Investigations and Reporting
Investigation lifecycle
An investigation converts an alert or referral into a documented, defensible conclusion. Understand the lifecycle: intake and triage (severity, deadlines, jurisdiction), scoping, evidence collection, analysis, escalation or closure, remediation, and quality assurance. Evidence must be relevant, reliable, and preserved through chain of custody for documents and devices, contemporaneous notes, and immutable audit trails. Interviews should be planned, non-accusatory where appropriate, and documented.
Traps
A common wrong answer is closing an alert because the customer seemed credible. Another is altering or backdating records; corrections must be transparent, dated, and attributable. Confidentiality and tipping-off rules limit what can be told to the customer, but internal escalation and legal or regulatory reporting still proceed. Reports are not narratives of everything known; they answer who, what, when, where, how, and why the activity is suspicious, in plain language, with supporting facts and amounts. Do not confuse an internal investigation with an audit or a law enforcement inquiry.
Worked example
A suspicious activity report narrative should state the customer and accounts, dates and amounts, the activity observed (for example, repeated transfers to high-risk jurisdictions inconsistent with the stated business), why it is suspicious, and what was reviewed. It should not declare the customer guilty.
Rule of thumb
If it is not documented, it did not happen: write every case as if a regulator will read it.