Alert Triage

Assigns a composite risk score to each generated alert based on weighted factors including transaction amount, entity risk rating, and anomaly severity. Alerts are bucketed into high, medium, and low priority queues.

• Dynamic thresholds adjust sensitivity based on investigator capacity
• Integrates entity risk profiles from KYC and CDD systems
• High-priority alerts trigger immediate escalation to senior investigators
• Example: A $500k wire to a high-risk jurisdiction with a new beneficiary scores 95/100 and jumps the queue

Applies rule-based and machine learning filters to suppress alerts generated by known benign patterns before they reach investigator queues. This prevents alert fatigue and preserves investigative resources for genuine threats.

• Whitelisting of trusted counterparties and internal accounts
• Pattern matching against historical false positive signatures
• Contextual suppression using transaction purpose codes and memos
• Example: Recurring payroll payments to vetted employee accounts are auto-closed as non-suspicious

Automatically augments raw alerts with contextual data from internal and external sources to accelerate investigator decision-making. Enrichment eliminates manual data gathering and provides a 360-degree view of the alerted entity.

• Pulls beneficial ownership structures and corporate hierarchies
• Integrates adverse media and sanctions list hits
• Appends 12-month transaction history and peer group comparisons
• Example: An alert on a shell company is enriched with its ultimate beneficial owner, recent negative news, and a network graph of connected entities

Distributes enriched alerts to the most appropriate investigator or team based on skills-based routing rules, workload balancing, and jurisdictional requirements. Ensures the right alert reaches the right analyst at the right time.

• Routes by product type, risk category, or geographic region
• Load balancing prevents queue overflow for individual investigators
• Jurisdictional routing ensures compliance with local filing requirements
• Example: Trade finance alerts route to specialized TBML investigators, while retail alerts go to the consumer fraud team

Leverages supervised machine learning models trained on historical investigator decisions to automatically disposition low-complexity alerts without human intervention. Only ambiguous or high-risk cases escalate for manual review.

• Models learn from historical SAR filing decisions
• Confidence thresholds determine auto-close vs. escalation
• Full audit trail maintained for regulatory examination
• Example: A $200 domestic transfer matching a known salary pattern is auto-closed with 98% confidence, while an unusual cross-border transaction escalates

Provides operational dashboards and analytics on triage performance, including alert volumes, disposition rates, investigator productivity, and model drift indicators. Closed-loop feedback from investigator decisions continuously refines scoring models.

• Tracks alert-to-SAR conversion rates by rule and model
• Identifies rules generating excessive false positives for tuning
• Active learning pipelines incorporate investigator labels back into training data
• Example: A rule generating 10,000 monthly alerts with a 0.1% SAR conversion rate is flagged for immediate threshold adjustment

The real-time engine that generates the alerts feeding the triage queue. These systems apply predefined rules and machine learning models to analyze financial transactions as they occur, flagging deviations from expected behavior.

• Rule-based scenarios: Velocity checks, threshold breaches, and geographic anomalies
• ML-driven detection: Unsupervised anomaly scoring and behavioral deviation alerts
• Output: Raw alerts that require prioritization by the triage layer

The primary objective of alert triage is suppressing false positives before they consume investigator time. Advanced triage systems apply secondary scoring models to filter out noise generated by overly sensitive detection rules.

• Secondary scoring: Re-scoring alerts with richer contextual features
• Threshold optimization: Dynamically adjusting alert thresholds based on segment risk
• Whitelist management: Maintaining exception lists for known legitimate patterns
• Typical reduction target: 70-90% of raw alerts suppressed before human review

The digital workflow backbone that receives promoted alerts from the triage system. Once an alert is deemed high-risk, it is converted into a case with a structured lifecycle.

• Alert-to-case conversion: Automated population of entity profiles and transaction evidence
• Investigator workflow: Queuing, assignment, and collaborative review tools
• Audit trail: Complete documentation of every action for regulatory examination
• SAR filing integration: Direct linkage to regulatory submission systems

A foundational AML principle mandating that triage resources be allocated proportionally to risk. Alert triage systems operationalize this by assigning priority scores that reflect both the likelihood of suspicious activity and the potential severity.

• Customer risk rating integration: Higher-risk customers receive lower alert thresholds
• Product risk weighting: Correspondent banking alerts prioritized over retail alerts
• Jurisdictional risk factors: Transactions involving high-risk geographies escalated automatically
• Aligns with FATF Recommendation 1 and national regulatory expectations

Triage systems enrich individual alerts with relational context by examining the transactional graph surrounding the flagged entity. An alert that appears low-risk in isolation may be escalated when linked to known suspicious networks.

• Link analysis: Identifying hidden connections to previously flagged entities
• Cluster detection: Recognizing coordinated structuring across multiple accounts
• Graph embeddings: Using neural representations to score network-level anomaly
• Transforms isolated alerts into intelligence-led investigations

The ultimate regulatory output of the triage process. Only alerts that survive triage filtering and full investigation culminate in a SAR filing. Triage effectiveness is measured by the SAR conversion rate and regulatory feedback.

• Defense against liability: Documented triage rationale protects institutions
• Timeliness requirements: Most jurisdictions require SAR filing within 30-60 days of detection
• Quality metrics: Regulatory agencies assess whether filed SARs are useful and actionable
• A well-tuned triage system maximizes high-quality SAR output while minimizing wasted effort