An AML case management system should do three things before anything else: keep the existence of a case and any SAR secret from everyone outside the financial intelligence unit, keep every piece of evidence behind a decision traceable and producible for at least five years, and show who decided and who approved each outcome. The twelve questions below test those duties and, for systems that use AI agents, a fourth: what the agents did, what they were forbidden to do, and how the bank would know if they went wrong. Each question comes with why it matters and what a good answer sounds like. Botminds' AML Case Management is one of the systems a bank might put them to, and this guide shows its answers where they help, alongside what any vendor should be able to say.
The examples come from a fictional sample bank, Corvane National Bank; its people, customers and cases are invented.
What should an AML case management system do? Keep the secret, keep the evidence, show who decided
Those three duties come straight from the SAR rule, 31 CFR 1020.320. A bank may not disclose a SAR or anything that would reveal one; it must keep a copy of each SAR and its supporting documentation for five years from filing; and that documentation is treated as if it had been filed with the SAR itself. The third, showing who decided, comes from how examiners work: they test the bank's SAR decision-making process on a sample of cases, and a process is testable only if each case records its steps.
Everything else a case system offers, dashboards, queues, workflow, is useful only if those three hold. A system with a fine queue and a case anyone in the bank can find by searching the customer's name is a liability. So is one whose recommendations cannot be traced to the rows they summarise.
The twelve questions, with what a good answer sounds like
Put the questions to the vendor, and then to the system: ask to see the answer on screen, on a case the vendor did not prepare. A good answer is specific, and it can be shown.
Twelve questions for an AML case management system, and what a good answer sounds like
Confidentiality
1. Who can see that a case exists, and what does a search from outside the FIU return?
Why it mattersThe existence, or even the non-existence, of a SAR must be kept confidential.
A good answerNamed roles only, every opening logged, and an outside search that looks exactly like a search for a case that never existed.
2. How does it stop letters, scripts and 314(b) replies from revealing a case?
Why it mattersDisclosure happens at the edges: a closure letter, a call-center line, a reply to another bank.
A good answerIt checks each customer-facing surface and each outgoing message, and holds anything that points to an investigation.
3. What happens when someone subpoenas a SAR?
Why it mattersThe bank must decline and notify FinCEN, citing the rule.
A good answerExports are built per audience, nothing that reveals a SAR goes outside an authorised one, and the request and response are logged.
Evidence
4. Can every number in a recommendation be traced to its source row?
Why it mattersSupporting documentation is deemed filed with the SAR.
A good answerA click from any figure opens the passage it came from, and a separate check recomputes each value before a decision.
5. Can it produce a SAR's supporting documentation, and only that, five years later?
Why it mattersIt must be identified at filing, kept five years and accessible within a reasonable time.
A good answerAn evidence index fixed at filing, retrievable by case, with legal holds and masking by audience.
6. What does the file say about sources it could not reach?
Why it mattersA silently incomplete file is worse than a visibly incomplete one.
A good answerEach gap named, with whether the finding depends on it and a way to retry.
Decisions
7. Does every decision, file and no-file, get a second person?
Why it mattersExaminers judge the decision process; enforcement orders have required more than the FAQs do.
A good answerMaker and checker on both outcomes, with self-approval blocked and returns coded.
8. Does the clock run from the detection date, not the alert date?
Why it mattersThe 30 days start at the suspicious determination, which a person makes.
A good answerA detection date set by the investigator, changed only with approval, with escalation before day 30.
9. Does it follow the October 2025 SAR FAQs?
Why it mattersNear-threshold cash alone, continuing-activity reviews and no-file documentation all changed.
A good answerReason codes that require signs of evasion, continuing-activity reviews only where the bank elects them, short no-file statements.
Agents and AI
10. What can the agents do, and what are they forbidden to do?
Why it mattersAccountability needs a line between preparing and deciding.
A good answerA written list of limits, enforced by the system: no deciding, approving, adding subjects or contacting customers.
11. How is each agent pinned, checked and monitored after go-live?
Why it mattersAgentic AI sits outside the 2026 model risk guidance, so the bank's own controls carry the weight.
A good answerPinned versions, a second-model check on outputs, override rates by reason, and changes approved by the BSA officer.
12. Can we test it on cases we have already decided?
Why it mattersBanks are expected to evaluate an innovation before it replaces or augments a process.
A good answerYes, on your closed cases, compared with your investigators' outcomes, before any live decision depends on it.
How do AML case management systems protect SAR confidentiality?
A good system protects SAR confidentiality in three places: who can open a case, what an outside search returns, and what leaves the unit. The FFIEC manual sets the bar higher than many teams assume: "the existence or even the non-existence of a SAR must be kept confidential, as well as the information contained in the SAR to the extent that the information would reveal the existence of a SAR" (FFIEC manual). A search that returns "access denied" for a restricted case has already told the searcher that something exists.
In the sample bank the relationship manager for the customer under investigation searched for the case number. The system returned "No records found. Check the spelling or search by customer name," the same response as for a case number that was never issued, and logged the search for the BSA officer only, without telling the relationship manager that anything was logged. The same check runs on outgoing material: the confidentiality guard read six customer-facing surfaces and rewrote one call-center script that said "Your account is under compliance review."
AML Case Management's restricted workspace: what a relationship manager sees
The third place is the subpoena. A bank asked by subpoena, or any other request, to disclose a SAR or information that would reveal one must decline, cite the rule and tell FinCEN about the request and its response. A system that can export a whole case to anyone with an export button makes that harder. What the AML team does when a grand jury subpoena arrives walks through what may and may not travel.
Questions about evidence: can every number be traced and produced?
The evidence questions are the easiest to test on screen. Pick a figure in a recommendation and ask where it came from. A good system opens the passage, the rows, the document, with the system it came from and when it was read. A weak one shows a list of attachments and leaves the reviewer to find the number.
Question five matters later. Supporting documentation must be identified when the SAR is filed, and five years on a law enforcement agency may ask for it without a subpoena. The system should be able to produce exactly the documentation behind that SAR, masked for its audience, rather than everything the unit ever held on the customer. In the sample bank, export packs are built per audience: an OCC examination, a law-enforcement request for supporting documentation, internal audit, the BSA officer.
What the sample case's evidence looked like when the decision was made
41items
in the case file from six systems, each cited where it was used
38values
in the draft checked against source by a second model; one disagreed
2of 23
deposit tickets document imaging did not return, named in the file
Questions about decisions: two people, the right clock, the current rules
Decision questions test whether the system encodes the bank's procedure or merely stores its outcome. The FFIEC manual asks for a final decision maker with authority to decide; the October 2025 interagency FAQs say there is no requirement to document a decision not to file and that a short statement will usually do (SAR FAQs, Q4). But a bank under an enforcement order can be held to more. The OCC's 2024 order against Blue Ridge Bank required the bank to write down each decision whether to file, and the key facts behind every decision not to (OCC, Blue Ridge Bank order). That order was terminated in November 2025, but the lesson for a system stands: it should be able to require what the bank's situation requires.
Documenting a no-file decision: the 2025 FAQs set a floor; an enforcement order can raise it
Interagency SAR FAQs, October 2025: No requirement or expectation under the BSA; documentation is encouraged, not required.
OCC order, Blue Ridge Bank, January 2024: Yes: individual decisions, and the key facts supporting each decision not to file.
Interagency SAR FAQs, October 2025: In most cases, a short, concise statement will likely suffice.
OCC order, Blue Ridge Bank, January 2024: Procedures that make the decision process effective, with standards for timely disposition of alerts.
Interagency SAR FAQs, October 2025: Not addressed.
OCC order, Blue Ridge Bank, January 2024: Reported promptly to the board and management, in writing.
Interagency SAR FAQs, October 2025: In force; the FFIEC manual's SAR section carries a notice that it will be updated to reflect them.
OCC order, Blue Ridge Bank, January 2024: Terminated by the OCC on November 13, 2025.
Question eight is about where the clock starts. A system that starts the 30 days when the alert fires is stricter than the rule and will flag cases as late that are not; one that has no clock at all leaves the FIU manager to discover lateness at day 31. The sample bank's system runs the clock from the detection date the investigator confirms, lets the FIU manager approve any change to it, and escalates at day 20 and day 25.
Does case management software need model validation? What changed in April 2026
Workflow software is not a model, and since April 17, 2026 neither are deterministic rule-based processes; agents that draft and check fall outside the new guidance altogether, which leaves validation to the bank's own judgment rather than removing it. The revised interagency model risk guidance (Federal Reserve SR 26-2, OCC Bulletin 2026-13) superseded the April 2021 interagency statement on model risk for BSA/AML systems, excluded rule-based software from its definition of a model, put generative and agentic AI outside its scope, and said the agencies plan a request for information on AI; we could not find that request published as of October 2026.
Out of scope does not mean unexamined. The agencies' 2018 joint statement still applies: management decides whether, and when, a new approach is mature enough to replace or supplement an existing BSA/AML process, weighing information security, third-party risk and compliance with other laws (2018 joint statement). FinCEN's April 2026 proposed program rule, still a proposal, would add that responsible experimentation with new technology does not, by itself, raise an institution's risk of supervisory or enforcement action (FinCEN proposed rule; see the guide to the proposal).
Questions about agents: what they may do, and how you would know
For agents, the useful standard today is the Wolfsberg Group's, a non-profit association of global banks that publishes financial crime guidance. Its 2022 principles ask institutions to weigh "the severity of potential financial crimes risk" against "any AI/ML solutions' margin for error," to "implement a programme that validates the use and configuration of AI/ML regularly," and to "monitor the use of AI/ML for consistent and stable performance after implementation" (Wolfsberg AI/ML principles). Questions ten and eleven turn those into things a system can show.
In the sample bank, each agent is pinned to a version, a prompt and a model, and validated before use. The verifier runs on a different model family from the drafter, so the same blind spot does not write and check a number. An investigator who decides against the draft gives an override code and a note, so the bank can count how often the agents are overruled and why. And the agents are forbidden, in settings the BSA officer approves, to decide, approve, add a subject, send a 314(b) message, contact a customer or change a detection date.
Answers that should end an AML case management system demo
| What you hear | What it means for the bank |
|---|---|
| "Users with access can see restricted cases they search for" | A relationship manager can find out a customer is under investigation. |
| "The AI writes the narrative and the investigator reviews it" | Without a check that recomputes each value from source, review means rereading, not verifying. |
| "Supporting documents are attached to the case" | Attachments are not an index fixed at filing; ask how the system tells which ones supported the SAR. |
| "The model is proprietary" | The bank owns the decisions; it needs to know what the tool did, and on which version. |
| "Approval is optional for no-file decisions" | Optional under the FAQs, perhaps, but a system should let the bank require it. |
| "We do not support testing on historical cases" | Then the bank cannot evaluate it the way the 2018 joint statement expects. |
How do you choose an AML case management system? Test it on your own decided cases
Choose on evidence from your own work: run each shortlisted system on fifty to a hundred cases your investigators have already decided, and compare the files, the links and the recommendations with what your people concluded. A demonstration on the vendor's data shows what the system can do; a run on closed cases shows what it does on yours, including the systems it cannot read and the typologies it handles badly. It also produces the hours-a-case figure that the full cost comparison needs.
Every decision in AML Case Management gets a second person, file and no-file
Can AML case management integrate with transaction monitoring?
It should, in one direction at least: the escalated alert, its scenario logic and the Level 1 note should arrive with the case, and earlier alerts and cases on the same customer should be searchable from it. The question to ask is narrower: does the case system read the monitoring system's history, or only receive new alerts? A case system that cannot see that the same customer was alerted and closed twice before cannot tell the investigator this is repeat activity, which the FFIEC manual expects banks to escalate.
Which AML case management system is best? It depends on four of your numbers
No system is best in general; the right one depends on how many cases you escalate a year, how many hours a case takes by hand, how many systems your evidence lives in, and how much of your risk is backlog. A unit escalating a few cases a month needs a disciplined tracker more than agents. A unit escalating thousands, with evidence in six systems and a tail of cases past day 20, is where agents that gather, link and check pay back. Ask the twelve questions of every shortlisted system; the ones that answer them on screen are the shortlist. The solution described here is at AML Case Management.
Questions people ask
What questions should we ask an AML software vendor?
Ask who can see a case and what an outside search returns, whether every figure traces to its source, whether every decision gets a second person, where the SAR clock starts, what the agents are forbidden to do, and whether you can test the system on cases you have already decided. Ask to see each answer on screen.
Is a case management system a model under model risk guidance?
Workflow and deterministic rules are not models under the April 2026 revised guidance, which excludes deterministic rule-based processes. Generative and agentic AI are outside that guidance's scope altogether, so a bank evaluates them under its own controls, as the 2018 joint statement on innovation expects.
Should an AML case management system make the SAR decision?
No. The FFIEC manual puts the final decision with a decision maker or committee that has the authority to make it. A system can draft a recommendation and check it; a person decides, and in a well-designed system a different person approves.
What audit trail should a case system keep?
Every action by people and agents, with who, what, when, why and which evidence, including who opened a restricted case and every search from outside the unit. Examiners sample cases to test the decision process, and the trail is how the process becomes visible.
Do the October 2025 SAR FAQs change what a case system must do?
They change what it should prompt for. Cash near $10,000 alone no longer requires a SAR, so a system's reasons to file should require signs of evasion; a separate post-SAR continuing-activity review is not required, so reviews should run only where the bank elects them; and no-file decisions need no documentation under the BSA, though many banks keep a short statement.