AML investigations: why context matters as much as the alert

An AML alert tells an investigator that something warrants attention; it rarely tells them enough to decide what that activity means.

When relevant information sits across multiple systems, investigators can spend considerable time reconstructing the circumstances behind an alert. They may need to retrieve previous case notes, check the customer’s expected activity or establish why a detection rule was triggered before they can properly assess the risk.

The quality of an investigation shouldn’t depend on how effectively an analyst can gather information that should already be available. A well-designed AML investigation workflow brings the relevant context together, allowing investigators to concentrate on interpreting the evidence rather than finding it.

Why transaction monitoring alerts don’t tell the whole story

Transaction monitoring systems identify activity that meets predefined detection criteria. An investigator’s responsibility is different: to assess that activity in context and determine whether further investigation or escalation is warranted.

Three types of information are particularly important.

Rule rationale: Knowing which rule generated an alert is useful, but understanding the behaviour it was designed to detect is more valuable. Without that rationale, an investigator may focus on whether the transaction meets the rule’s conditions rather than whether it represents the underlying risk.

Typology context: A potential structuring pattern requires different lines of enquiry from suspected layering or the movement of funds through mule accounts. Understanding the relevant indicators helps investigators assess the activity and explain why their findings may be significant.

This becomes particularly important when an investigation results in a suspicious activity report (SAR). The UK’s ⁠National Crime Agency emphasises that SARs should clearly explain the grounds for suspicion, rather than simply describe the transactions involved.

Prior investigation outcomes: Previous alerts, decisions and supporting evidence can help investigators identify recurring patterns and avoid duplicating work. However, earlier decisions shouldn’t automatically determine the outcome of a new investigation; customer behaviour, risk exposure and the information available may have changed.

The same transaction, two different risk profiles

Consider two customers who each make a £15,000 outbound transfer to an overseas account. Both transactions trigger the same monitoring rule because they exceed a threshold for transfers to that destination.

• Customer A regularly transfers funds to the same beneficiary. The relationship is documented, and the transaction amount is consistent with their historical activity.
• Customer B has historically made domestic payments. The overseas beneficiary is new, and the transfer follows an unexpected increase in incoming funds from several unrelated parties.

Although the triggering transactions look similar, the circumstances warrant different lines of enquiry.

For Customer A, the investigator may be able to establish that the payment is consistent with expected activity, subject to any other relevant risk indicators.

For Customer B, the combination of a new beneficiary, unusual incoming funds and a change in transaction behaviour warrants closer examination. The investigator may need to establish the source of funds, the relationship with the beneficiary and whether the activity forms part of a broader pattern.

Neither transaction can be classified as suspicious or benign from these details alone; the context determines what needs to be examined and which evidence is required to support the decision.

When that information isn’t readily available, investigators must reconstruct it themselves. An experienced analyst may know exactly where to look, while another might need to navigate several systems or request data from a different team.

The resulting differences in investigation time and access to evidence can affect decision quality.

How missing context creates inconsistent AML decisions

When investigators work with incomplete information, the consequences extend beyond individual cases.

For financial crime operations leaders, three problems emerge:

• Inconsistent decisions: Similar cases may produce different outcomes depending on which information an investigator can access or chooses to prioritise.
• Weaker quality assurance: Without a clear record of the evidence considered and the reasoning behind a decision, reviewers struggle to assess whether an alert was handled appropriately.
• Greater reliance on individual experience: Experienced investigators may know how to reconstruct missing context, while less experienced colleagues take longer or overlook relevant information.

Training remains essential, but it cannot compensate for information that is unavailable when a decision is made. Even a well-trained investigator needs a workflow that supports the application of their expertise.

What better AML investigation workflows look like

Closing the context gap requires more than bringing additional data into a case management system. The information must be relevant, reliable and accessible when investigators need it.

Make relevant context available from the start

Customer risk profiles, expected behaviour, transaction history and previous investigation outcomes should be accessible alongside the alert.

The objective is to surface the information most relevant to the risk being investigated - not to display every available data point. Investigators should also be able to identify when that information is outdated, incomplete or requires verification.

Support investigations beyond the initial alert

Investigators need to explore related transactions, counterparties and account activity as new questions emerge, without repeatedly switching systems or requesting additional data.

AI-assisted tools can help retrieve information, identify relevant activity and organise supporting evidence, reducing the manual effort involved.

Any evidence presented must remain traceable to its source and available for verification. The investigator remains responsible for interpreting the findings and determining the appropriate outcome.

Make investigation knowledge reusable

Experienced investigators develop valuable knowledge about how to examine particular patterns, which questions to ask and which evidence matters most.

When that knowledge exists only in individual experience, organisations become dependent on particular analysts to handle certain investigations effectively.

Documented investigation approaches, reusable queries and accessible case histories can help make that expertise available more widely.

For example, an investigator reviewing suspected layering activity could use an established approach to examine transaction sequences, counterparty relationships and the movement of funds across accounts.

This provides a consistent starting point without prescribing the conclusion, helping teams apply effective investigative approaches while retaining the flexibility to respond to unusual or emerging behaviour.

How to measure investigation quality and consistency

Better access to context should support more effective investigations, but faster case closure alone isn’t evidence of improvement.

The more important question is whether investigators are reaching well-supported decisions, applying appropriate scrutiny and documenting their reasoning consistently.

Several existing operational measures can help assess this:

• Quality assurance findings: Are reviewers repeatedly identifying missing evidence, incomplete reasoning or failures to consider relevant customer information?
• Closure and escalation patterns: Do comparable alerts produce substantially different outcomes across investigators?
• Escalation reversals: How frequently are decisions changed following review, and what information or reasoning was missing?
• Repeat alerts: Are investigators repeatedly reviewing similar activity without access to previous findings?
• Investigation handling time: How much effort is spent gathering information compared with analysing it and documenting the outcome?

These measures should be considered together, with appropriate adjustments for case complexity, risk and workload distribution.

For example, differences in closure rates may reflect genuine variations in customer risk rather than inconsistent decision-making. Similarly, an experienced investigator may work more quickly because they know where to find relevant information.

Comparing outcomes across similar cases, supported by quality assurance findings, can help distinguish genuine differences in risk from avoidable weaknesses in the investigation process.

Where judgement begins

The goal is not to make every investigator equally experienced; it is to stop experience being the only place where context lives.

Better access to information, reusable investigation approaches and clear evidence trails allow investigators to apply their expertise more consistently, without removing the judgement that effective AML investigations require.

The alert is not the case. The case is the alert plus the context needed to decide what it means.

Explore Fortify’s AML investigation capabilities

Fortify helps AML teams investigate transaction activity, explore connected data and build reusable investigation workflows. With natural-language data exploration, AI-assisted analysis and auditable investigation records, teams can spend less time gathering evidence and more time assessing risk.

Find out more