a setting, five or seven years from the decision, changed only through a proposal the BSA Officer approves. Every action by people and agents is kept with who, what, when, why and which evidence, and the export for an examiner is redacted to the last four digits of account numbers. Where a disposition becomes an escalation, the record carries the detection date the bank recorded; the 30-day filing period is measured from initial detection, which the FFIEC says is not the moment the alert fired. How the measures built on these records should be reported upward is the subject of the alert to SAR ratio.

Questions people ask

What reason codes should an AML alert closure use?

A short list the BSA Officer approves, each code with a definition and an example: activity consistent with the customer's business, known counterparties on an established pattern, a one-off event with documentation, and so on. Closure codes and escalation codes should be separate lists, so the code alone says which way the alert went.

Does an AML alert closure need a second reviewer?

No rule requires one for every closure. Most banks use sampled quality control instead, often weighted toward higher-risk alerts, new analysts and closures that overrode a recommendation; in the sample settings that means 5% risk-weighted, 20% of batch-signed closures and 100% of closures against the challenger.

How long should an alert disposition rationale be?

As short as the evidence allows, but specific. The October 2025 FAQs say a short, concise statement will likely suffice for a SAR decision; for an alert closure, three or four sentences with numbers, names and dates usually cover expected activity, counterparties and history.

What happens when QC disagrees with a closure?

The QC analyst reopens the alert with a reason code, and it goes back for a fresh decision. Good practice routes it to a different analyst and records a coaching note, so the error is fixed on the alert and counted against the pattern that produced it.

Is escalating an alert the same as filing a SAR?

No. Escalation sends the alert to an investigator, who may recommend filing or not. The SAR itself is due 30 calendar days after initial detection of facts that may be a basis for filing, or up to 60 days if no suspect has been identified.