Conducting and Supporting the Investigation Process
From alert to disposition
Investigations begin from many sources: automated monitoring alerts, sanctions and watchlist hits, branch or employee referrals, negative media, law enforcement enquiries, and internal audit findings. The workflow is consistent - triage and prioritisation, information gathering, analysis, escalation, decision, documentation, and closure or reporting.
The analytical core is comparison against expectation. Gather the customer's KYC file, expected-activity profile, prior alerts, account history, beneficial ownership, and any adverse media. Then ask whether the observed activity is consistent with that profile and, if not, whether the customer's explanation holds up against documents rather than assertions. Consider source of funds and source of wealth where risk is elevated.
Worked example: a monitoring rule flags repeated round-dollar transfers between the subject and two entities sharing a registered address. The investigator confirms the entities are not disclosed in the KYC file, obtains the originating funds' documentation, and finds invoices for goods that no shipping record supports. That gap - not the transfer pattern alone - justifies escalation and a suspicious transaction report.
Traps: investigators should not contact the subject or tip off anyone about a report; a filed report does not establish criminality and needs no proof of a predicate offence, only reasonable suspicion; closing an alert requires a written, reasoned rationale that a reviewer could follow; and a law-enforcement request should be routed through the proper channel rather than answered informally by the investigator. Documentation must be contemporaneous - reconstructed notes are a recurring criticism.
The narrative should address who, what, when, where, why and how, in plain language, describing observed facts and why they are unusual, and avoiding conclusory legal characterisations. Retain supporting workpapers under the applicable retention rule.