Analyst guide

This guide is for AML analysts, investigators and senior analysts. It covers how to work the queue, investigate, use the AI assistants, review screening hits, analyse files, read and write rules, look after customer records, and the four-eyes controls that apply along the way. Senior analysts will find their extra responsibilities — QA review, bulk closure and screening confirmations — in their own section.

1. Getting around

• Icon rail (left): one icon per module. You will mostly use Work, Monitoring, Customers and Screening. Click an icon to open its flyout of pages; pin it to keep it open.
• Command palette: Ctrl+K (⌘K on a Mac) or /. Type part of a page name, an action such as "create rule", or a customer, account, case or rule reference, then Enter. Free text opens full search.
• Ask Sentry: Ctrl+J (⌘J) opens the AI copilot for questions about the page you are on.
• App bar: breadcrumbs, the notifications bell (four-eyes items waiting for you) and your user menu (theme, MFA, passkeys, sign out).

See Find your way around.

2. Your day: the alert queue

Alerts & cases (/alerts) is your work queue for monitoring alerts, including findings promoted from file analysis (origin Ad-hoc file). Screening hits are worked separately on Hits (/screening).

• Views: My work, Team and Unassigned.
• Claim next takes the highest-priority unassigned alert. Claim and Release work on a single alert; supervisors can assign alerts with Assign to.
• Priority is a 0–100 score shown as High (80 and above), Medium (50 and above) or Low.
• SLA chips show On track, Due today, Due soon or Overdue. SLA windows by severity are set in the Alert-work policy (/alerts/policy).

Reading an alert

Open an alert to see why it fired: the rule and version, the window, each threshold against the actual value (in your base currency with the exchange rate used), the trigger transactions and related alerts over the last 90 days. Summarise with AI adds a plain-language reading with a suggested outcome and reason code.

Closing an alert

Under Close this alert, choose the Outcome (No suspicion (activity explained) or Inconclusive), a Reason code from your institution's catalogue, and a Rationale of at least 20 characters, then Close alert. Use as rationale fills the fields from the AI summary — always edit before saving.

About one in ten closures is sampled for QA. A returned closure reopens with the badge "Returned by QA — rework" and its full history.

Escalating to a case

Select one or more alerts on the queue, give the case a title and select Open case. If an alert looks like a duplicate it usually is: rule cool-offs mean one sustained pattern raises one alert.

3. Investigating a case

A case (/cases/{id}) moves forward through Triage, Investigation, Review and Closed. The primary button Advance to … moves it to the next stage. The SLA indicator shows Within SLA or SLA breached.

Tab	Use it to
Overview	Run Investigate with AI (Sentry Agent memo) and Summarise case; set priority; Escalate or Hand over; open the Customer profile
Alerts	Read every linked alert and its explanation
Transactions	Review the subject's transactions; tick those a report must include and Save STR selection
Parties / UBO	See directors, owners and related parties; open a profile in the side drawer
Screening	See the subject's screening results
Documents	Attach evidence. Files are scanned and encrypted at rest; viewing adds a watermark with your name
Notes	Record what you checked and why (Add note)
Suspicion & STR	Record suspicion; draft the STR or SAR
Requests (RFI)	Ask a relationship manager a factual question with a due date
History	Every action on the case by named user

Use Link analysis (/cases/link-analysis) to map a subject's transaction network: counterparties, weighted flows and communities. Double-click a node to expand it; select two nodes to trace the path between them.

The Sentry Agent memo

Investigate with AI reads the case through read-only tools — alerts, transactions, screening, linked parties, prior alerts and peer baselines — and drafts an investigation memo: a summary, evidence with citations to the records, a typology assessment, a recommendation and a confidence. It is labelled AI draft — advisory and saved on the case, so the latest memo is there when you come back. Add to case notes adds it as a labelled note. The agent never dispositions, files or edits anything.

Information requests and tipping-off

Use Requests (RFI) › Ask a question to ask the customer's relationship manager for facts. The RM sees only your question and an answer box — never the case. Ask only for facts; never mention suspicion, an alert, an investigation or a report.

Recording suspicion

On Suspicion & STR, enter your Grounds for suspicion (at least 20 characters) and select Record suspicion. The suspicion clock starts and the case goes to the MLRO. In STR draft, choose the Report type (STR or SAR), use Draft narrative with AI if helpful, edit the narrative, tick the report indicators and Save STR draft. If the MLRO returns the case, address what they asked for and select Resubmit to the MLRO. See Draft and file an STR.

Warning: A case involving an STR becomes STR-restricted. Only STR-privileged roles and the people already on the case can see it. Do not discuss it outside the investigation.

Closing a case

Record your conclusion in a note and advance the case to Closed. A closed case keeps its history and rejects new evidence.

4. Screening hits

Hits (/screening) is the screening workbench. Statutory list hits (UN and Kenya domestic designations) come first; a statutory hit open more than a day shows as overdue.

1. Open a hit. Compare the subject and the list entry Side by side; the Reading column shows whether date of birth, nationality, identifier and type agree, are close or differ. Why this hit explains the match; Score breakdown shows how the score was built.
2. Optionally use Explain this match for an AI comparison; Use narrative fills the narrative only.
3. Decide with a coded reason and narrative: Clear (false positive), Propose true match or Escalate to a case.

True matches always need a second person. Clears of statutory list hits, and of hits scoring above your institution's threshold, become Clear proposed for a checker. A clear is remembered for that subject and list entry until either changes.

Other screening tools:

• Name search (/screening/search): look a name up against your lists without creating a hit.
• Batch screening (/screening/batch): screen a CSV of up to 5,000 names.
• Clear as false positive on the queue: clear several Potential hits at once with one reason code and narrative.
• PEP register (/screening/pep): designate PEPs and RCAs and request declassification.

See Review a screening hit.

5. File analysis

File analysis (/analysis/files) checks a statement that is not in the book — another bank's statement, a broker or fund ledger, a mobile-money statement — against your live rules, statement analytics and screening lists in an isolated workspace. Upload up to five CSV or XLSX files about one subject, confirm the mapping, validate, run, then Promote the findings that deserve an alert or Dismiss them with a reason. Always read the coverage panel first: limited coverage means "no findings" is not a clean result. See Analyse a statement file.

6. Rules

• Rule library (/monitoring/rules): every rule your institution runs — built-in, tuned and your own. Filter by status, severity, typology, transaction type, channel and grouping. A rule's page shows a plain-English summary, thresholds, versions and how often it alerted.
• Create rule (/monitoring/rules/new): the guided builder. Start from a plain-English description (AI draft), a built-in scenario or a blank rule; choose what to watch; build conditions; check thresholds; review the sentence and backtest; Submit for approval. An approver — never you — activates it. See Build a monitoring rule and get it approved.
• Backtest (/monitoring/backtest) and Rule performance (/monitoring/performance) explain noisy rules before you ask for a change.

7. Customers and KYC

• Customers (/customers): search by the start of any name or an exact identifier (national ID, KRA PIN, phone, account or customer number); filter by risk band, KYC status, PEP, sanctions, country, branch, onboarding date, reviews due or expiring IDs. Identifiers are masked; Reveal on a profile is recorded.
• Accounts (/accounts): search by account number or owner.
• Customer profile: KYC details, identity documents with expiry, addresses, contacts, accounts, risk breakdown, screening, alerts and cases, transactions and history.
• Changing KYC (senior analysts and above): Edit KYC details, enter the change and the reason, Send for approval. Nothing changes until a second person approves. See Propose and approve a KYC change.

8. For senior analysts

• QA review (/qa): sampled closures — at least one per bulk batch. Pass them, or Return for rework with what needs reworking; the alert reopens with its history. You cannot QA your own closure.
• Bulk close on the queue: for scenarios your alert-work policy allows, close a batch with one reason code and a Batch rationale.
• Screening checker: confirm or reject proposed true matches and proposed clears with step-up, from Awaiting a checker or My approvals.
• Case supervision: reassign cases, take over escalations and review cases at the Review stage.
• Alert-work policy: propose changes to SLA windows, QA sampling and bulk-close scenarios; another supervisor approves.

9. Controls you will meet

• Step-up: a fresh authenticator code or passkey before sensitive actions such as confirming a true match. Valid for five minutes.
• Maker-checker: the person who proposes is never the person who approves. FlowSentry enforces this on the server: "The approver must be a different person from the author (segregation of duties)."
• Audit trail: everything you do on a governed record is attributed to you in a tamper-evident log.
• Read-only views: some colleagues (auditors, QA reviewers) can see the queue but not act.

10. Tips

• Check the customer's profile before closing an alert or clearing a hit — context resolves most false positives.
• Write rationales for a reviewer who was not there: what you checked, what you found, why it explains the activity.
• Use backtests to understand why a rule is noisy before asking for it to be tuned.
• Learn the palette: Ctrl+K then a case number is the fastest way back to your work.

Related

• Analyst and senior analyst
• Investigate an alert end to end
• Use AI assistants responsibly