{"version":"0.35.0","built_at":"2026-10-24T11:24:42.001Z","license":"CC BY 4.0 © Mike Reams","canonical":"https://catalog.mikereams.com","value_stream":{"id":"VS-460","name":"Alert-to-Disposition","industries":["financial-services"],"description":"Carry a money-laundering, sanctions or fraud alert from detection through triage and investigation to a decision, any report to the authorities and the action taken on the customer. Cyber security incidents are Threat Detection & Response (BC-760.30), outside this stream.","outcome":"Every alert is closed with a documented decision, required reports are filed on time, and detection rules are tuned from what was learned.","trigger":"A monitoring scenario, screening hit, fraud score, staff referral or authority request raises an alert.","aliases":["Alert-to-Case","Financial Crime Case Lifecycle","Detect-to-Report","AML Investigations Flow"],"stages":[{"id":"VS-460.10","order":1,"name":"Detect","description":"Raise alerts from transaction monitoring, name and payment screening, and fraud scoring.","capability_ids":["BC-1770.20","BC-1770.30","BC-1770.40"],"events":[]},{"id":"VS-460.20","order":2,"name":"Triage","description":"Clear obvious false positives quickly and send the rest to investigation by risk.","capability_ids":["BC-1770.20","BC-1770.30","BC-1770.40"],"events":[]},{"id":"VS-460.30","order":3,"name":"Investigate","description":"Investigate the activity and the customer, refreshing due diligence where the picture has changed.","capability_ids":["BC-1770.20","BC-1770.30","BC-1770.40","BC-1770.10"],"events":[]},{"id":"VS-460.40","order":4,"name":"Decide & Act","description":"Decide the case, block or reject a true sanctions match, restrict or exit the customer where needed, and reimburse fraud victims.","capability_ids":["BC-1770.20","BC-1770.30","BC-1770.40","BC-1710.20","BC-1770.10"],"events":[]},{"id":"VS-460.50","order":5,"name":"Report","description":"File suspicious activity and large cash transaction reports, check their quality, and answer authority requests.","capability_ids":["BC-1770.50"],"events":[]},{"id":"VS-460.60","order":6,"name":"Tune Controls","description":"Use outcomes to tune scenarios and thresholds, prove coverage, and validate the models behind them.","capability_ids":["BC-1770.20","BC-1780.50"],"events":[]}]}}