AML Alerts Are Not Fraud Findings. The Difference Is the Case File, the Authority and the Clock.
Transaction monitoring can detect patterns that deserve inquiry; fraud operations must often decide quickly whether an account or payment should move. The operational join is the case record that allows an alert to inform a control without quietly becoming a verdict.
The rule
An alert is a question with evidence attached, not an answer with a customer attached.
The Alert Has Not Made Up Its Mind
An account on your books receives four cash deposits of $9,800 over 8 days.
It then sends $38,900 by wire to a new overseas counterparty.
Somewhere in your monitoring estate, a rule notices that the deposits sit just below the currency-transaction reporting threshold, that the cash aggregates neatly, that the beneficiary is new, and that the funds have developed a brisk interest in foreign travel.
The rule produces your alert.
It has not discovered money laundering.
It has not discovered fraud.
It has certainly not discovered that your customer is a bad person, though this is the point at which a dashboard begins to look rather pleased with itself.
It has done something more modest and more useful.
It has selected a pattern for your inquiry.
That distinction becomes awkward when the alert lands beside a payment your fraud team must decide whether to permit, pause, contact about, or investigate.
Fraud operations have a clock, a customer, a product promise, and an incoming queue that cannot all be treated as a minor seminar in criminal procedure.
AML has a reporting standard, a confidentiality obligation, an evidential narrative, and a decision that must not be made by pressing the large red button marked suspicious.
The operational join is the case file.
Not a shared label.
Not a score pasted from one dashboard onto another.
A case file.
A record in which one of your controls can offer evidence to another without quietly lending it an authority it does not possess.
Two Systems, Two Questions, One Inconvenient Customer
AML asks whether activity and context give you a reasonable basis for a reporting or continuing-control decision.
Its relevant facts are the amount.
The aggregation window.
The cash channel.
The beneficiary’s novelty.
The speed of movement.
Expected account behaviour.
Linked parties.
Stated purpose.
Payment narrative.
Geography.
Prior alerts.
Permitted adverse information.
A 90-day lookback may show six earlier near-threshold deposits.
It may instead reveal a stable seasonal pattern that your rather dramatic eight-day window had omitted.
Fraud asks you an entirely different set of questions.
Was a remote card payment a reasoned but fallible prediction about the cardholder?
Did a compromised session take over an account?
Did a customer send a push payment under a false belief? Is a synthetic identity behaving beautifully while constructing a future loss?
Not laundering typologies in a different font.
Different failures of evidence, authority and loss allocation.
Consider a login, followed by a phone-number change, followed by a payment to a newly added payee.
A sensible account-takeover signal, because your authentication is not permanent proof of who is operating an evolving account.
The signal still does not establish your customer’s actual authority, let alone a filing conclusion.
Conversely, the wire in the cash-deposit case may be an AML concern while the customer confirms a genuine supplier payment.
Both your files can be open.
Neither annexes the other’s conclusion.
There is a temptation to call this duplication.
It is not.
It is division of labour, which is the grown-up version of declining to ask one person to be dealer, referee and court reporter because the office is busy.
Build the File Before the Control Borrows Its Meaning
Do not store Alert = High.
That is not an investigation record.
It is an invitation to have one later, usually after a complaint, an examination, or the first email from Legal with a formidable distribution list.
The combined case wants eleven fields, complete rather than decorative: alert type; triggering transaction; customer profile; linked accounts; typology; fraud indicator; evidence; disposition; SAR decision; payment action; reviewer.
Alert type identifies your route in. Automated scenario.
Employee referral.
Law-enforcement request.
External advisory.
Another approved source.
The triggering transaction preserves the actual event, rather than your system’s later paraphrase.
The customer profile carries expected activity, stated business purpose, account age, usual turnover and your product relationship.
Linked accounts map your sources and destinations, including shared person, device, branch, account, beneficiary or return-flow connections.
Typology states the AML proposition you are testing.
Possible structuring.
Unusual rapid movement.
Mule activity.
Another governed pattern.
Fraud indicator states the separate fraud proposition.
Possible account takeover.
Push-payment deception.
Card-not-present misuse.
Synthetic identity.
Or no fraud indicator at all.
The absence of one is evidence too.
You need not accuse a customer of a whole crime family because a few data points sit adjacent on a screen.
Evidence carries dates, times, branches, account and transaction identifiers, payment messages, counterparties, exchange rates where relevant, previous alerts, customer documents, questions asked, answers received, and contradictions found.
An invoice, a shipping record, a contract, a normal gross margin or a credible explanation can weaken your concern.
A missing response is a fact. It is not automatic proof.
A plausible response that conflicts with the sequence is also a fact.
That is what investigation means, when it is not merely colouring in the alert.
Disposition, SAR decision, payment action and reviewer then stop the record becoming an account of a feeling.
A case can close as explained.
Close as duplicate.
Continue monitor.
Restrict.
File.
Escalate to another internal control.
The SAR field records file or no-file, and the decision maker.
The payment-action field records permit, delay, reject, contact, restrict, release, or the applicable product action.
The reviewer field names the person in your firm who applied the authority.
Where a case cannot say who made which decision, it has achieved the usual institutional miracle.
Action without agency.
The Clocks Do Not Agree, Which Is Why They Need Names
Your fraud desk works at transaction speed.
A remote payment, a profile change or a cash-out request may need an immediate risk action while the evidence is still warm and the customer can still use the product.
That urgency does not let your fraud operations declare a customer a launderer.
It lets the authorised risk owner take the payment action policy allows, and record why.
Your AML timetable is different.
For a US bank, transactions conducted or attempted by, at or through the bank that aggregate to $5,000 or more can require a SAR, where the bank knows, suspects or has reason to suspect money laundering or other illegal activity, evasion, or no apparent lawful purpose after review.
That figure is a reporting threshold on you. It is not a moral sorting hat.
A transaction a dollar below it can matter inside a broader pattern. A very large one does not file itself merely by being impressive.
US rules generally require filing within 30 calendar days of initial detection of facts that may form a basis for filing. Where no suspect is identified, the period can extend, and not beyond 60 calendar days.
The important clock does not necessarily start when your first rule fires.
It starts after your review, and your determination that activity is suspicious.
An alert is a signal to begin the work.
It is not a clever way of starting the stopwatch before anybody has opened the file.
There is a separate UK branch, where a firm seeking a Defence Against Money Laundering before proceeding enters a statutory notice period of 7 working days.
That may decide whether your particular act proceeds.
It is not the ordinary filing path, and it is not a portable payment-hold rule for every country, product and customer relationship.
Liability and remediation travel especially badly.
The same loss can sit in a consumer debit transfer, a consumer credit-card purchase, a corporate wire, a card-network dispute, an insurance claim, or a civil contract claim.
It is astonishing how quickly a universal answer becomes an expensive memo.
Facts, Inferences, and the Small Matter of Due Process
Your case narrative leads with the reason for concern.
Then chronology.
Amounts.
Identifiers.
Explanations or contradictions.
Linked entities.
Continuing concerns.
The business sent a wire twenty-five minutes after the last deposit is an observed fact.
The business structured cash to fund illicit activity is an inference.
The first belongs in your record, because it can be checked.
The second may be a reasonable working hypothesis.
It must never masquerade as a completed finding merely because it acquired a dropdown value.
This matters even more in fraud.
A browser can post an order.
An authenticator can return an approval.
A device can download content.
A transfer instruction can be accepted.
Those prove to you that something happened.
They are much weaker evidence of why.
A person can use your customer’s phone.
A customer can act under a fabricated emergency.
A family member’s authority can have changed.
System telemetry is very good at dates and rather less gifted at conversations.
Regulation E makes the point in an unfashionably concrete way.
Its consumer-liability approach has tiers, including up to $50, up to $500, and potentially an unlimited amount, depending on reporting circumstances.
A legal allocation under stated conditions.
Not a technical theorem that a correct authentication event settles a dispute.
The 60-calendar-day statement rule likewise has triggering conditions and consequences.
It is not a slogan for a call-centre wall.
So the proper customer communication is an approved service explanation for any delayed or rejected transaction, or any change in access, while preserving filing confidentiality.
Your case retains what was communicated, when, and by whom.
A confidential report does not make a later complaint, dispute or remediation obligation disappear.
It merely ensures you can enjoy two processes at once, as institutions so often do.
A Queue Is Not a Measure of Quality
Alert counts are the favourite metric of systems not yet prepared to explain themselves to you.
One scenario can produce 400 alerts and 2 worthwhile escalations, because an incoming field was misclassified.
Your remedy is data repair.
It is not a higher threshold applied with the solemn confidence of a man turning down a thermostat.
The useful dataset is your full disposition history.
Explained.
Duplicate.
Continuing monitor.
Restricted.
Filed.
Escalated.
Add the fraud outcomes.
Approval rate.
False positives.
Complaint rates.
Conversion.
Recoveries.
Harm prevented.
A system that declines every remote purchase drives your counted card-not-present fraud toward zero while making the product unusable.
That is not security.
It is an unusually committed way of declining to provide a payment service.
Classify your failures before repairing them.
A false positive can arise from a legitimate new device.
Travel.
Poor connectivity.
A cash-intensive business.
A normal small card-verification charge.
Stale customer context.
A duplicate alert.
A poor linkage rule.
A human decision applied too broadly.
A missed concern can arise because intermediary information, reversals, international-payment fields or a detection route were simply absent.
The control changes only through governed testing, approval, implementation and retained results.
Moving an aggregation window from 7 days to 30 changes detection, workload and effective risk appetite.
It deserves an owner. Not a quiet Friday afternoon.
The Ladder, Because the Word Fraud Has Started Doing Too Much Work
Transaction fact?
Read your payment records.
Suspicious-pattern detection?
Go to your AML monitoring.
Unauthorised-use assessment?
Send it to your fraud team.
Account restriction?
Find the authorised risk owner.
SAR filing?
Give it to your AML officer.
Customer remediation?
Apply your product and dispute rules.
Manual override?
Demand a named senior approver.
A small discipline.
It keeps an AML case from becoming an unauthorised fraud verdict, a fraud signal from becoming a confidential-reporting decision, and a hurried payment control from becoming an evidential bonfire.
Which is as close to elegance as this particular corner of the machine is likely to get.
An alert is a question with evidence attached, not an answer with a customer attached.
What the paper establishes
- An AML alert is a prompt for review rather than a finding of money laundering, fraud, criminal intent, or customer liability.
- A combined investigation record requires eleven fields: alert type, triggering transaction, customer profile, linked accounts, typology, fraud indicator, evidence, disposition, SAR decision, payment action, and reviewer.
- AML suspicion, an unauthorised-use assessment, an account restriction, a SAR filing, and customer remediation belong to different decision layers with different authorised owners.
- A US bank SAR decision can apply to transactions aggregating to $5,000 or more when the applicable suspicion standard is met; the amount is not a safe harbour or an automatic filing rule.
- Payment holds and fraud interventions must preserve customer and transaction evidence and be coordinated with product-specific dispute and remediation obligations.
- Alert quality is measured through dispositions and error outcomes, including explained alerts, duplicates, continuing monitoring, restrictions, filings, false positives, and customer-impact measures.
Questions
- What is an AML alert, exactly?
- An AML alert is a system- or human-generated prompt to review activity that matches a monitoring scenario or other concern. It is not a finding that money laundering occurred, that a customer committed fraud, or that a payment is unauthorised. The case begins by preserving transaction and customer-context evidence, then testing competing explanations and recording a distinct disposition.
- Does an AML alert mean the customer has committed fraud?
- No. AML monitoring asks whether activity may warrant investigation or reporting for suspected laundering, terrorist financing, BSA evasion, or another reportable concern. Fraud operations ask different questions, such as whether a payment is unauthorised, an account was taken over, or a customer acted under deception. The same transaction can be relevant to both processes without resolving either one.
- What has to be in the case file before an alert affects a payment?
- The investigation record identifies the alert type, triggering transaction, customer profile, linked accounts, typology, fraud indicator, evidence, disposition, SAR decision, payment action, and reviewer. Supporting evidence can include dates, times, account and transaction identifiers, payment messages, counterparties, relevant exchange rates, prior alerts, customer explanations, and the rationale for any escalation, restriction, release, or closure.
- Who decides whether a suspicious-activity report is filed?
- An authorised AML decision maker determines whether the investigated facts meet the applicable suspicious-activity reporting standard, whether another report is required, and which accounts or persons must be named. The record distinguishes observed facts from inference and documents a file or no-file decision. A fraud analyst or payment-operations colleague can supply evidence, but does not acquire SAR authority by raising an alert.
- Does a payment over $5,000 automatically require a SAR?
- No. For a US bank, transactions conducted or attempted by, at, or through the bank that aggregate to $5,000 or more can be reportable when the bank knows, suspects, or has reason to suspect specified illicit activity, BSA evasion, or no apparent lawful purpose after review. The threshold is part of a jurisdiction-specific test, not a conclusion about the customer.
- When does the SAR filing clock start?
- US rules generally require a bank to file within 30 calendar days of initial detection of facts that may form a basis for filing. If no suspect is identified, the period can extend but not beyond 60 calendar days. The relevant point is not necessarily the first automated alert; it follows an appropriate review and a determination that the activity is suspicious.
- Can an AML case put a payment on hold?
- An AML case can inform a payment action, but a hold or restriction requires authority under the applicable policy, contract, law, and product process. An ordinary SAR filing does not automatically freeze funds. In the United Kingdom, a firm seeking a Defence Against Money Laundering before proceeding with a suspect transaction enters a statutory notice period of 7 working days, which is a separate route from ordinary SAR filing.
- Does a successful login or authentication settle a fraud dispute?
- No. Authentication shows that a session presented a recognised factor; it does not conclusively establish that the person was the legitimate account holder or understood the payment’s purpose. A fraud model can flag a $2,200 transfer after a phone-number change, but actual authority can depend on conversations, coercion, timing, customer contact, preserved logs, and a stated decision rationale.
- Why can a customer dispute and an AML case both be open?
- A customer dispute concerns a payment, account access, product rule, or loss-allocation question. An AML case concerns whether transaction activity and context meet a separate suspicion and reporting standard. A recipient account receiving ten unrelated $300 credits can be relevant to an APP reimbursement inquiry, while deciding whether that pattern forms a laundering typology or requires a SAR remains an AML determination.
- What are the useful dispositions for an AML alert?
- A useful disposition taxonomy separates close as explained, close as duplicate, continue monitor, restrict, file, and escalate to another internal control. These outcomes prevent alert counts from masquerading as risk findings. They also show whether a scenario identifies meaningful concerns, produces repeat work, requires a payment control, or supplies evidence for an authorised suspicious-activity reporting decision.
- How is alert quality measured without rewarding overblocking?
- Alert quality is measured by the disposition and downstream outcome, not by raw volume alone. Relevant measures include explained alerts, duplicates, continuing monitoring, restrictions, filings, approval rate, false positives, complaint rates, conversion, recoveries, and harm prevented. A control that blocks every legitimate remote purchase can reduce counted fraud while making the product unusable, which is not a successful control.
- What should staff tell a customer when an AML review affects an account?
- Staff use an approved service explanation for a delayed or rejected transaction or a change in account access, while preserving SAR confidentiality. The case records exactly what was communicated, when, and by whom. That record matters because an unexplained operational action can create a separate complaint, contractual dispute, or remediation obligation even when the AML investigation remains confidential.