An AML case study example, day by day: from alert to SAR decision

This AML case study example follows one case from start to finish: a furniture importer that made 23 cash deposits of $8,600 to $9,700 at six branches in 19 days, then wired $203,500 to a trading company in Hong Kong. The monitoring alert fired on September 29; the investigator confirmed on October 5 that the activity was suspicious, which is when the bank's 30 days to file a SAR began; and on day 17 she decided to file and a senior investigator approved. The case shows the parts of AML work that training materials usually skip: the clock starts at a person's determination, not at the alert; cash near $10,000 is not enough on its own since October 2025; and the other people in the scheme are found only by looking for them. It ran through Botminds' AML Case Management, where agents build the cited case file and two people make the file or no-file decision.

Everything about the case is fictional sample data: Corvane National Bank, Lindqvist Imports LLC, every other customer and person, and every amount. The rules and the enforcement figures are real and linked where they appear.

An AML case study example: the facts of case C-2026-04417

The customer is Lindqvist Imports LLC, an importer of Scandinavian home furniture, a business checking customer of Corvane National Bank since June 2019, rated Medium risk. Its managing member, Erik Lindqvist, owns 100% and is the only signer. The profile expects about $5,000 a month in cash from showroom sales; in the twelve months before September the average was $4,300. It expects wires of about $55,000 a month, to suppliers in Sweden and Denmark.

In September that changed. Between September 8 and 26, 23 cash deposits arrived, every one between $8,600 and $9,700, at six different branches, $211,100 in total. On eight days the cash was split between two branches, so no single deposit passed $10,000 while the day's total did. From September 11, wires began to a company called Jadeport Trading Co. Ltd in Hong Kong, which appears nowhere in the profile: $46,500, then $54,200, $58,800 and $44,000, $203,500 by October 1, with no invoice on file. The regular suppliers received $43,600 in September, against $54,800 the month before.

Day by day: 57 days from the first deposit to the filing deadline

The case lasted 57 days from the first deposit to the SAR deadline, and the bank's 30-day clock covered only the last 30. Three weeks of activity came before the alert, six days passed between the alert and the determination that the activity was suspicious, seventeen more until the decision, and the filing team then had thirteen days in hand.

When does the SAR 30-day clock start? At the suspicious determination, not the alert

The 30 days start when the bank, having reviewed the activity, determines that it is suspicious. The rule gives a bank 30 calendar days from initial detection of facts that may justify a SAR, and up to 30 more only if it still has no suspect, never more than 60 in all (31 CFR 1020.320(b)(3)). The FFIEC manual says what initial detection is not: a flag from a monitoring system or a system report is not detection, and the clock runs only from the review that determines the activity is suspicious (FFIEC manual, Timing of a SAR Filing; the guide to the SAR filing process sets the whole clock out).

That is why this case's clock starts on October 5, not September 29. It is also why the detection date is a judgment someone must record and defend. The same section requires the review before detection to be done within a reasonable time, and a bank that lets alerts sit for months has not bought itself time; it has an unreasonable review. In the solution, the investigator sets the detection date, the clock keeper counts from it, and any change to it needs the FIU manager's approval.

What happens after an AML alert is escalated? Day 0 to day 17

After escalation, the case belongs to the Level 2 investigator, and the first job is evidence. In this case the agents built the file: 41 items from six systems, each cited, including twelve months of statements, the profile and beneficial ownership, seven counterparties, prior alerts and the restricted SAR index, 314(a) results and 14 documents. Document imaging failed to return 2 of the 23 deposit tickets; the file named them and noted that the draft did not rely on them, since the core system recorded both deposits.

The investigator's work was to ask questions and decide what the answers meant. Asked what happened between September 14 and 18, the timeline analyst answered with citations: seven cash deposits, $64,300, at all six branches in five days; $54,200 wired to Jadeport four hours after the last of them; and five deposits by other customers within an hour of Lindqvist's, at the same branches. The payments behind the answer lit up on the timeline.

The case in AML Case Management on day 17: the money laid out, one lane per counterparty

The pattern: what made near-threshold cash suspicious

Since October 9, 2025, amounts near $10,000 have not been enough to require a SAR. The interagency SAR FAQs (Q1) require a filing only when the bank knows, suspects or has reason to suspect the transactions were designed to evade currency reporting. So the case could not rest on 23 deposits under $10,000. It rested on what showed design: on eight days the cash was split between two branches; a teller recorded that the depositor asked whether two deposits on one day are added together; cash in September was about 49 times the monthly average; and other people's cash was arriving at the same branches within the hour.

The wires answered a different question: where the cash went. A furniture importer whose profile names Swedish and Danish suppliers sent $203,500 to a Hong Kong trading company it had never paid before, with no invoice, while paying its real suppliers less. That is a reason to file in its own right, funds transfers inconsistent with the customer's business, and it is what separates this case from a textbook funnel account: the cash came in locally and left as trade payments.

The network: three customers nobody had linked

The link finder searched every customer for shared addresses, devices, beneficiaries and cash deposited at the same branch within an hour of Lindqvist's, and proposed three. Dorian Pask shares Lindqvist's registered address and deposited cash seven times within 40 minutes of a Lindqvist deposit at the same branch; a SAR had been filed on him in May 2025. Teodora Vance logged in from the same online banking device on 11 days, made five same-hour deposits and sent Lindqvist $40,000 marked "loan." Brightfield Home Goods wired $48,000 to the same Jadeport account. The investigator opened the branch transaction log behind the links, 16 deposits worth $147,200, and accepted all three.

Two further facts arrived from outside. A 314(b) request to Alder Ridge Savings Bank, approved by the BSA officer and sent on October 9, came back on October 19: Brightfield had sent another $77,000 to Jadeport from its account there. Across the network, the case now held 39 cash deposits totalling $358,300 and five wires to Jadeport totalling $251,500.

The decision on day 17: file, with three reasons and one correction

The recommendation drafter proposed filing at 93% confidence under three of the bank's reason codes: structuring with signs of intent to evade reporting, funds transfers inconsistent with the customer's business, and third-party or nominee depositors, with five subjects. The verifier, on a different model, checked 38 amounts, counts, dates and names against the source and found one wrong: the draft said "five branches," the core system showed six. The investigator accepted the correction, chose File a SAR, kept the three reason codes and attested. Had she gone against the draft, she would have needed an override code and a note. The full investigation report for this case follows that correction from the rows to the packet.

The SAR decision on day 17, after the correction

The senior investigator, Priya Raman, saw the decision with three checks beside it: every value agrees with its source, the maker and checker are different people, and the case is within its clock. She approved. The SAR filing team received a packet with five subjects, activity from September 8 to October 1, the cash and wire totals and 41 cited items, due Wednesday, November 4.

After the decision: filing, ratings, an exit and the continuing-activity question

Three hand-offs followed, each with its own approver. Three customers' risk ratings were proposed to rise to High, waiting for a senior investigator. The BSA officer approved an account exit for Lindqvist and Brightfield, with a 30-day notice from deposit operations on its standard template, closing November 23, checked so it reveals nothing. And the case raised the question every filed case raises: what about activity after the SAR?

The October 2025 FAQs made the answer the bank's choice. A bank need not run a separate review after filing, and the familiar timeline, detection on day 0, the first SAR by day 30, a review period ending on day 120 and a continuing SAR by day 150, is one banks may follow but need not (SAR FAQs, Q2 and Q3). The sample bank elects that timeline for filed cases whose account stays open; for this case it would have meant a review ending February 2, 2027 and a continuing SAR by March 4, 2027. Because the accounts close on November 23, no continuing review is planned.

How long does an AML case take? What the enforcement record shows

A case takes as long as the evidence and the decision need, inside two limits: a review completed in a reasonable time, and a filing within 30 days of the determination. The enforcement record shows what happens when banks treat either as elastic. At TD Bank, FinCEN found that in 2018 "the AML program registered over 70,000 backlogged detection alerts and roughly 3,000 aged subpoena responses and further investigation cases," and that during the backlogs the bank "willfully failed to timely file over 6,000 SARs" (FinCEN, TD Bank consent order).

Bank of America's 2026 consent order records a lookback that found close to 8,900 SARs the bank had failed to identify and file, on activity of nearly $4 billion, and that it "filed a material portion of its SARs more than six months after the relevant activity took place" (FinCEN, Bank of America consent order). Neither problem was a single investigator working slowly. Both were queues that grew faster than the people working them, which is why the FIU manager's view of every clock matters as much as any one case.

What the investigator sees each morning: cases ranked by the SAR clock

What AML case studies for training should teach

Most AML case studies used in training teach the typology: what structuring, funnel accounts or trade-based laundering look like. This one is better used to teach the process, because that is where real cases go wrong. The six lessons below are the ones it carries.

The seats involved in each step, from the Level 1 analyst who escalated to the BSA officer who approved the exit, are set out in what an AML investigator does, seat by seat. The solution is at AML Case Management.

Questions people ask

What is an AML case study?

An AML case study is a worked example of a suspicious activity case: the customer, the activity, the evidence, the analysis and the decision. Training case studies are usually fictional or anonymised, as this one is; public ones come from enforcement orders, which describe how banks' programs failed rather than how individual cases were decided.

What happens if a bank misses the 30-day SAR deadline?

A late SAR is a violation of the SAR rule, and a pattern of them is a program failure. FinCEN's orders against TD Bank (over 6,000 SARs filed late during its backlogs) and USAA Federal Savings Bank (at least 3,873 SARs not filed on time or accurately) both cited late filing among the violations behind their penalties.

Can the SAR deadline be extended to 60 days?

Only to identify a suspect. If no suspect was identified on the date of detection, a bank may delay filing for an additional 30 calendar days to identify one, but reporting may never be delayed more than 60 days after initial detection. In this case the subjects were known, so the 30-day deadline applied.

Do you need to close the account after filing a SAR?

No. The FFIEC manual leaves the decision to keep or close an account to the bank, under its own standards, and asks for procedures on when repeat filings should lead to a relationship review or closure. If law enforcement asks the bank to keep an account open, the request should be in writing, and the bank still files SARs on what it sees.

What is a money laundering case study example from enforcement?

FinCEN's 2023 order against Shinhan Bank America describes a customer who moved about $4.7 million from a real estate business account through a non-profit's account to the personal accounts of its signers, which the order described as pass-through activity pointing to tax evasion. Enforcement orders are a useful source of real patterns, though they describe what a bank missed, not how a good investigation runs.