Alert triage
Also called level 1 alert review, alert disposition
Alert triage is the first-level review of alerts generated by transaction monitoring or screening systems. An analyst decides quickly whether an alert is a clear false positive to close, or whether it needs a deeper investigation. Triage sets the order of work so the riskiest alerts reach investigators first.
How it works
Alerts arrive in a queue, often scored by risk. A level one analyst checks the customer profile, recent activity and prior alerts, then closes the alert with a reason or escalates it to level two. Many firms now use machine learning to rank alerts or auto-close low-risk ones under controlled rules, with quality assurance sampling of closed alerts.
Triage is where most of the cost of monitoring sits, because rules-based systems produce high false positive rates. Slow triage builds backlogs, and backlogs put reporting deadlines at risk. In the US a suspicious activity report is due within 30 calendar days of initial detection. Regulators review triage decisions for consistency and expect a clear audit trail.
The rules
Requires a SAR within 30 calendar days of initial detection, extendable by 30 days to identify a suspect, never beyond 60 days.
Banks subject to the Bank Secrecy ActMakes it an offence to fail to disclose knowledge or suspicion of money laundering as soon as practicable after it arises.
Staff in the UK regulated sectorClarified there is no requirement to document a decision not to file a SAR and no mandatory 90-day continuing activity review.
Banks and other SAR filersCommon questions
What is the difference between level one and level two review?
Level one triage decides quickly whether an alert merits investigation. Level two investigators then gather evidence, review linked accounts and decide whether to file a suspicious activity report.
Can alerts be closed automatically?
Many firms auto-close or deprioritise low-risk alerts using models or rules. Regulators expect the logic to be documented, validated and tested, with sampling of auto-closed alerts.
When does the SAR clock start in the US?
The US rule sets the deadline at 30 calendar days after initial detection of facts that may constitute a basis for filing. If no suspect is identified, filing can be delayed by a further 30 days, but never beyond 60 days after initial detection.
Why do alert backlogs matter?
Unreviewed alerts mean suspicious activity may go unreported or be reported late. Alert backlogs feature often in regulatory findings, skilled person reviews and enforcement actions against banks.
Our coverage
News and analysis on transaction monitoring from RegTech Post.
Read the coverage →RegTech PostBanks Turn to AI Agents for AML, Fraud Detection and Risk MonitoringRead the article →RegTech PostCompliance Costs Are Climbing. RegTech Offers a Way Out.Read the article →
