Skip to content
Blueprint Catalog

    ↑↓ move · Enter open · Esc close

    03 — Value stream · VS-460

    Alert-to-Disposition

    Carry a money-laundering, sanctions or fraud alert from detection through triage and investigation to a decision, any report to the authorities and the action taken on the customer. Cyber security incidents are Threat Detection & Response (BC-760.30), outside this stream.

    • Alert-to-Case
    • Financial Crime Case Lifecycle
    • Detect-to-Report
    • AML Investigations Flow
    // FIG. 03 · Stage flow
    1Detect2Triage3Investigate4Decide & Act5Report6Tune Controls
    1. 01

      Detect

      VS-460.10

      Raise alerts from transaction monitoring, name and payment screening, and fraud scoring.

    2. 02

      Triage

      VS-460.20

      Clear obvious false positives quickly and send the rest to investigation by risk.

    3. 03

      Investigate

      VS-460.30

      Investigate the activity and the customer, refreshing due diligence where the picture has changed.

    4. 04

      Decide & Act

      VS-460.40

      Decide the case, block or reject a true sanctions match, restrict or exit the customer where needed, and reimburse fraud victims.

    5. 05

      Report

      VS-460.50

      File suspicious activity and large cash transaction reports, check their quality, and answer authority requests.

    6. 06

      Tune Controls

      VS-460.60

      Use outcomes to tune scenarios and thresholds, prove coverage, and validate the models behind them.