Inside an AML alert: from pattern to report

Banks run monitoring systems that watch every account for patterns linked to money laundering: deposits kept just under a reporting threshold, funds that arrive and leave within a day, transfers through a chain of new parties. When a rule fires, it creates an alert. An analyst then has to answer one question: is this activity suspicious, or is there an ordinary explanation?

Most alerts turn out to have an ordinary explanation. That is not a failure of the system; it is the job. The skill is telling the two apart, quickly, and writing it down so it holds up.

1. The rule fires and the alert lands in the queue
2. Read the pattern the rule saw
3. Test it against who the customer is
4. Pull the full evidence
5. Decide, and document it inside the deadline

1. Name the pattern, by its proper name

Monitoring rules are written for known typologies. Structuring (splitting deposits to stay under a reporting threshold), rapid movement of funds, funnel accounts, and unusual cash activity for the type of business are common ones. An analyst who can name the pattern, and point to at least two transactions that show it, starts from solid ground.

2. Measure the money trail against the customer

Every customer file says what activity to expect: a payroll account, a small restaurant, a retiree living on a pension. The question is whether the alert's activity fits that picture. A restaurant depositing cash every evening is normal. A retiree receiving wires from five new senders in a week is not.

Find the figure the activity contradicts: the expected monthly volume, the stated occupation, the usual counterparties. That contradiction is the core of the case.

Anti-money laundering desk

3. Pull the full evidence before you decide

A decision made on the alert alone is a decision made on half the facts. Before writing anything, an analyst opens:

• The customer file and how the account was opened
• The other parties on the transactions, and what is known about them
• Earlier alerts and earlier reports on the same customer
• Any adverse media or screening hits

Then quote at least one specific transaction in the decision, and say what would have changed your mind.

4. Decide inside the deadline

If the activity is suspicious, the bank files a Suspicious Activity Report (SAR) with FinCEN, the U.S. Treasury's financial intelligence unit. The clock is set in regulation, not by the bank.

Missing that deadline is a regulatory finding in its own right, whatever the outcome of the case. That is why analysts work their queue by clock and risk, not by the order alerts arrived.

5. Write the report a regulator can follow

The narrative of a SAR is the part law enforcement actually reads. A good one answers who, what, when, where, why and how, in order, in plain language. It sticks to facts and the analyst's reasoning, and it does not speculate beyond the evidence.

The rule you never break: no tipping off

Federal law prohibits telling the customer, or anyone involved, that a SAR has been filed or is being considered. Even a hint, such as "we're looking into some unusual activity on your account", can compromise an investigation. Strong analysts write every customer-facing note with that in mind. The rule sits in the Bank Secrecy Act at 31 U.S.C. 5318(g).

Good AML work is not suspicion. It is a clear, documented reason, reached on time, that someone else could check.

Getting into AML

AML analysts come from banking operations, customer service, audit and law enforcement. Employers look for careful reading, structured writing and comfort with deadlines. To build those:

• Read how the work is judged in our Anti-money laundering guide.
• Work alerts on the Anti-money laundering desk, where each decision is graded and saved to your Shift Record.
• Browse FinCEN's own guidance library to learn the vocabulary the job uses.

Sources and further reading

• 31 CFR 1020.320, reports by banks of suspicious transactions.
• 31 U.S.C. 5318, including the confidentiality of reports in subsection (g).
• FinCEN, Guidance.
• Zeloric, Anti-money laundering guide and desk.