Reporting, Investigation and Escalation
Domain 7 tests the path from alert to report: how cases are investigated, when suspicion crystallises, what a good STR narrative contains, and how escalation, tipping-off and continuing activity are handled.
The investigation lifecycle
An alert becomes a case when it cannot be dispositioned at triage. The case file should record the customer profile, the activity reviewed, the period and scope, documents obtained, adverse media and screening results, and a reasoned conclusion. The decision is binary in principle: file or do not file. 'Insufficient evidence' is a conclusion that must be justified, not a default.
When suspicion arises
Suspicion is lower than proof. It is a reasonable belief, supported by facts, that activity may be criminal or that assets may be proceeds. Waiting for conclusive evidence is a recurring failure. Timing matters: reports should be filed promptly once suspicion exists, and continuing suspicious activity after filing should be reported further.
Narrative quality
A useful narrative answers who, what, when, where, why and how: the parties, the transactions with dates and amounts, the discrepancy with the expected profile, the explanation offered and why it did not satisfy the analyst, and what was reviewed. Vague narratives referencing 'unusual activity' are a supervisory finding.
Escalation and confidentiality
Internal escalation routes, decision logs and named approvers must be documented. Tipping off the customer is prohibited; so is revealing a report to third parties outside permitted disclosures. Records are retained per local requirements and made available to the FIU on request.
Worked example
A monitoring alert shows repeated deposits inconsistent with a declared grocery business. The analyst reviews invoices that lack customer names, a tax return showing turnover far below deposits, and site photos of a small shop. The explanation offered is 'family loans' with no documentation. The correct outcome is an STR: the facts are inconsistent, the explanation is unsupported, and waiting for proof of a predicate offence would delay reporting.
Traps that cost marks
- Requiring proof of a predicate offence before filing.
- Tipping off the customer or a third party about a report.
- Filing without a factual narrative or with unsupported conclusions.
- Assuming filing closes the matter; continuing activity needs ongoing handling.
- No documented escalation route or approval record.