An AML investigator, usually called a Level 2 investigator, takes an alert that a Level 1 analyst has escalated and turns it into a case: pulling the customer's statements, wires, profile, prior alerts and earlier SARs, laying the activity out until a pattern shows or does not, and writing a recommendation to file a Suspicious Activity Report or not. A bank has 30 calendar days from the point it determines activity is suspicious to file that SAR, and most of an investigator's time goes into the gathering that comes before the judgment. The judgment itself is shared: the investigator recommends, and a named decision maker, often a senior investigator or a SAR committee, makes the final call. Botminds' AML Case Management is software for that desk: agents build the cited case file before the investigator opens it, and two people still make every file or no-file decision.
The examples below come from a fictional sample bank, Corvane National Bank, as it runs through the solution; every person, customer and amount in them is invented. The rules and figures about the work itself come from regulators and are linked where they appear.
The scale an investigator works inside
4.8M
Suspicious Activity Reports filed with FinCEN in fiscal 2025, by all filer types
up from 4.3 million in fiscal 2022
30days
from initial detection to filing a SAR, extendable to 60 only to identify a suspect
137,800
people employed in the federal job group that holds fraud and financial crimes investigators, 2025
What does an AML investigator do all day? Build the case a decision rests on
An AML investigator spends the day turning an escalated alert into evidence a decision maker can rely on. The federal occupational profile for fraud examiners, investigators and analysts lists the work in plain terms: in-depth investigation of suspicious financial activity such as suspected money laundering, then "Gather financial documents related to investigations", "Prepare written reports of investigation findings" and "Recommend actions in fraud cases" (O*NET 13-2099.04). The task it rates most important of all is "Document all investigative activities."
In a bank, that list becomes a sequence. The investigator reads the alert and the Level 1 note, pulls twelve months or more of statements, wires and cash activity, reads the customer's profile and expected activity, searches for prior alerts and SARs on the customer and anyone connected, checks 314(a) results and any 314(b) replies from other banks, and looks at deposit tickets and teller notes. Then comes the analysis: does the activity fit the business the customer said it runs, and if not, what explains it?
The output is a written conclusion. The FFIEC examination manual expects it: "After thorough research and analysis, investigators should document conclusions including any recommendation regarding whether or not to file a SAR" (FFIEC manual, Managing Alerts). What the investigator does not have to do is prove a crime. The same section says banks "are not obligated to investigate or confirm the underlying crime"; that is law enforcement's job. The investigator's job is to show why the activity is suspicious, clearly enough that someone who never saw the case can act on it.
Analyst vs investigator: where Level 1 ends and a Level 2 AML review begins
The difference between an AML analyst and an AML investigator is depth and authority. A Level 1 analyst works the alert queue: each alert gets a review against the customer's history and a disposition, closed with a rationale or escalated. A Level 2 investigator takes the escalated ones and works them as cases, across accounts, counterparties and related customers, until there is a recommendation. At many banks a third tier, a senior investigator or a committee, decides.
No regulation names the tiers. What the rules require is a defined path. The FFIEC manual asks that "management should establish a clear and defined escalation process from the point of initial detection to disposition of the investigation," and that policies name "the person(s) or departments responsible for identifying or producing an alert of unusual activity, managing the alert, deciding whether to file, SAR completion and filing, and monitoring and SAR filing on continuing activity." Levels 1 and 2 are how most banks answer the second sentence.
An AML analyst clears alerts; an AML investigator builds cases
Level 1 analyst: A monitoring alert: one scenario, one customer, one period.
Level 2 investigator: An escalated alert and the analyst's note, often with related alerts on other customers.
Level 1 analyst: The flagged activity against the customer's recent history and profile.
Level 2 investigator: Twelve months or more of activity, counterparties, linked customers, prior SARs, 314(a) and 314(b), documents and teller notes.
Level 1 analyst: A disposition: closed with a rationale, or escalated.
Level 2 investigator: A case file and a written recommendation: file, no file, or keep investigating.
Level 1 analyst: Usually the closure of an alert, often with a sample checked by quality control.
Level 2 investigator: The recommendation. The final file decision usually needs a second signature.
Level 1 analyst: Internal service levels for working alerts.
Level 2 investigator: The SAR deadline: 30 days from the suspicious determination to filing.
The distinction matters most for the clock. An alert firing does not start the 30 days. The bank's 30 days begin once a review has determined the activity is suspicious, which in a two-tier bank is usually the Level 2 investigator's call, and a worked AML case study follows that clock on one fictional case from the first deposit to the filing deadline.
The seats around a Level 2 case, and what each one signs
A Level 2 case passes through five or six hands, and each one owns something specific: a disposition, a recommendation, an approval, a filing, a program. The figure below takes the sample bank's financial intelligence unit seat by seat, with what each seat looks like today and once agents do the gathering.
Six seats in the life of one AML case, and what stays with each
Today
Works the alert queue and escalates what cannot be closed, with a note on why.
With agents
Escalates the same way; the case file starts building the moment the alert moves to Level 2.
Still theirs: the disposition of every alert and the reason for it
Today
Carries about 14 open cases, each on its own clock, and spends the first days of each pulling statements, wires and tickets from six systems into a spreadsheet.
With agents
Opens a case already built, with the money laid out by counterparty, linked customers proposed with reasons and a draft whose every number has been checked.
Still theirs: whether the activity is suspicious, which links to accept, and the recommendation
Today
Approves decisions for eight investigators by rereading the evidence behind each recommendation.
With agents
Sees the decision with the value check and the separation-of-duties check beside it, and approves or returns with a reason.
Still theirs: the final approval of every file and no-file decision
Today
Learns which cases are close to day 30 from status meetings, after the time to rebalance has passed.
With agents
Sees every 30-day and 60-day clock across 85 investigators in six teams, with escalation at day 20.
Still theirs: staffing, routing and the detection date when it must change
Today
Signs off on what leaves the unit, from closure letters to replies to other banks, checking each for anything that would reveal a SAR.
With agents
Approves account exits, 314(b) replies and export packs that arrive drafted and checked for disclosure.
Still theirs: the program, board reporting, exits and anything sent outside the unit
Today
Retypes subjects, amounts and dates from the recommendation into the FinCEN form.
With agents
Receives a packet with subjects, activity dates, amounts and every cited item.
Still theirs: the filing through BSA E-Filing, and its accuracy
Two seats are often missed in job descriptions. The FIU manager owns the clock across the unit: whether 198 cases sitting between day 21 and day 25 can all be decided in time is a staffing question, not an investigator's. And the BSA officer owns what leaves the unit. A closure letter, a call-center script or a reply to another bank under 314(b) can each reveal that a SAR exists, and the SAR rule, 31 CFR 1020.320(e), forbids disclosing anything that would reveal one.
The Level 2 desk in AML Case Management: fourteen cases, ranked by the SAR clock
Who decides whether to file a SAR? A named decision maker or a committee
The final SAR decision belongs to whoever the bank's procedures name: an individual, often a senior investigator or the BSA officer, or a SAR committee. The FFIEC manual is specific: "The decision maker, whether an individual or committee, should have the authority to make the final SAR filing decision. When the bank uses a committee, there should be a clearly defined process to resolve differences of opinion on filing decisions."
That leaves the investigator in an unusual position. They know the case better than anyone, they write the recommendation, and in many banks they do not sign the outcome. Good procedures make the hand-off explicit. The investigator decides what to recommend and why; the decision maker checks that the evidence supports it and approves or returns it with a reason. A maker who approves their own decision defeats the point, which is why the sample bank's settings block it outright.
The second signature: a senior investigator approves the decision
No-file decisions are part of this, and the rules on them changed in October 2025. The interagency SAR FAQs say nothing in the BSA or its regulations requires, or leads examiners to expect, a written record of a decision not to file, and that where a bank does keep one, a short statement will usually be enough (SAR FAQs, Q4; the guide to the October 2025 FAQs explains what changed). The FFIEC manual still says to document them and now carries a banner saying its SAR section will be updated; examiners are told the FAQs are the most current guidance. Many banks keep a short statement anyway, because it is the fastest way to show a decision followed procedure.
What examiners test: the decision-making process, not each call
Examiners judge whether the bank has a sound way of reaching SAR decisions, not whether each individual decision was right. The manual puts it bluntly: "The decision to file a SAR is an inherently subjective judgment. Examiners should focus on whether the bank has an effective SAR decision-making process, not individual SAR decisions." A bank that followed its procedures and decided not to file should not be criticised for it, the manual adds, unless the miss was significant or made in bad faith.
For an investigator this cuts both ways. A reasoned no-file is defensible even if an examiner would have filed. A file decision reached without following procedure is not made safe by being a filing. What examiners look for in a sample of cases is the chain: an alert, an escalation with a reason, evidence gathered, a recommendation, a decision by the person entitled to make it, and a filing on time.
The five parts of a SAR program, and the seat that owns each at a two-tier bank
| Component (FFIEC) | What it covers | Who usually owns it |
|---|---|---|
| Identification or alert of unusual activity | Monitoring output, employee referrals, law enforcement inquiries, 314(a) and 314(b) requests | Monitoring team; Level 1 analysts |
| Managing alerts | Escalation from detection to disposition, research, documented conclusions | Level 1 analysts, then Level 2 investigators |
| SAR decision making | A final decision maker or committee, with authority to decide | Senior investigator, BSA officer or SAR committee |
| SAR completion and filing | A complete, accurate narrative, filed on time through BSA E-Filing | SAR filing team, from the investigator's packet |
| Monitoring and SAR filing on continuing activity | Repeat filings, relationship review, account closure decisions | Investigators, the BSA officer for exits |
What does a financial intelligence unit do in a bank?
A bank's financial intelligence unit, or FIU, is the team that investigates suspicious activity and decides what the bank reports: the analysts, the investigators, the decision makers and the people who file. The name borrows from the government agencies that receive suspicious transaction reports; FinCEN is the US one. Inside a bank, the FIU is also the boundary of a secret. Everything it knows about a pending or filed SAR stays inside, and the rest of the bank, including the customer's relationship manager, should not be able to tell a case exists.
The FIU also reports upward. Bank regulators require that the board or a board committee be told SARs have been filed, though not in any particular format. The FFIEC manual adds an exception that every investigator should know: when the subject is an insider, such as a director or the president, the policy that would notify that person "should not be followed," and the deviation should be documented.
Staffing is the FIU's recurring problem. In its spring 2025 risk perspective the OCC noted that "banks are leveraging BSA staff to help manage related risks in other areas of the bank, e.g., fraud investigations, which could affect continuity of BSA operations" (OCC Semiannual Risk Perspective). The same desk that works structuring cases is increasingly asked to work scams and fraud, on the same 30-day clocks.
The FIU's view in AML Case Management: 1,742 open cases by day of the clock
Certification and training: what a BSA/AML investigator needs
No regulation requires an AML investigator to hold a certificate. The law requires training: the bank AML program rule lists "Training for appropriate personnel" as one of its elements (31 CFR 1020.210(a)(2)(iv)), and the FFIEC manual expects that investigation staff "possess the requisite experience levels and are provided with comprehensive and ongoing training to maintain their expertise." Private certifications are common in hiring, but they are a bank's choice, not an examiner's requirement.
What separates a good investigator is harder to certify. The skills below come up in every one of the regulators' expectations for this desk, and in what goes wrong in enforcement orders when they are missing.
What a strong Level 2 investigator brings to every case
- Reads a customer's business
Knows what a furniture importer's cash and wires should look like, so a supplier that is not on the profile stands out.
- Separates a red flag from a reason to file
Since October 2025, cash near $10,000 alone is not enough; the file needs signs the activity was designed to evade reporting.
- Follows the money past the account
Counterparties, shared addresses and devices, beneficiaries, and other customers depositing at the same branch and hour.
- Writes for a reader who never saw the case
Who, what, when, where, why and how, in order, with every figure traceable to a transaction.
- Keeps the secret
Nothing that would reveal a SAR reaches the customer, the relationship manager or another bank.
- Works to the clock
Knows the case's detection date, and asks for help before day 25, not after day 30.
Where AML Case Management agents take over the gathering, and what stays at the desk
Agents can take the part of the job that is retrieval and arithmetic; the judgment, the links and the decision stay with people. In AML Case Management, the case builder reads the alert and the escalation note, twelve months of statements, the customer profile, counterparties, prior alerts and the restricted SAR index, 314 results and the documents, and assembles a file in which each item is cited to its system. On the sample case it held 41 items from six systems before the investigator opened it, and named the two deposit tickets document imaging failed to return.
The rest of the desk changes shape around that. The investigator starts from the money laid out by counterparty instead of a spreadsheet, asks questions in plain words and gets cited answers, and accepts or rejects linked customers that the link finder proposes with its reasons. A drafter writes the recommendation; a second agent on a different model checks every amount, count, date and name against the source. Then the investigator decides and a senior investigator approves. The AML investigation steps, one by one, shows which of them can move and which cannot.
What the agents may not do is written into the solution's settings: decide, approve, add a subject, send a 314(b) message, contact a customer or change a detection date. Those are the investigator's and the decision maker's, which is where the regulators put them. For the whole solution, see AML Case Management.
Questions people ask
What is a BSA/AML investigator?
A BSA/AML investigator is a bank employee who investigates potentially suspicious activity under the Bank Secrecy Act and recommends whether the bank should file a Suspicious Activity Report. The title varies (AML investigator, financial crimes investigator, FIU investigator); the federal occupational profile closest to it is fraud examiners, investigators and analysts, whose core tasks include investigating "suspected money-laundering efforts."
What is a Level 2 AML review?
A Level 2 review is the investigation of an alert that a Level 1 analyst could not close. It covers the customer's whole relationship, counterparties and linked customers rather than one flagged transaction, and ends in a written recommendation. The tier names are a bank's own; the FFIEC manual requires only a clear escalation path from detection to disposition.
How many cases does an AML investigator handle?
There is no regulatory standard, and caseloads depend on complexity. Enforcement orders show what too many looks like: at CommunityBank of Texas, FinCEN found three analysts each reviewing about 100 alerts a day, too many to open the deposit slips and wire records behind them. The sample bank in this guide caps investigators at 24 open cases.
Does an AML investigator need to prove money laundering?
No. The FFIEC manual says banks "are not obligated to investigate or confirm the underlying crime," which is the responsibility of law enforcement. The investigator needs to establish that the activity is suspicious within the meaning of the SAR rule and describe why, clearly enough for law enforcement to act.
How long does an AML investigator have to finish a case?
The SAR must be filed within 30 calendar days of initial detection, or up to 60 days if the bank is still trying to identify a suspect. The clock starts when a review determines the activity is suspicious, not when the alert fires, and the review leading up to that point must still be done in a reasonable period of time.
Can an AML investigator tell the customer about the case?
No. The SAR rule forbids disclosing a SAR or any information that would reveal one, and that includes telling the customer or anyone outside the people with a need to know. Account exits and letters that follow a case are sent on neutral templates so nothing in them points to the investigation.