14.1 The Alert Investigation Process: From Unusual to Suspicious and When to Escalate
Key Takeaways
Unusual activity departs from the customer's expected pattern; suspicious activity is backed by facts that give reasonable grounds to suspect crime or evasion.
US SAR rules cover transactions where the institution knows, suspects or has reason to suspect illegal funds, evasion, no apparent lawful purpose, or facilitation of crime.
In England and Wales, R v Da Silva (2006) held that suspicion means a possibility that is more than fanciful, which is a low threshold.
Investigators should escalate when red flags stay unresolved, when sanctions, PEP or insider links appear, or when activity matches a known typology.
CAFCA sub-topic 3.5 covers the investigatory process for alerts, including determining unusual and suspicious activity and determining escalation. The exam rewards a structured, documented, timely process that never tips off the customer.
Unusual versus suspicious
- Unusual: the activity departs from what was expected for this customer, or from their peer group. Examples are a sudden spike, a new corridor, or an odd time of day. Unusual activity is a reason to look, not a conclusion.
- Suspicious: after review, the facts give reason to suspect that the funds come from crime, that the activity is designed to evade reporting, that it has no business or apparent lawful purpose, or that the account is being used to facilitate crime. These four limbs reflect the US SAR rule. In the UK, suspicion is a low threshold. In R v Da Silva (2006) the Court of Appeal described it as a possibility that is more than fanciful. Proof is not required.
Many alerts are unusual but explained: a bonus, a house sale, a seasonal business. The investigator's job is to find out whether the explanation fits the facts and can be corroborated.
The investigation workflow
| Stage | Key questions | Typical outputs |
|---|---|---|
| 1. Triage (L1) | Is the alert valid, or caused by bad data? Is it a duplicate? Are there linked alerts or open cases? Is there an obvious, verifiable explanation? | Close with rationale, or move to review |
| 2. Customer review | Who is the customer? What did they say about purpose and expected activity? What is their risk rating and prior history? | Profile summary; baseline comparison |
| 3. Transaction analysis | Who are the counterparties? What are the amounts, timing, velocity, geography and payment methods? Does a known typology fit? | Flow summary, charts, counterparty list |
| 4. Information gathering | What do internal data show (other accounts, devices, IPs, fraud claims)? What does open-source research show? Do we need a carefully worded request for information to the customer? | Evidence file with sources |
| 5. Assessment | Is there a credible, corroborated legitimate explanation? Which red flags remain? | Written analysis separating facts, inferences and conclusions |
| 6. Decision | Close, keep under watch, escalate to a case (L2), restrict or exit, or refer for SAR/STR? | Decision, approver, timestamps |
| 7. Quality assurance | Did the work meet the standard? | QA score; feedback |
Escalation criteria
Escalate from L1 to L2 investigation, or to the MLRO or SAR decision-maker, when:
- Red flags remain unresolved after reasonable enquiry, or the explanation cannot be corroborated.
- Activity matches a known typology: funnel account, rapid pass-through, structuring, transaction laundering or scam victim behaviour.
- There is a sanctions nexus (escalate at once to sanctions handling), PEP involvement, adverse media, or a link to existing SARs or law enforcement requests.
- Insider involvement is suspected.
- Amounts, counterparties or geographies breach escalation thresholds in the procedure.
- The customer refuses or evades reasonable information requests.
Escalation is not an accusation. It moves the decision to someone with authority and context.
Timeliness and interim actions
- Clocks. In the US, the 30-day SAR clock starts at the initial detection of facts that may constitute a basis for filing. That is not when the alert fires, but reviews must not be delayed unreasonably. Other regimes require reporting "promptly" or "as soon as practicable".
- Interim protection. Where policy, contract and law allow, apply holds, limits or freezes to stop further loss. A confirmed sanctions match must be blocked or rejected straight away (Chapter 10).
- UK consent. If the firm wants to carry out a transaction involving suspected criminal property, it may need a defence against money laundering (DAML) from the NCA before proceeding (Chapter 4).
Contacting the customer without tipping off
Requests for information are allowed and often useful, for example asking for an invoice, the purpose of a payment or a contract. Phrase them neutrally, as routine account checks, and never mention suspicion, alerts or reports. If questioning would alert the customer to an investigation, take advice from the MLRO first (Chapter 15).
Realistic exam scenario
An alert flags a student account that received 15 P2P credits of US$500 to US$900 from unrelated senders over two days, all forwarded within 30 minutes to a crypto exchange. The customer says, "My friends paid me back for concert tickets." There is no evidence of ticket purchases, several senders have filed scam reports, and the device has been seen on two other accounts. The explanation is not corroborated and does not fit the facts. The pattern matches a mule or funnel typology. The investigator should escalate to an L2 case. Possible actions are restricting outbound transfers, linking the related accounts, and referring the case for a SAR decision.
Common exam traps
- Closing because the customer offered an explanation. Explanations must fit the facts and be corroborated.
- Waiting for proof before escalating. Suspicion, not proof, is the standard.
- Treating "unusual" as automatically "suspicious". It is the trigger for review, not the conclusion.
- Telling the customer an alert was raised. That is tipping off.
Which statement correctly distinguishes unusual from suspicious activity?
They mean the same thing in every AML regime and under the US SAR rule
Unusual departs from expected activity; suspicious means facts give reason to suspect crime
Suspicious activity requires proof beyond reasonable doubt before any report can lawfully be filed
Unusual activity must always be reported to the FIU within 30 days
A customer gives an explanation for an alert, but the documents provided do not match the transactions and several counterparties have reported fraud. What should the investigator do?
Close the alert, because the customer responded within the deadline
Tell the customer that a report will be filed if better documents are not provided
Delete the alert to reduce the backlog before the audit
Escalate, because the explanation is uncorroborated and fits a known typology
When does the US 30-day SAR filing clock begin?
On initial detection of facts that may be a basis for a SAR
When the monitoring system first generates the alert for the activity
When law enforcement asks for the file or serves a subpoena
When the first suspicious transaction occurs
Sections you finish are checked off in the contents.