Investigate an alert end to end

This tutorial follows one alert from the moment it lands in your queue to one of two endings: you close it because the activity is explained, or you open a case, investigate and record suspicion for the MLRO. It takes about 20 minutes the first time.

Before you start

• You need the Analyst or Senior analyst role (the MLRO and Deputy MLRO can do the same).
• Have your authenticator app to hand. You will not need step-up in this tutorial, but you may later.
• Screening hits are worked separately on Hits (/screening); this tutorial covers monitoring alerts.

Step 1: Pick up an alert

1. Open Work › Alerts & cases (/alerts).
2. Choose a view: My work (alerts assigned to you), Team or Unassigned.
3. Select Claim next to take the highest-priority unassigned alert, or open any alert and select Claim. The alert moves to My work and colleagues can see it is yours.

Each row shows the subject, a Priority (High, Medium or Low), the SLA chip (On track, Due today, Due soon or Overdue) and when the alert was raised. Work the overdue and high-priority alerts first.

Tip: If you cannot finish an alert, select Release to return it to the unassigned queue rather than leaving it parked under your name.

Step 2: Understand why it fired

Open the alert to see its drawer:

• Rule and version, the typology and severity.
• Thresholds against actuals: each condition with your institution's threshold and the value that crossed it, in your base currency with the exchange rate used.
• Window: the period the rule looked at.
• Trigger transactions: the transactions that tripped the rule.
• Related alerts on the same subject over the last 90 days.

Select Summarise with AI for a plain-language reading: why it fired, the customer's risk context, a suggested outcome and reason code, and the facts it relied on. It is labelled AI draft — advisory. Treat it as a second opinion, not a decision.

Step 3: Gather context

1. Open the customer's profile (from the subject name) to check KYC details, occupation or business activity, expected turnover, accounts, risk band and screening results.
2. Look at the customer's other alerts and cases.
3. For networks of payments, open Link analysis (/cases/link-analysis) to map counterparties and flows around the customer. Double-click a node to expand it.

Ask yourself: is the activity consistent with what we know about this customer? A harvest-season cash deposit from an agricultural supplier may be explained; ten unrelated senders paying a student who cashes out at six agents is not.

Step 4a: Close the alert if the activity is explained

1. In the drawer, under Close this alert, choose the Outcome: No suspicion (activity explained) or Inconclusive.
2. Choose a Reason code from your institution's catalogue.
3. Write a Rationale of at least 20 characters that a reviewer can follow: what you checked and why it explains the activity. If you used the AI summary, Use as rationale fills the fields — edit them before you save.
4. Select Close alert.

A sample of closures goes to QA review. If a reviewer returns yours, the alert reopens with the badge "Returned by QA — rework" and its history.

Step 4b: Open a case if it needs investigation

1. On the queue, tick the alert (and any related alerts on the same subject).
2. Give the case a title and select Open case.
3. The case opens at the Triage stage. Use Advance to Investigation when you start working it.

Step 5: Investigate in the case

Work through the tabs:

Tab	What to do
Overview	Select Investigate with AI. The Sentry Agent reads the case through read-only tools and drafts a memo: summary, evidence with citations to the records, typology assessment, recommendation and confidence. Review it, then Add to case notes if useful. Summarise case gives a handover-style summary.
Alerts	All alerts on the case, with their explanations.
Transactions	The subject's transactions, newest first. Tick the ones a report must include and Save STR selection.
Parties / UBO	Directors, owners and related parties. Open a profile in the side drawer.
Screening	The subject's screening results.
Documents	Attach evidence. Files are scanned before use and encrypted at rest.
Notes	Record what you checked and found. Add note.
Requests (RFI)	Ask a question of the relationship manager. Ask only for facts — never mention suspicion, an alert, an investigation or a report.
History	Every action on the case, by named user.

If the case needs a senior opinion, use Escalate with a reason and select Escalate to Review, or Hand over the case to a colleague.

Step 6: Record suspicion (if you have grounds)

1. Open Suspicion & STR.
2. Write your Grounds for suspicion (at least 20 characters) and select Record suspicion. The suspicion clock starts and the case appears on the MLRO's desk with a decision due date.
3. In STR draft, choose the Report type (STR for specific transactions, SAR for activity with no transactions), then use Draft narrative with AI for a Who / What / When / Where / Why / How narrative. Use draft fills the narrative field with the badge "AI draft — edit before saving". Edit it, tick the report indicators and select Save STR draft.

You can refine the draft until the MLRO decides. Continue with Draft and file an STR to see what happens next.

Warning: Once a case involves an STR it becomes STR-restricted: only STR-privileged roles and the people already on the case can see it. Never discuss it with the customer or with colleagues outside the investigation.

If the case is not suspicious

Record your conclusion in a note and advance the case through Review to Closed. A closed case keeps its full history and rejects new evidence.

Related

• Analyst guide
• Use AI assistants responsibly
• Status and badge meanings