The Alert That Was Closed Too Fast
A retail bank's automated system generated an alert on a customer who had received eleven incoming transfers from six unrelated individuals over nine days, each just under a reporting threshold, followed by a single outgoing transfer to an overseas account. The alert was assigned to an analyst with fourteen months' experience and a queue of 90 open alerts. The analyst reviewed the customer's profile, saw a stated occupation of "consultant," noted that the transfers were below the threshold, and closed the alert as "no unusual activity" in eleven minutes. No narrative was recorded beyond that phrase. Four months later, a foreign authority's inquiry about the receiving account prompted a look back. The bank's own system had flagged the pattern, and the closure note gave no basis for review. The analyst says the queue pressure was intense and that the closure codes available did not include a category for "needs more information."
1. Assess the alert disposition as a control failure, identifying what was missing at the analyst, supervisory, and system levels.
Read the worked answer
At the analyst level, the disposition is indefensible on its own terms. Eleven incoming transfers from six unrelated parties in nine days, each just under a threshold, followed by a single outbound transfer abroad, is a textbook structuring and layering pattern. The analyst treated the absence of a single reportable transaction as the absence of risk, which inverts the logic: staying under the threshold is the signal, not the reassurance. Closing in eleven minutes with a four-word note means no reasoning was recorded and no hypothesis was tested.
At the supervisory level, the closure went unreviewed. A junior analyst with fourteen months' experience should have had closures sampled or escalated, particularly on a pattern alert. No one checked the note quality.
At the system level, two design gaps stand out. The queue of 90 open alerts created pressure to clear rather than investigate, and the closure codes offered no honest option for "insufficient information." When the only available codes are "no unusual activity" and similar, analysts will use them regardless of what they actually think. The system thereby manufactured false closures. The absence of a mandatory narrative field with a minimum standard compounded this.
2. Recommend changes to alert handling that would make this outcome less likely, without assuming unlimited resources.
Read the worked answer
Prioritise triage over volume. Introduce risk-based routing so pattern alerts, threshold-adjacent activity, and cross-border outflows go to experienced analysts, while simpler alerts go to a standard queue. This costs nothing but a rule set.
Fix the closure taxonomy. Add codes for "escalated for further information," "referred to investigation," and "customer contact required," and require a narrative that states the hypothesis considered and why it was rejected. A minimum narrative standard, enforced by the system, prevents four-word closures.
Add supervisory review proportionate to risk: all pattern-alert closures reviewed before finalisation, plus a monthly sample of routine closures. Track quality metrics such as time-to-close distribution, narrative length, and reopen rate, and treat unusually fast closures as a flag rather than a virtue.
Address queue pressure directly. If the queue is consistently at 90, either staffing or alert tuning is wrong. Review the alert rules for precision, and where tuning reduces noise, redeploy the saved time into quality review. Finally, give analysts a documented escalation path and make clear that escalating is not a failure metric. None of these require a large budget; they require deliberate design.
3. The bank must respond to the foreign authority's inquiry. Outline the approach and the judgement calls involved.
Read the worked answer
The response should be accurate, complete, and timely, and it should be built on preserved evidence. First, freeze and preserve the alert record, the customer file, transaction data, and the analyst's and supervisor's records. Second, establish the facts: what the customer did, what the bank knew, what it should have known, and whether any report was filed or should now be filed.
Judgement calls arise immediately. The bank must decide whether the activity now warrants a report to its own financial intelligence unit, which it almost certainly does, and whether to file late or treat the earlier closure as the relevant point. It should not obscure the earlier missed alert; concealment is far worse than the original error. It must decide how much internal analysis to share, balancing cooperation against legal privilege and local disclosure rules, and should take legal advice on that boundary.
The tone matters. The response should acknowledge the pattern, explain what the bank's system detected, and describe the remediation already underway, without speculating beyond the evidence. It should name a single point of contact and meet the authority's deadlines. Internally, the bank should treat the matter as a lesson: the inquiry revealed a control that detected but did not act, and the fix belongs in the disposition process, not just in this file.