AML investigation steps, re-divided between agents and people

The AML investigation steps at a bank run from an escalated alert to a decision: confirm when the activity was determined suspicious, read the customer's profile, pull the activity, search prior alerts and SARs, resolve counterparties and documents, find linked customers, ask other banks, lay the money out until a pattern shows, decide whether it is suspicious, write and check a recommendation, get it approved, and hand it to the people who file. Most of those steps are gathering, and gathering is where a Level 2 case loses its days. Botminds' AML Case Management moves the gathering to agents that cite every item they bring back, and leaves the steps that are judgment with the investigator and a second approver. Banks are not required to prove the underlying crime, so what the steps must produce is a decision that someone accountable made on evidence anyone can check.

The examples on this page come from a fictional sample bank, Corvane National Bank, and its case C-2026-04417, a furniture importer depositing cash just under $10,000; every person, customer and amount in them is invented.

What are the steps in an AML investigation? Twelve, from escalation to hand-off

A Level 2 AML investigation has about twelve steps, though banks group them differently. Regulators do not prescribe them; the FFIEC manual asks for a clear escalation path from first detection to the close of the investigation, and for investigators to write down their conclusions, including whether they recommend a SAR. Inside that frame, the work is the same everywhere: establish the clock, assemble the evidence, analyse it, decide and hand off. The grid below takes each step and asks one question of it: is this retrieval, or is it judgment?

Four steps are pure retrieval, five are shared, and three are a person's alone. The pattern is not an accident of software design. It follows the line the regulators draw between gathering information, which can be done by anyone or anything competent, and deciding that activity is suspicious, which the FFIEC manual calls "an inherently subjective judgment" and expects a named decision maker to own.

Which AML investigation steps can agents do, and which stay with people?

Agents can do the steps whose output can be checked against a source: retrieval, matching, drawing, drafting and checking. People keep the steps whose output is a judgment about intent, or that changes what happens to a customer or what leaves the bank. That gives a simple test for any step: if the result can be verified by opening the row it came from, an agent can produce it; if the result is an opinion someone must answer for, a person produces it.

The shared steps are where design matters most. Link analysis is the clearest case. An agent can search every customer for a shared address, phone, online banking device, beneficiary or a cash deposit at the same branch within the hour, far faster than a person running one query at a time. But adding a person to a SAR is a serious act, so in the solution a proposed link joins the case only when the investigator accepts it, and a rejection takes a reason code. The 314(b) step works the same way: the agent checks the other bank's registration and drafts the request, and nothing is sent until the BSA officer approves it.

Gathering, done before the investigator opens the case

Gathering the evidence: profile, activity and history in one place

Steps two to five are retrieval, and they are where a by-hand case spends most of its first days. The investigator needs the customer's profile, because the CDD rule makes the profile the baseline for what is unusual; the activity, from the core system and the payments hub; the history, meaning prior alerts, prior cases and the bank's own SAR index; and the documents behind the transactions, from imaging. FinCEN's 314(a) results belong here too: a match tells the investigator that law enforcement has named the customer in a significant investigation, and banks search accounts for the "preceding twelve months" and transactions for the "preceding six months" when they respond (31 CFR 1010.520).

Each source is a different system with its own login and export. That is why the gathering step is slow and why it is error-prone: an investigator copying 64 rows of five weeks' activity into a spreadsheet makes the same mistakes anyone would. In the sample case, the case builder read the alert and escalation note, twelve months of statements, the profile and beneficial ownership, seven counterparties, prior alerts and the restricted SAR index, 314(a) results and 14 documents, and cited each item to its system. Document imaging timed out on 2 of 23 deposit tickets; the file says so and offers a retry.

Finding the other customers: link analysis that proposes, not adds

Structuring and funnel schemes rarely involve one customer, and finding the others is the step investigators most often skip for lack of time. Each search is a separate query: who else uses this address, this phone, this device, this beneficiary? Who else deposited cash at this branch within an hour of our customer? Run by hand, an investigator does the obvious two or three and stops.

In the sample case the link finder ran all of them. It proposed three customers, each with its strength and evidence: Dorian Pask, who shares Lindqvist's registered address and deposited cash seven times at the same branch within 40 minutes of a Lindqvist deposit (0.94); Teodora Vance, who used the same online banking device and sent Lindqvist $40,000 (0.91); and Brightfield Home Goods, which wired $48,000 to the same Hong Kong account (0.88). It also listed the two customers it considered and did not link, and why. The investigator opened the branch transaction log behind the links, 16 deposits worth $147,200, each within 60 minutes of a Lindqvist deposit at the same branch, and accepted all three.

Linked customers, each with the reason and the evidence

How long does an AML investigation take? Thirty days, and a reasonable period before them

A bank must file a SAR within 30 calendar days of initial detection, or up to 60 if it is still trying to identify a suspect, so the investigation that leads to a filing has to fit inside that window. But the 30 days start only when a review has determined the activity is suspicious, and the review before that point has its own standard: it must be completed "in a reasonable period of time." The FFIEC manual explains what that means: "What constitutes a 'reasonable period of time' will vary according to the facts and circumstances of the particular matter being reviewed and the effectiveness of the SAR monitoring, reporting, and decision-making process of each bank. The key factor is that a bank has established adequate procedures for reviewing and assessing facts and circumstances identified as potentially suspicious, and that those procedures are documented and followed."

That is the honest answer to "what is the standard review period for AML investigations": there is no number in the rules, there is a deadline once suspicion is determined, and there are the bank's own written service levels, which examiners will hold it to. Within that, hours per case vary enormously with complexity. The figure below is our estimate for one escalated structuring case of moderate complexity, by hand and with the solution.

Laying out the activity: why the pattern hides in a spreadsheet

The analysis step is where a by-hand case most often goes wrong, because the format hides the pattern. Twenty-three cash deposits listed in rows, each between $8,600 and $9,700, look like twenty-three deposits. The same deposits drawn on a timeline, one lane per counterparty, show something else: on eight days the cash was split between two branches, so that no single deposit passed $10,000 while the day's total did.

That distinction now carries legal weight. Since October 9, 2025, the interagency SAR FAQs have said that transactions at or near the $10,000 CTR threshold do not, by their presence alone, require a SAR; a bank must file only if it knows, suspects or has reason to suspect they were designed to evade CTR reporting (SAR FAQs, Q1; the guide to the October 2025 FAQs covers all four answers). Amounts near the threshold are not enough. Split days, linked depositors and a teller's note that the customer asked whether two deposits on one day are added together are the signs of design.

In the solution, the investigator can ask the case in plain words and get an answer with citations. On the sample case, "What happened between Sep 14 and 18?" came back with seven cash deposits, $64,300, at all six branches in five days, then $54,200 wired to the Hong Kong counterparty four hours after the last deposit, and five deposits by the linked customers within an hour of Lindqvist's. The payments the answer used light up on the timeline, so the investigator can check every one.

Can AI do AML investigations? What the regulators have said so far

AI can do parts of an AML investigation, and US regulators have said so for years; none has said it can make the SAR decision. In their 2021 request for information on AI, the federal banking agencies already listed picking out transactions for BSA/AML investigation among the ways banks used AI (2021 AI RFI). Treasury's December 2024 report on AI in financial services went further: respondents described generative AI working alongside investigation platforms to gather and summarise case data and to draft and file reports (Treasury, AI in Financial Services).

The same report records the risk on the other side. One respondent told Treasury that imprecise AI models had led to more bank accounts being closed in error; Treasury does not endorse the claim, but it names the failure that matters here (the guide to AI in transaction monitoring covers what regulators and researchers have found): a model that is wrong about a customer does real harm when nobody checks it. That is the case for keeping the suspicion, the links and the decision with people, and for checking every number an agent writes. The agencies' 2018 joint statement on innovation still frames how a bank can try: a pilot run alongside the existing process is the expected route, and a pilot that fails is not, by itself, a reason for criticism.

Deciding, approving and handing off: the last steps

The last three steps turn a case into consequences, and each one has an owner. The drafter writes the file, no-file or need-more recommendation with reason codes and a statement; the verifier, running on a different model, checks every amount, count, date and name in it against the source with no tolerance on amounts. In the sample case it checked 38 values and found one wrong: the draft said "five branches", the core system showed six. How one number is traced from statement to SAR follows that check in detail.

The SAR decision in AML Case Management: file, no SAR, or need more

Then come the hand-offs. An approved file decision goes to the SAR filing team as a packet with subjects, activity dates, amounts and cited items; proposed customer rating changes go to a senior investigator; an account exit goes to the BSA officer with a closure notice checked so it reveals nothing. What makes these steps safe to speed up is that every one of them ends with a person's name on it. For the full sequence on one case, from the first deposit to the filing deadline, see the case study, day by day, and for what a bank needs in place before agents can do any of this, start with its data. The solution itself is at AML Case Management.

Questions people ask

What is the AML investigation process?

It is the bank's defined path from an alert of unusual activity to a disposition: review, escalation, investigation, a decision on whether to file a SAR, filing, and handling of continuing activity. The FFIEC manual describes it as five components, from identification of unusual activity through SAR filing on continuing activity, each with named owners.

How do banks investigate money laundering?

Banks do not investigate the crime itself; they investigate whether activity is suspicious and report it. The FFIEC manual says a bank need not investigate or confirm the underlying crime; that is law enforcement's job. The bank's investigation compares activity with what it knows about the customer, follows counterparties and linked customers, and documents why the activity is or is not suspicious.

What triggers an AML investigation?

Most cases start from a transaction monitoring alert, but the FFIEC manual lists others: activity identified by employees, law enforcement inquiries such as subpoenas, 314(a) and 314(b) requests, and advisories from regulators or law enforcement. A trigger opens a review; the review decides whether there is anything to investigate.

What is 314(b) and when does an investigator use it?

Section 314(b) of the USA PATRIOT Act lets registered financial institutions share information with each other about possible money laundering or terrorist financing, with a safe harbor. A bank must file an annual notice with FinCEN and take reasonable steps to verify that the other institution has done the same before sharing.

Do investigators need to document a decision not to file?

Not under the BSA. The October 2025 interagency SAR FAQs say there is no requirement or expectation to document a decision not to file, and that a short statement will usually suffice where a bank does. Many banks still record one, because it shows the decision followed procedure.