AML case management tools are the platform in which a bank's investigators work escalated alerts, together with the systems that platform reads and the procedures that govern it. Before agents can build a case, three things must be in place: read access to the systems where the evidence lives (monitoring, core banking, payments, document imaging and the customer profile system), the bank's own Level 2 procedure written as settings (clocks, escalations, reason codes, who approves what), and a restricted space where nobody outside the financial intelligence unit can see a case exists. Botminds' AML Case Management connects to those systems and is configured from those procedures; it cannot invent data the bank does not hold, so a gap in any source becomes a gap the case file names. This guide is the list, with who owns each item and why an examiner would care.
Examples come from a fictional sample bank, Corvane National Bank; its systems, people and cases are invented.
Before agents build a case in AML Case Management: eight things to have in place
- Read access to six systems of record
Monitoring and case history, core banking, payments, document imaging, the customer profile system and the 314 programs. Owner: IT, with the BSA officer's approval.
- The restricted SAR index
Prior SARs on the customer and anyone linked, searchable only from inside the FIU. Owner: BSA officer.
- Your Level 2 procedure, written as settings
Clocks, escalation days, assignment caps and routing by typology. Owner: FIU manager.
- Reason codes for every outcome
File, no-file, override, return and link-rejection codes, so decisions can be compared. Owner: BSA officer.
- Named roles for decide and approve
Who decides, who approves, and that the two are never the same person. Owner: BSA officer.
- A list of customer-facing surfaces
Letters, scripts, banners and notes that must never reveal a case. Owner: BSA officer with operations.
- Retention and masking rules
At least five years from filing for SAR files, plus your own policy for no-file cases and legal holds. Owner: records management.
- A sample of cases already decided
Fifty or a hundred closed cases, file and no-file, to compare the agents' files with your investigators'. Owner: FIU manager.
What are AML case management tools? The platform and the systems it reads
AML case management tools are everything an investigator uses to get from an escalated alert to a decision. The platform itself holds the case, the clock, the evidence, the decision and the trail of who did what. Around it sit the systems it reads, and the quality of a case file depends on them more than on the platform. The FFIEC manual is explicit that the bank owes its investigators these tools: "Staff should also be provided with sufficient internal and external tools to allow them to properly research activities and formulate conclusions," and internal tools include access to account systems and account data, CDD and EDD information among them (FFIEC manual, Managing Alerts).
A tool that shows the investigator a case but leaves them to log into five other systems is a case tracker, not case management. The difference is where the gathering happens. In the solution, the case builder reads each system once, cites every item to its system, and names any source it could not reach, so the investigator starts from a file rather than a login screen.
Six systems an AML case reads, and what each one gives the investigator
Transaction monitoring and case management
The escalated alert, its scenario logic, the Level 1 note, earlier cases and the restricted SAR index
Owner: Monitoring team and FIU
Core banking system
Accounts, statements and transaction history, the customer index, the branch transaction log and the online banking device log
Owner: Deposit operations and IT
Payments hub
Wires, ACH and beneficiaries, with the date each counterparty first appeared
Owner: Payments operations
Document imaging
Deposit tickets, teller notes and wire forms, with a retry when a request times out
Owner: Branch operations
Client lifecycle management
Customer profiles, owners, expected activity and risk ratings; approved rating changes go back to it
Owner: KYC and onboarding
FinCEN 314 programs and SAR filing
314(a) results, 314(b) registration of other banks, and packets to the filing team for BSA E-Filing
Owner: BSA officer and filing team
What data does AML case management need? Six sources, and what each one settles
AML case management needs the data that answers the investigator's questions: what normal looks like for this customer, what actually happened, who was at the counter, where the money went, whether this has happened before, and what other banks and law enforcement know. Each comes from a different system. The customer profile answers the first, and the FFIEC manual makes it the baseline: the bank's procedures should name who may change a customer's risk profile, because the profile is what activity is measured against (FFIEC manual, Customer Due Diligence).
Having the data is not the same as using it, and the enforcement record says so. At CommunityBank of Texas, FinCEN found that three analysts each worked through about 100 case alerts a day, so they often skipped the deposit slips, wire records and check images behind them, though every one was in the bank's systems (FinCEN, CommunityBank of Texas). Nobody had time to open them; the guide to the transaction monitoring analyst's day shows the same squeeze at the alert desk.
Document imaging is the source most often missing from a case, because it is slow and built for one request at a time. In the sample case it timed out on 2 of 23 deposit tickets, at 06:14 on the morning the file was built. The file says so, says the draft does not rely on those two tickets because the core system has both deposits, and offers a retry. A tool that silently drops what it could not fetch produces a file that looks complete and is not.
Transaction monitoring vs case management tools: where one ends and the other begins
Transaction monitoring tools decide which activity becomes an alert; case management tools decide what happens to an alert once a person has escalated it. The search "aml case management or transaction monitoring tools" usually comes from a bank deciding where to spend first, and the answer depends on which half is failing. If the queue is full of alerts that never become cases, or the cases that matter never alert, monitoring needs work. If good alerts sit for weeks while investigators gather evidence, case management does.
Transaction monitoring tools raise alerts; AML case management tools work them
Transaction monitoring: Which activity is unusual enough to look at?
AML case management: Is this activity suspicious, and what does the bank do about it?
Transaction monitoring: Monitoring analysts tuning scenarios; Level 1 analysts working alerts.
AML case management: Level 2 investigators, senior investigators, the FIU manager and the BSA officer.
Transaction monitoring: Coverage, thresholds, tuning and independent validation.
AML case management: Escalation, documented conclusions, the decision process and timely filing.
Transaction monitoring: Statistical scoring is a model; deterministic rules are not, under the April 2026 guidance.
AML case management: Workflow is not a model; agents that draft and check need the bank's own evaluation.
Transaction monitoring: Missed activity, or a flood of alerts no one can work.
AML case management: Backlogs, late SARs and decisions nobody can reconstruct.
Your procedures as settings: clocks, reason codes and who approves
A bank's Level 2 procedure should become the tool's settings, not a document beside it. Every number an examiner might ask about, the escalation day, the assignment cap, the link threshold, the confidence below which a fact must be confirmed, belongs in a setting that is versioned and approved. The FFIEC manual takes the same view of monitoring tools, where changes to settings should generally need the BSA officer's or senior management's approval, and the same logic applies to the tool that decides how cases are worked.
The sample bank's Level 2 procedure as settings in AML Case Management
| Setting | Value at the sample bank | Why it is a setting, not a habit |
|---|---|---|
| SAR clock | 30 days from the detection date the investigator confirms; up to 60 while a suspect is being identified | The deadline is the rule's; when the clock starts is the bank's documented judgment |
| Escalation | Day 20 to the FIU manager, day 25 to the BSA officer | Gives time to rebalance before a SAR is late |
| Assignment cap | 24 open cases an investigator; above it, cases route to another of six teams by typology | Stops one desk silently becoming a backlog |
| Link signals | Same device 0.40, shared beneficiary 0.40, shared address 0.35, shared phone or email 0.30, shared employer 0.10; same branch within 60 minutes | Makes a proposed link explainable and repeatable |
| Link threshold | Propose at 0.80; list as possible from 0.50 | Below it, a link is shown as considered, not proposed |
| Confirmation and tolerance | Investigator confirms any fact under 0.85 confidence; $0 tolerance on amounts | A difference of a dollar is a disagreement the decision waits on |
| Retention and masking | Five years from filing or decision; account and tax numbers masked to the last four | Five years from filing is the rule for SARs; the rest is policy |
Reason codes deserve their own line in any implementation plan. Without them a decision is a sentence; with them it is data the bank can count. The sample bank uses F-01 to F-06 for reasons to file, OV-01 to OV-04 when an investigator decides against the agents' draft, R-01 to R-04 when an approver returns a decision, and L-01 to L-04 when an investigator rejects a proposed link. A quarterly look at how often investigators override the draft, and why, is the cheapest quality control a unit can run.
Restricted access and 314(b): decide them before the first case
Two settings carry legal weight and should be decided before any case is built. The first is who can see a case. The SAR rule, 31 CFR 1020.320(e), forbids disclosing a SAR or anything that would reveal one, and a case management tool that lets a relationship manager find a case by searching the customer's name is a disclosure waiting to happen. In the sample bank, cases open only for named FIU roles and auditors with time-boxed read access, every opening is logged, and a search from outside returns "No records found," the same as for a case that never existed.
The second is 314(b). Sharing with another bank is protected only if the bank has filed its annual notice with FinCEN, which lasts one year from the date of the notice (the guide to 314(b) renewal covers the calendar), and has taken reasonable steps to verify that the other institution has too (31 CFR 1010.540(b)). FinCEN counted more than 7,200 registered institutions in fiscal 2025, and more than 65,480 SARs referenced 314(b) (FinCEN Year in Review FY2025). The tool should check registration before drafting a request, and nothing should be sent without the BSA officer.
314(b) sharing in AML Case Management: registration checked, nothing that reveals a SAR
What should an AML case file contain? The minimum an examiner can test
An AML case file should contain enough for someone who never saw the case to follow it from alert to outcome: the alert and why it was escalated, the scope of review, the evidence with where each item came from, the analysis, the recommendation, the decision with who made and approved it, and what was handed off. If a SAR is filed, everything that helped decide becomes supporting documentation, kept five years from filing. A sample investigation report shows the nine sections filled in for one case.
The audit trail is the part most often missing. Examiners test the decision process on a sample of cases, and the process is visible only if every action, by people and by agents, is recorded with who, what, when, why and which evidence. Records must also be retrievable within a reasonable time (31 CFR 1010.430(d)), which is a property of how files are kept, not of how long.
The audit trail and an examiner export pack
How do you implement AML case management? Start with cases already decided
The safest way to implement an AML case management tool with agents is to run it first on cases the bank's investigators have already decided, and compare. Pick fifty to a hundred closed cases across typologies, file and no-file, and let the agents build each file and draft each recommendation without anyone seeing the original outcome. Then compare: did the file contain what the investigator used, did the link finder find the same people or others, did the draft agree with the decision, and where it did not, who was right?
The regulators have made room for that approach. The agencies' 2018 joint statement says a pilot that fails does not, in itself, invite supervisory criticism, and that when a new approach finds activity the existing process missed, the agencies will not take that alone as proof the existing process was deficient (2018 joint statement). A pilot on closed cases also measures the hours a case on the bank's own work, which is the number the full cost of AML case management software turns on.
How long does it take to set up AML case management?
Setup time is set mostly by access, not configuration. Settings such as clocks, codes and roles can be agreed in days if the procedure is written down. Read access to six systems of record usually takes longer, because each has its own owner, security review and approval, and the restricted SAR index has the tightest controls of all. A bank that starts the access requests on the first day, and runs the pilot on closed cases while the last connections are finished, shortens the path. The questions to ask any AML case management system are worth settling in the same weeks. The solution is at AML Case Management.
Questions people ask
What integrations does AML case management need?
Read access to the systems where an investigation's evidence lives: transaction monitoring and earlier cases, the core banking system, the payments hub, document imaging and the customer profile system, plus the 314(a) and 314(b) programs. Write-back is usually limited to approved changes, such as a customer risk rating, and to packets for the SAR filing team.
Can AML case management tools work without document imaging?
They can, but the files will lack deposit tickets, teller notes and wire forms, which often hold the evidence of who was at the counter and what they said. A tool should name every source it could not reach so the investigator can judge whether the finding depends on it.
Who should own an AML case management tool?
The BSA officer should own its settings, because they encode the bank's suspicious activity procedures; IT owns the connections and an administrator makes changes. In the sample bank every change is proposed by the administrator, approved by the BSA officer and kept as a version, and the administrator cannot read cases.
Do we need a SAR committee to use AML case management?
No. The FFIEC manual allows the final SAR decision to sit with an individual or a committee, as long as the decision maker has the authority to decide and, for a committee, there is a defined way to resolve disagreements. A tool should record whichever the bank uses.
What is a restricted SAR index?
It is the bank's list of SARs it has filed, searchable only by people entitled to know. Investigators need it to see whether a customer or a linked party has been reported before; anyone else seeing it could reveal a SAR, which the SAR rule forbids.