Investigations Fundamentals
Investigations Fundamentals
This domain tests whether you can distinguish an alert from a case, frame a defensible investigative question, and run the investigative cycle from intake to conclusion. The exam probes process knowledge, but weighs judgement more heavily: what an investigator may conclude, on what standard, and what must be written down.
Core rules
- An alert is a system-generated or referred signal. A case is a managed investigation with an owner, a scope and a documented outcome. Escalating an alert does not create a finding, and closing one does not clear the customer.
- Investigations are hypothesis-driven. State the hypothesis, list the evidence that would confirm or refute it, then go and test both.
- Standards differ. The internal threshold - reasonable grounds to suspect - sits far below the criminal standard of beyond reasonable doubt. Your job is to decide whether suspicion is reasonable and whether reporting is required, not to prove an offence.
- Two families of work: reactive (alert, referral, law enforcement request, subpoena) and proactive (thematic reviews, lookbacks, typology sweeps).
- The cycle: intake, scoping, evidence collection, analysis, conclusion, reporting and escalation, then closure and remediation.
- Documentation must let an independent reviewer reconstruct the reasoning without speaking to you.
Worked example
A business customer deposits $9,200 in cash on three consecutive Fridays, then wires $27,000 to a supplier in a country the customer profile never mentions. Hypothesis one: structuring to stay below the $10,000 reporting threshold. Hypothesis two: ordinary cash-intensive retail receipts. Test: does the CDD file describe cash-intensive activity, is there a year of consistent cash banking, do invoices match the wire? If the file records a software consultancy with no cash activity, hypothesis one stands and the case goes to reporting consideration. If it records a bakery, the deposits may be explained - but the unexplained wire still needs verification against the profile.
Traps that cost marks
- Writing "no evidence of criminality" as a closure reason when the standard is suspicion, not proof.
- Confirmation bias: collecting only what supports the first hypothesis.
- Letting the alert scenario define the scope, so alternatives are never tested.
- Treating a law enforcement "no action" response as exoneration of the customer.