SystemBSA/AML Compliance

AML Case Management

AML case management where agents build the case and two investigators make every file or no-file call

Case files that build themselves, and every SAR call approved by a second investigator.

See one case, screen by screen ↓
demo41itemsfrom six systems in the case file before the investigator opens it, each one cited
demo38valuesin the draft checked against the source by a second model, which caught one wrong count
demo17of 30 dayswhen the Lindqvist Imports case was decided and sent to a senior investigator for approval
target50%less time spent gathering evidence for a case
In short

What is AML Case Management?

AML Case Management is where Level 2 AML investigators take an escalated alert to a file or no-file SAR decision. Agents build the cited case file from the bank's systems, lay the money out as a timeline with a lane per counterparty, propose linked customers with the reason for each link, and draft a recommendation that a second agent checks against the source. The investigator decides, and a senior investigator approves every decision.

AI use cases in banking: a buyer's guide to agentic AI for bank and credit union operations →

Updated

The problem

Why AML case management runs out of clock: the gathering comes before the judgment

AML case management starts when a Level 1 analyst escalates an alert. From the detection date, the Level 2 investigator has 30 calendar days to decide whether to file a Suspicious Activity Report, or 60 when no suspect is identified. Most of that time goes to gathering: statements and the ledger from the core banking system, wires from the payments hub, the customer profile, prior alerts and SARs, deposit tickets and teller notes from document imaging, 314(a) results, and a 314(b) reply from another bank that may or may not arrive.

Only then does the pattern appear, and usually in a spreadsheet, where 23 deposits in rows do not look like structuring. Other customers in the scheme sit in other customers' records and are found late or never. Numbers drift between the evidence and the recommendation, so the draft says five branches when the ledger shows six. Since the October 2025 interagency SAR FAQs, cash near $10,000 is not enough on its own: the investigator has to show signs that the activity was designed to evade reporting. And nothing about the case may reach the customer or the relationship manager.

typical4.7millionSuspicious Activity Reports received by FinCEN in fiscal 2024
typical2.6millionof them filed by banks and other depository institutions
typical30daysfrom detection to filing, or 60 when no suspect is identified, under 31 CFR 1020.320
Where an investigator's hours go on one Level 2 caseestimated
By hand5.5 hours
With the solution2.5 hours
  • Pulling statements, wires and the profile from each system1.5 → 0.7 h
  • Finding deposit tickets, teller notes, prior alerts and SARs1 → 0.5 h
  • Searching for other customers, one query at a time0.5 → 0.3 h
  • Laying out the transactions to see the pattern1 → 0.3 h
  • Writing the recommendation and checking its numbers1 → 0.4 h
  • Senior investigator's review and any rework0.5 → 0.3 h

Estimated split of an investigator's hours on one escalated case, by hand and with the solution, inside the two to eight hours practitioner guides give for a Level 2 review. The gathering rows fall by half, the design target; the senior investigator's review stays with a person.

How it works

How one case moves

Eight agents build the case, draw the money, find linked customers and verify the draft; the investigator decides and a senior investigator approves.

What comes in
What arrives6 systems · alert, ledger, wires, profile, imaging, 314(b)
Agents at work
Case builder41 items, each cited
Then
Link finderaddress · device · hour
Timeline analystlanes and cited answers
Then
Recommendation drafterfile or no file
Then
Verifierevery amount against the source
A person decides
Investigator decides, senior investigator approvesboth file and no-file, reason codes on every change
What comes out
SAR filing packet
Account exit, approved
Examiner pack
One case, step by step

One AML case investigation, from escalated alert to an approved SAR decision

Case C-2026-04417 at Corvane National Bank: Lindqvist Imports LLC, an importer of Scandinavian home furniture, made 23 cash deposits between $8,600 and $9,700 at six branches in 19 days, then wired $203,500 to a trading company in Hong Kong. The alert fired on September 29, Level 1 analyst Dana Okafor escalated it, and Renata Solís confirmed detection on October 5. This is day 17 of 30.

  1. 01Morning

    Her cases, ranked by the SAR clock

    Renata Solís · AML Investigator, Level 2

    Renata has 14 open cases, each with a 30-day bar marking day 20 and day 25, the agents' one-line finding and its state. One sentence on top says what needs her. Lindqvist Imports LLC is ready to decide, with a draft of File a SAR at 93%.

    4 cases are ready for your decision. The oldest open case is on day 24 of 30.

  2. 02Before she opened it

    A case file of 41 items, built and cited

    Case builder

    The case builder read the alert and the escalation note, 12 months of statements, the customer profile, seven counterparties, prior alerts and the restricted SAR index, and 14 documents. Every item carries its system and how often it is cited. Document imaging timed out on 2 of the 23 deposit tickets, so the file names the gap and offers a retry.

    Document imaging timed out at 06:14 on 2 of 23 deposit tickets (Sep 21 and Sep 25). The draft does not rely on them; the ledger has both deposits.

  3. 03The case opens

    The money, laid out as a timeline

    Timeline analyst

    Days run left to right and each counterparty is one thin lane. Each payment is a dot sized by its amount: squares for cash, triangles for wires, circles for ACH. The cash lane shows 23 deposits, $211,100, from September 8 to 26. The Jadeport Trading Co. Ltd lane shows four wires to Hong Kong, $203,500, while wires to the regular suppliers in Sweden and Denmark fell. "Day 17 of 30 · due Wed, Nov 4" sits in the header.

  4. 04Proposed, not added

    Three linked customers, each with the reason

    Link finder

    The link finder searched shared addresses, devices, branch-and-hour deposits and beneficiaries. Dorian Pask shares Lindqvist's registered address and deposited cash seven times at the same branch within the hour (strength 0.94). Teodora Vance used the same online banking device and sent $40,000 to Lindqvist (0.91). Brightfield Home Goods wired $48,000 to the same Jadeport account (0.88). It also shows the two customers it considered and did not link, and why.

    A link joins the case only when the investigator accepts it. A rejection needs a reason code, L-01 to L-04.

  5. 05One click

    Every statement opens its source

    Renata Solís · AML Investigator, Level 2

    Renata opens the citation behind the links: the branch transaction log. It lists 16 deposits by the three customers, $147,200, each within 60 minutes of a Lindqvist deposit at the same branch. She accepts the links, and they join the timeline as lanes. Her opening of the source is logged.

  6. 06She asks

    A cited answer, with the payments it used lit up

    Timeline analyst

    Renata asks what happened between September 14 and 18. The answer sits beside the timeline: seven cash deposits, $64,300, at all six branches in five days, then $54,200 to Jadeport Trading on September 18, and five deposits by the linked customers within an hour of Lindqvist's. The payments it used are lit on the timeline.

    A teller at Riverside Plaza noted on Sep 14 that the depositor asked whether two deposits on one day are added together.

  7. 07Drafted, then checked

    The draft says file, and the verifier finds one wrong count

    Recommendation drafter · Verifier

    The recommendation drafter wrote File a SAR at 93%, under reason codes F-01 (structuring: signs of intent to evade reporting), F-02 (funds transfers inconsistent with the customer's business) and F-03 (third-party or nominee depositors), with five subjects and a statement. The verifier, on a second model, checked 38 amounts, counts, dates and names against the source with $0 tolerance. 37 agree.

    Verifier: 37 of 38 values agree. One sentence says “five branches”; the ledger shows six.

  8. 08Day 17 of 30

    She decides, with reason codes and an attestation

    Renata Solís · AML Investigator, Level 2

    Renata accepts the verifier's correction, chooses File a SAR over No SAR or Need more, keeps reason codes F-01, F-02 and F-03, and ticks the attestation. Had she chosen against the draft, she would have needed an override code and a note. The decision goes to Priya Raman.

    Corrected from the ledger: six branches · 38 of 38 values agree.

  9. 09Approved

    A second investigator approves

    Priya Raman · Senior AML Investigator

    Priya sees the decision, the statement and three checks: every value agrees with its source, the maker and checker are different people, and the case is within its clock. She approves. Had Renata tried to approve her own decision, the button would have told her why she cannot.

  10. 10Handed off

    SAR filing, rating changes and an account exit

    Thomas Reyes · BSA Officer

    The SAR filing team receives a packet: five subjects, activity from September 8 to October 1, 2026, 39 cash deposits totaling $358,300 and five wires to Jadeport totaling $251,500, 41 cited items, file by Wednesday, November 4. Three customer risk ratings rise to High, waiting for a senior investigator. Thomas approves the account exit, with a closure notice the confidentiality guard checked for any mention of an investigation.

Who it’s for

Built for everyone who works a Level 2 AML case.

The same case, seen by the four people who carry it through the financial intelligence unit: what their month looked like, and what it looks like now.

RS
Renata SolísAML Investigator, Level 2 · accepts links and decides file or no file
AML Investigator, Level 2
Before
Carries about 14 open cases, each on its own clock, and spends the first days of each one pulling statements, wires and tickets from six systems into a spreadsheet before she can see a pattern.
Now
Opens a case the agents built overnight, with the money already laid out as lanes, the linked customers proposed with their reasons, and a draft whose every number has been checked. She asks, accepts, and decides.
PR
Priya RamanSenior AML Investigator · approves or returns file and no-file decisions
Senior AML Investigator
Before
Approves decisions for eight investigators by rereading the evidence behind each recommendation, and finds the number that does not match the ledger herself.
Now
Sees the decision with the verifier's result and the separation-of-duties check beside it, approves or returns with a reason code, and clears clean no-file decisions in bulk.
TR
Thomas ReyesBSA Officer · approves account exits, 314(b) replies and export packs
BSA Officer
Before
Owns the program and signs off on what leaves the financial intelligence unit, from closure letters to replies to other banks, and has to check each one for anything that would reveal a SAR.
Now
Approves 314(b) replies drafted with the other bank's registration verified and checked for any mention of a SAR, account exits with a neutral notice, and export packs built for each audience.
EH
Evelyn HartFIU Manager · runs the queues for 85 investigators in six teams
FIU Manager
Before
Learns which cases are close to day 30 from status meetings and spreadsheets, after the time to rebalance has passed.
Now
Sees every 30-day and 60-day clock across the unit, with escalations to her at day 20 and to the BSA Officer at day 25, and approves the agents' proposals to rebalance cases between teams.
Built on the engine

8 agents. Each with one job, and hard limits.

Eight agents build the case, draw the money, find linked customers and verify the draft; the investigator decides and a senior investigator approves.

Case builder

Builds the case file before the investigator opens it: accounts, 12 months of statements, the customer profile, counterparties, prior alerts and SARs, 314(a) results, 314(b) replies, deposit tickets and teller notes. It cites every item and names any source it could not reach.

  • Never contacts the customer, a branch or the relationship manager
  • Never reads outside the restricted workspace
Link finder

Searches for other customers tied to the case by a shared address, phone, device, branch-and-hour deposits or beneficiary. It scores and explains each link and lists the customers it considered and did not link.

  • Never adds a subject or a lane without the investigator
  • Proposes a link only at a strength of 0.80 or more
Timeline analyst

Draws the money timeline and answers plain-words questions about the case, with citations, lighting the payments each answer used.

  • Never states a fact without a source row
Recommendation drafter

Drafts the file, no-file or need-more recommendation with reason codes tied to the October 2025 interagency SAR FAQs and the bank's Level 2 procedure, and writes a short statement for a no-file decision.

  • Never decides
  • Flags confidence under 0.85 for the investigator to confirm
Verifier

Checks every amount, count, date and name in the draft against the source, on a second model family.

  • Never edits the draft
  • $0 tolerance on amounts: any difference is a disagreement
314(b) clerk

Verifies the other institution on FinCEN's 314(b) list, drafts requests and replies with the safe-harbor notice, and tracks replies.

  • Never sends without the BSA Officer
  • Never mentions a SAR
Confidentiality guard

Keeps the workspace restricted, logs every opening of a case, and checks letters, scripts and notes for anything that would reveal an investigation.

  • Never reveals that a case exists outside the financial intelligence unit, even in its own notices
Clock keeper

Tracks the 30-day and 60-day clocks from the detection date, escalates at day 20 and day 25, and plans continuing-activity reviews when the bank's policy elects them. It runs on rules, with no model.

  • Never changes a detection date: the investigator does, and the FIU Manager approves
Senior AML Investigator

Approves every file and no-file decision. The agents propose; a named person decides.

Ask in plain words

Ask the case, and see the payments behind the answer

Beside the timeline, the investigator asks in plain words. Every answer cites the statement, wire, ticket or record it came from, and lights the payments it used.

What happened between Sep 14 and 18?

Seven cash deposits, $64,300, at all six branches in five days, each between $8,600 and $9,700; on Sep 14 and Sep 16 the cash was split between two branches, over $10,000 each day. On Sep 18, four hours after the last deposit, $54,200 went to Jadeport Trading in Hong Kong. In the same days the linked customers made five deposits within an hour of Lindqvist's, at the same branches. A teller at Riverside Plaza noted on Sep 14 that the depositor asked whether two deposits on one day are added together.

Why Hong Kong?

The customer profile names suppliers in Sweden and Denmark, nothing in Hong Kong. Jadeport Trading received its first payment from Lindqvist on Sep 11, and $203,500 in four wires by Oct 1, with no invoice on file. Meanwhile the regular suppliers got $43,600 in September against $54,800 a month before. Brightfield Home Goods wired $48,000 to the same account on Sep 22, and Alder Ridge Savings Bank says Brightfield sent another $77,000 there.

Is this cash normal for this business?

No. The profile expects about $5,000 a month in cash from showroom sales; the twelve months before September averaged $4,300. September brought $211,100 in 23 deposits, every one between $8,600 and $9,700, and on eight days the cash was split between two branches so that no single deposit passed $10,000. Amounts near the threshold are not enough on their own; the split days and the other depositors are what suggest evasion.

Who can see this case?

Only named FIU roles: the investigator, Priya Raman as checker, Evelyn Hart, Thomas Reyes, and auditors with time-boxed read access. No relationship manager can open it; a search for it returns nothing, as for a case that does not exist.

Every screen

The working solution, as it ships.

13 screens from the working solution, on its sample data. Pick one to see it large.

The AML case opens as a money timeline you can questionCase C-2026-04417, Lindqvist Imports LLC, day 17 of 30. Days run left to right, one thin lane per counterparty, one dot per payment sized by amount: squares for cash, triangles for wires, circles for ACH. The investigator asked what happened between September 14 and 18; the answer sits beside the timeline with citations, and the payments it used are lit.
An investigator's AML cases, ranked by the SAR clockRenata Solís's 14 open cases, each with a 30-day bar marking day 20 and day 25, the agents' one-line finding and the state. One sentence on top says what needs her: four cases are ready to decide.
A case file the agents build before the investigator opens it41 items from six systems: statements, the customer profile, counterparties, prior alerts and SARs, 314(a) and 314(b), documents and linked parties, each with its system and how often it is cited. The source the agents could not reach is named, with a retry, and the build is shown step by step.
Linked customers, each with the reason for the linkThe link finder searched shared addresses, devices, branch-and-hour deposits and beneficiaries. Each link has its strength, its reasons and the same-hour evidence; it joins the case only when the investigator accepts it, and a rejection needs a reason code.
Every statement opens its source passageA citation opens the passage the agents used, here the branch transaction log behind the links: 16 deposits by three customers, each within an hour of a Lindqvist deposit at the same branch. Every opening is logged.
The file or no-file recommendation, checked value by valueThe recommendation drafter wrote the statement for the SAR narrative; the verifier, a second model, checked 38 amounts, counts, dates and names against the source. 37 agree. One sentence says "five branches"; the ledger shows six.
The SAR decision, with reason codes and an attestationAfter accepting the verifier's correction, the investigator chooses File a SAR, No SAR or Need more, picks reason codes, edits the statement if needed and attests. The decision goes to a senior investigator for approval.
A senior investigator approves every decision, file and no-filePriya Raman, Senior AML Investigator, sees the decision, the verifier's result and the separation-of-duties check before she approves. The person who decided can never approve.
Handoffs to SAR filing and an account exit the BSA Officer approvesOnce approved, the case goes to the SAR filing team with its subjects, amounts and dates, the customer rating change waits for a senior investigator, and the account exit is approved by the BSA Officer with a neutral closure notice the confidentiality guard has checked.
Every SAR clock across the financial intelligence unit1,742 open cases by day of the 30-day clock, with escalation to the FIU Manager at day 20 and the BSA Officer at day 25, the 60-day clock for cases with no suspect, and continuing-activity reviews only where the bank elects them.
314(b) information sharing, approved by the BSA OfficerRequests and replies with registered institutions: registration verified on FinCEN's list, the safe-harbor notice on file, a reply drafted by the 314(b) clerk and checked so it never mentions a SAR, and sent only when the BSA Officer approves.
A restricted workspace: the relationship manager sees nothingWhat Colin Avery, the customer's relationship manager, sees: the customer page with no trace of the case, and a search for the case number that returns "No records found", the same as for a case that never existed. The confidentiality guard checks six customer-facing surfaces and rewrites one call center script.
The audit trail and an examiner export packEvery action by people and agents, with who, what, when, why and the evidence, and an export pack built and redacted for its audience: the OCC, a law-enforcement request for supporting documentation, internal audit or the BSA Officer.
Governance

Built for a SAR decision an examiner will test: two people, every value cited, nothing tipped off.

Two people on every decision, file and no-fileThe investigator decides and a senior investigator approves or returns with a reason code, R-01 to R-04. The person who decided can never approve. No-file decisions are approved too, as a short statement. Account exits, 314(b) replies, law-enforcement export packs and settings changes go to the BSA Officer.
Every value tied to its sourceEvery dot on the timeline, every answer, every link and every sentence of the recommendation carries its citation, and a click opens the passage. A second model checks every amount, count, date and name in the draft with $0 tolerance, and a decision waits while a disagreement is open.
A restricted workspace, and no tipping offA case opens only for named FIU roles, and every opening is logged. A relationship manager's search returns "No records found", the same as for a case that never existed. The confidentiality guard checks six customer-facing surfaces, and holds and rewrites anything that would reveal an investigation.
Every clock tracked and escalatedThe 30-day clock runs from the detection date, 60 days when no suspect is identified. The clock keeper escalates to the FIU Manager at day 20 and the BSA Officer at day 25. Continuing-activity reviews are planned only where the bank elects them.
An audit trail and export packsEvery action by people and agents is recorded with who, what, when, why and which evidence. Export packs are built and redacted for their audience, the OCC, a law-enforcement request for supporting documentation, internal audit or the BSA Officer, with account numbers masked to the last four. Case files are kept five years from filing or decision, longer under a legal hold.
Agents pinned, overrides recordedEach agent is pinned to a version, a prompt and a model, and validated by model risk. Agents may not decide, approve, add a subject, send a 314(b) message, contact a customer or change a detection date. An investigator who decides against the draft gives an override code, OV-01 to OV-04, and a note.
Configuration

Your clocks, your thresholds, your approvals

The program is configured, not coded. Every change is proposed by the administrator, approved by the BSA Officer and kept as a version, and the administrator can change every setting without reading a single case.

SettingDefaultChoose from
SAR clock30 days from detection, 60 with no suspect identifiedChanges are proposed by the administrator and approved by the BSA Officer
EscalationDay 20 to the FIU Manager, day 25 to the BSA OfficerThe clock keeper notifies at each step
Assignment cap24 open cases per investigatorAbove the cap, new cases route elsewhere; routing is by typology to six teams
Continuing activityElected for filed cases whose account stays openElected or off
Link signalsSame online banking device 0.40, shared beneficiary 0.40, shared address 0.35, shared phone or email 0.30, shared employer 0.10; same branch within 60 minutesEach signal's weight, and the window for same-branch deposits
Link thresholdsPropose at 0.80, show as possible from 0.50Below the proposal threshold, a link is listed as considered
Recommendation and verifierAsk the investigator to confirm facts under 0.85; $0 tolerance on amountsAny difference in an amount is a disagreement
Retention and maskingFive years from filing or decision; account and tax numbers masked to the last fourA legal hold extends retention; export packs are redacted by audience
Connections

Works with the systems an investigation already reads

Transaction monitoring and case managementThe escalated alert, its scenario logic, case notes and the restricted SAR index
Core banking systemAccounts, the ledger, the customer index, the branch transaction log and the online banking device log
Payments hubWires, ACH and beneficiaries
Document imagingDeposit tickets, teller notes and wire forms, with a retry when a request times out
Client lifecycle management systemCustomer profiles, owners and risk ratings; an approved rating change goes back
FinCEN 314(b) list and SAR filingRegistered institutions for 314(b) sharing, and packets to the SAR filing team for FinCEN BSA E-Filing
What it changes

The difference, in numbers.

Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.

target
100%
of file and no-file decisions approved by a second investigator, every amount verified
Every decision
maker · checker · verifier
typical
30days
to file from detection, 60 with no suspect — every clock tracked and escalated
target
50%
less time gathering evidence, against the 2–8 hours a Level 2 review takes
By hand2–8 hours
With agentshalf or less

“demo” = seen in the working solution, on its sample data · “estimated” = our split of an investigator's hours, kept modest · “target” = the design goal, measured in the pilot · “typical” = a published figure or rule, cited. Sources: FinCEN Year in Review for fiscal year 2024: 4.7 million Suspicious Activity Reports received, 2.6 million from banks and other depository institutions · 31 CFR 1020.320, the SAR rule for banks: 30 calendar days from initial detection, up to 60 when no suspect is identified, five-year retention and confidentiality · FinCEN, Federal Reserve, FDIC, NCUA and OCC, interagency frequently asked questions on suspicious activity reporting, October 9, 2025 · 31 CFR 1010.520 and 1010.540, sections 314(a) and 314(b) of the USA PATRIOT Act. Corvane National Bank, Alder Ridge Savings Bank and every customer, company, account and figure on this page are invented sample data. People named on this page are characters in the working solution.

Questions

What BSA/AML teams ask about AML case management.

What is AML Case Management?

AML Case Management is where Level 2 AML investigators take an escalated alert to a file or no-file SAR decision. Agents build the cited case file from the bank's systems, lay the money out as a timeline with a lane per counterparty, propose linked customers with the reason for each link, and draft a recommendation that a second agent checks against the source. The investigator decides, and a senior investigator approves every decision.

How does AML case management software change the AML investigation process?

It moves the gathering before the investigator opens the case. In the case shown on this page, the case builder assembled 41 items from six systems, each cited, and named the two deposit tickets document imaging could not return, with a retry. The investigator starts from the pattern on the timeline and asks questions in plain words, and every answer cites its source and lights the payments it used.

How does it find other customers involved in structuring?

The link finder searches for shared addresses, phones, online banking devices, deposits at the same branch within 60 minutes, shared beneficiaries and shared employers. It proposes a link at a strength of 0.80 or more, explains each one with its evidence, and lists the customers it considered and did not link. A linked customer joins the case only when the investigator accepts, and a rejection takes a reason code.

Does it write the SAR narrative?

The recommendation drafter writes the file, no-file or need-more recommendation and its statement, with reason codes and citations, and the verifier checks every amount, count, date and name in it against the source. The investigator can edit the statement before deciding. Once a file decision is approved, the SAR filing team receives a packet with the subjects, the activity dates, the amounts and the cited items.

How does it track the SAR investigation timeline?

The clock keeper tracks 30 calendar days from the detection date, or 60 when no suspect is identified, and escalates to the FIU Manager at day 20 and the BSA Officer at day 25. Every case on an investigator's list shows where it stands on its clock, and the FIU Manager sees every open case across the unit. Continuing-activity reviews follow the bank's elected policy.

How does it keep a SAR investigation confidential?

Cases live in a restricted workspace open only to named FIU roles, and every opening is logged. A relationship manager who searches for the case number sees "No records found", the same as for a case that never existed. The confidentiality guard checks customer-facing letters, scripts and notes for anything that would reveal an investigation, and 314(b) replies are checked so they never mention a SAR.

Do people stay in control of the SAR decision?

Yes. Agents build, link, draft and check; they never decide, approve, add a subject, send a 314(b) message, contact a customer or change a detection date. The investigator decides, gives an override code when deciding against the draft, and a senior investigator approves or returns every file and no-file decision. The person who decided can never approve.

How long does it take to go live?

The Agentic Solution Engine builds and deploys it from your own requirements and documents: your Level 2 procedure, your reason codes, your clocks and escalation steps, your roles and your systems of record. It is live once every quality gate has passed.

See it on
your own cases.

We'll run AML Case Management on a sample of cases your investigators have already decided, and you can compare its case file and recommendation with theirs.