Tech, ExplainedFintech
Part

AML case management

Each alert investigated, the case drafted by AI.

INSIDE: AML TRANSACTION MONITORINGAn alert arrives:₹6 lakh receivedand sent on within40 minutesThe model gathers12 months oftransactions, theKYC record and twolinked accountsIt writes a firstdraft of thecase, with theevidence attachedThe investigatorchecks the draftand the evidenceHarmlessClosed, with the reason recordedSuspiciousReport prepared for FIU-IND↓ Every decision and its reasons arestored for later auditALSO TALKS TOAI SOC analyst↗ SECURITY OPERATIONS CENTREINSIDE: AML TRANSACTION MONITORINGAn alert arrives:₹6 lakh receivedand sent onwithin 40 minutesThe model gathers12 months oftransactions, theKYC record and twolinked accountsIt writes a firstdraft of thecase, with theevidence attachedThe investigatorchecks the draft andthe evidenceHarmlessClosed, with the reason recordedSuspiciousReport prepared for FIU-IND↓ Every decision and its reasons arestored for later auditALSO TALKS TOAI SOC analyst↗ SECURITYOPERATIONS CENTREINSIDE: AML TRANSACTION MONITORINGAn alert arrives: ₹6 lakh received andsent on within 40 minutes↓The model gathers 12 months oftransactions, the KYC record and twolinked accounts↓It writes a first draft of the case, withthe evidence attached↓The investigator checksthe draft and the evidence↓HarmlessClosed, with the reason recordedSuspiciousReport prepared for FIU-IND↓ Every decision and its reasons are stored for later auditALSO TALKS TOAI SOC analyst↗ SECURITY OPERATIONS CENTRE
One alert on a ₹6 lakh transfer arrives, a model gathers the history and drafts the case, and an investigator either closes it or files a suspicious transaction report.
opens a page inside this one a page in the same scene a page in another scene a concept page a label only, with no page

AML case management is the software in which an investigator works through each alert raised by AML transaction monitoring, decides whether it is suspicious, and records the decision. Each alert becomes a case. AML stands for anti-money laundering.

A bank may raise thousands of alerts a day, and most of them turn out to be harmless. For each one, the investigator must find out who the customer is, what is normal for them, and where the money came from and went. The investigator also checks the KYC record, the customer's earlier transactions and any linked accounts. Then the investigator writes down the reasons for the decision, so that an auditor can check it later. Doing all this by hand can take hours for one case.

Now an AI model does the first part. It gathers the history, finds the linked accounts and writes the first draft of the case. The investigator reads the draft, checks the evidence and makes the decision. The model drafts; the person approves. This is called human in the loop. Security teams use the same idea in an AI SOC analyst, which sorts computer security alerts. Sorting many alerts into the few that matter is called alert triage.

If the investigator decides that the transfer is suspicious, the case software prepares a suspicious transaction report (STR). It is sent to the Financial Intelligence Unit, India (FIU-IND), through regulatory reporting, on FIU-IND's online portal, FINGate. The bank must file it within 7 working days after its principal officer, the senior employee responsible for these reports, confirms the suspicion. If the alert is harmless, the investigator closes it with a reason. In both cases, the record is kept for years.

Tech, Explained is a part of ingrid.fyi. Every page explains one piece of technology in plain words.