Wire investigation: the case file an examiner can follow

A wire investigation is the work of finding out what happened to a wire transfer that someone has questioned, and putting it right: tracing the payment through each bank, deciding whether anything went wrong under the funds-transfer rules, and replying, correcting or claiming. The answer goes to the person who asked. The file goes to everyone who checks the bank later, and that is where many desks are weakest, because the evidence sits in inboxes, screenshots and notes in a shared tool. The test of a good file is simple: a stranger can follow it months later and reach the same conclusion. Botminds' Payment Investigations is software for payment investigation teams that builds that file as a by-product of the work, with every lookup cited, every decision explained and every approval signed by a second person.

What is a wire investigation?

It is the bank's response to a question or problem about a wire after it has been sent or received. The common ones are a beneficiary who says it was not credited, a sender who wants a payment cancelled or returned, an amount or beneficiary that was wrong, a payment the receiving bank cannot apply, and a claim for interest or fees. The investigator traces the payment, establishes the facts, decides what they mean and resolves the case by replying, correcting the posting, returning funds or paying or rejecting a claim.

The tracing is partly inside the bank and partly outside it. Inside, the payment leaves a trail across the payments hub, the Fedwire or SWIFT gateway, the core banking system and the general ledger. Outside, the investigator depends on correspondents and the beneficiary's bank to say what they did. The steps and the rule at each are set out in the payment investigation process; this guide is about what the bank keeps to prove it did them properly.

What do examiners ask about payment investigations?

They ask whether open items are controlled, whether corrections are approved by someone independent, and whether the records let them reconstruct a transaction. The FFIEC's Wholesale Payment Systems booklet, still listed among its IT examination booklets, sets out the procedures for a funds-transfer operation. Several are about the investigation desk in all but name.

The retail booklet, written for ACH, names the unit outright, asking examiners to judge how well the investigation unit handles customer inquiries and controls return and rejected items (Retail Payment Systems, April 2016). Neither booklet tells a bank how to organize its files. Both describe evidence the examiner expects to find, and a desk that cannot produce it case by case has a finding waiting for it.

The case file, annotated

A defensible case file holds seven things: the request, the payment identified, every lookup with its source, the determination, the action, the approvals and the clock. The figure at the top of this guide sets out what each proves. Two of them are where files most often fall short.

The first is the determination. A file that records "corrected posting, notified client" shows what was done but not why, and an examiner reviewing a reversal will want the why: which rule, which clause of the account agreement, which fact. The second is the clock. A file that records only when a case was opened and closed cannot show where the time went in between, which is the information management needs to tell a slow desk from a desk waiting on slow counterparties.

The trail in Payment Investigations: who, what, when, why and which evidence

Every lookup with the record it came from

A lookup is evidence only if a reader can open what was looked at. "Payment confirmed credited per core" is a note; a link to the core posting, with its time and account, is evidence. The FFIEC asks for audit trails detailed enough to support "the analysis or investigation of specific transactions", and the same standard applies to the investigation itself: each step should point at the record behind it.

In Payment Investigations, every line the research agent writes carries a numbered citation that opens its source: the payments hub record, the tracker status, the core posting, the name-check log, the agreement or the rule. In the solution's sample case, a non-receipt claim from a fictional German bank, the thread reads as a sequence of cited lines: the payment message received at 10:41 a.m. on October 19, the tracker's credited status a minute later, the core posting to account …4417, and the name-check score that let it through. An examiner reading that thread does not have to trust the analyst's summary.

Citations also protect against a quiet failure: an answer built on the wrong payment. Two wires to the same beneficiary for similar amounts on the same day are easy to confuse. A file that identifies the payment by its unique end-to-end reference (UETR), and cites the record that carries it, shows the confusion did not happen.

Who should approve a wire correction?

Someone other than the person who prepared it, with authority for the amount. That is the plain reading of the FFIEC procedures: an officer approves corrections, reversals and adjustments, and people not involved in receiving, preparing or sending funds review exceptions. A correction that debits one customer and credits another, a return of funds, a payment of a claim and a reply admitting the bank's error all belong in that category, because each moves money or commits the bank.

The approval in Payment Investigations, with the reason kept on the case

Two details make the difference between a control and a ritual. The checker must see the same evidence the maker saw, not a summary, or the approval is a signature on trust. And the approval must be refused, not merely discouraged, when maker and checker are the same person. In Payment Investigations a maker can read but not approve their own draft, a checker who edited a draft cannot approve it, the administrator cannot act on cases, and corrections above the team lead's limit ($250,000 in the sample) and claims above $10,000 go to the Head of E&I. The design target is that 100% of replies that admit liability, move money or pay a claim are approved by a second person. Why a reply conceding error is itself a decision that needs that second person is the subject of UCC 4A-207 for investigators.

How long must investigation records be kept?

Five years for the records the Bank Secrecy Act rules require, and as long as the bank's policy says for the rest. Under 31 CFR 1010.430(d), records required by that chapter must be kept for five years and stored so that they can be retrieved within a reasonable time (eCFR); the guide to BSA recordkeeping requirements quotes the rule and prices it by bank size. For funds transfers of $3,000 or more, the records a bank must keep are set out in 31 CFR 1020.410(a). Those rules govern the payment records; the investigation file itself is kept under the bank's own retention schedule, which a bank can align to the same period so that a case and the payment it concerns can be produced together.

The clocks a wire case file has to show

A file has to show the legal clocks that bear on the case, not just the service level. Three matter most. Under UCC 4A-505, a customer who received notice reasonably identifying a debited payment order cannot later dispute it unless it objects within one year. Under 4A-205 and 4A-304, a sender who gets notice of an erroneous order or execution must exercise ordinary care to find the error and report it within a reasonable time not exceeding 90 days; a sender who fails loses interest under 4A-304, and under 4A-205 can be liable for the bank's proven loss. And under 4A-404(b), a beneficiary's bank that fails to notify an account beneficiary by midnight of the next funds-transfer business day after the payment date owes interest for the gap.

Each of those clocks starts from a date the file should prove: the date notice was received, the date the error was reported, the payment date. A case file that records only "opened" and "closed" cannot show a reviewer that the bank met them, or that the customer did not. The Reserve Banks add one of their own: a Fedwire participant objecting to a debit to its master account must give notice consistent with 4A-505 and bring any legal action within one year (Operating Circular 6, §21.3).

What an email with a screenshot cannot prove

An email asking "OK to reverse?" with a screenshot attached proves that someone was asked. It does not prove what the approver saw, which version of the facts they approved, whether they had authority for the amount, or that the reversal posted matched what was approved. Each of those is a question an examiner or an auditor can ask about a correction, and each is answered by a structured approval and not by an inbox.

One file, four readers: examiners, internal audit, the BSA officer and the correspondent

The same case is read by people with different rights to see it, so a file has to be producible in more than one cut. An examiner reviewing the investigation unit wants cases, decisions, approvals and replies for a period. Internal audit wants the maker and checker evidence: who drafted, who approved, the reason codes, the limits and any overrides. The BSA officer may need everything, including a referral to Financial Crimes that no one else may see. A correspondent asking for the history of its own case is entitled to the messages and replies, and nothing internal.

Payment Investigations builds those four cuts as exports from the same trail: an examiner export with account numbers masked and restricted referrals removed, an internal audit export, a BSA officer export that alone carries Financial Crimes referrals, and a correspondent export of one case's messages and replies. The same discipline governs the drafts themselves: the drafting agent removes restricted wording from anything a client or correspondent will read. What the bank owes in money when a wire is late, and how to price it, is set out in UCC 4A-305 interest. To see the trail and the exports on a sample case, start from Payment Investigations.

Questions people ask

How do banks investigate a wire?

They identify the payment by its references (the UETR and, on Fedwire, the IMAD and OMAD), trace it through their own systems and ask the other banks in the chain what they did with it. They then decide what the facts mean under UCC Article 4A, Regulation J for Fedwire, and the agreements, and reply, correct, return or claim. The bank's own part can be traced quickly; answers from other banks set most of the pace.

What records should a wire investigation keep?

The request as received, the payment's identifiers, every lookup with its source, the determination and the rule applied, the entries and replies, the maker and checker with their reasons, and the dates that start each legal clock. The payment records themselves fall under the BSA recordkeeping rules for funds transfers of $3,000 or more.

What is an aging report for open items?

It lists unresolved items by how long they have been open, so management can see what is stuck and act. The FFIEC's funds-transfer procedures expect management to receive periodic reports on open items, suspense and inter-office accounts that include the aging of open items, the status of significant items and the resolution of prior ones.

How long does a customer have to object to a wire debit?

Under UCC 4A-505, one year after receiving notification that reasonably identifies the payment order. After that, the customer is precluded from asserting that the bank is not entitled to keep the payment. Shorter duties apply to reporting errors: a reasonable time not exceeding 90 days under 4A-205 and 4A-304.

Do examiners accept email approvals for wire corrections?

The FFIEC procedures do not prescribe a format; they expect an officer to review and approve corrections and reversals, and supervisory review of adjustments and their reasons. An email can record that approval if it shows what was approved, by whom, with what authority and on what evidence, which a screenshot attached to a question rarely does.

Is the investigation file a BSA record?

Not as such. The BSA rules require the funds-transfer records themselves, kept five years. A bank can keep investigation files on the same schedule so the case and the payment can be produced together, and a file touching a suspicious activity report must be handled under that report's confidentiality rules.