AML case management is the process that takes a monitoring alert through triage, investigation, escalation and a recorded disposition, so a supervisor can see what was found, who decided and why. An examiner-ready audit trail captures each action as it happens, with timestamps and reasons, instead of rebuilding the story after an examination notice arrives.
No source reviewed for this guide prescribes a case-file template. The expectations below come from the FATF Recommendations, BSP's guidance on transaction monitoring systems, and the reporting clocks set by AMLC and BSP issuances. They describe what a defensible record needs to show, not a mandated format.
The guide is written for compliance heads and operations leads who run lean teams. It follows one alert from the moment it fires to the moment the record is locked, and it flags the points where examiners tend to find gaps.
What does AML case management cover, from alert to disposition?
It covers every step between a system flag and a final decision: triage, enrichment, investigation, escalation, disposition, reporting where required, and retention of the record.
Alerts come from transaction monitoring rules and from name screening. A case is the container that holds the alert, the evidence, the analysis and the decision, and the alert disposition is the recorded outcome at the end of it. BSP's Memorandum No. M-2023-013, a guidance paper on an effective AML/CTPF transaction monitoring system, covers alert and case management alongside system design, scenario coverage, suspicious transaction reporting and independent testing, which makes it the natural reference point for how alerts should be handled once they fire.
The quality of the case file depends on the quality of the alerts feeding it. A queue full of noise produces thin, repetitive closure notes, which is why our guide to threshold tuning and false-positive reduction belongs next to any case management review.
What are the stages of an AML investigation workflow?
Seven stages cover the path, and each one should leave something specific in the file.
| Stage | What happens | What the file should show |
|---|---|---|
| Triage | The alert is prioritised and assigned | Alert ID, rule and version, priority, owner, time received |
| Enrichment | Customer profile, risk rating and prior alerts are pulled in | Sources checked and the risk rating at the time of review |
| Investigation | Transactions, counterparties and documents are analysed | Evidence list and analysis notes |
| Review | A second person checks the work where policy requires it | Reviewer, date and comments |
| Disposition | The outcome is chosen: false positive, escalate, or suspicious | Decision, written reason and approver |
| Reporting | An STR is filed where suspicion is determined | Determination date and time, and the filing reference |
| Closure and retention | The record is completed and locked | Closure date and retention period |
The most common design flaw sits between triage and investigation. When a customer generates three alerts across a week, three analysts can open three tickets and reach three conclusions. One customer should map to one case, with related alerts from every source linked into it and the evidence travelling with them. That structure also makes it possible to show an examiner the full history of a customer in one place.
What does an examiner-ready audit trail contain?
It contains enough detail for a reviewer who was not in the room to reconstruct the decision without asking anyone.
- 01Why the alert fired. The rule, the threshold, the data window and the rule version in force on that date.
- 02Who did what, and when. Every assignment, note, status change and handover, with a user name and a timestamp.
- 03What was reviewed. The transactions, documents and customer information the analyst relied on, attached or referenced in the case.
- 04The reasoning in plain words. A short explanation of why the activity was or was not suspicious, specific to this customer and this pattern.
- 05The decision and its approval. The disposition, the person who made it and the person who approved it.
- 06The determination date. The moment suspicion was established, where it was.
- 07A lock at closure. Once a case closes, later changes should appear as new, dated entries, not as edits to the original record.
The seventh point is the one that separates a case record from a spreadsheet. A record that can be edited after the fact is hard to rely on, however good the original entries were.
How do case timestamps connect to STR and risk-event clocks?
The case is where the evidence for a deadline lives, because the clocks run from a determination the analyst records.
FATF Recommendation 20 requires suspicions to be reported promptly to the financial intelligence unit. In the Philippines, under AMLC's GoTRACS reporting rules, an STR is due by the next working day from the determination of suspicion, which is not the same as the date of the transaction. We set out the mechanics in our guide to the STR filing window trap, and the contrast with US terminology in SAR versus STR. Covered transaction reports run on a separate five-working-day window and are not the same filing.
BSP Circular 1193 adds a second clock. A covered person must submit an ML/TF/PF Risk Event Report to the BSP within 24 hours from the date of knowledge or discovery. A case that escalates to a significant event needs a timestamp for that knowledge, and a named person who judged it.
If the case record holds the determination date and the reasoning behind it, one file answers both timeliness questions. If it does not, the team is left arguing from memory. Our guide to writing a BSP-ready STR covers what the narrative itself needs to contain.
How long should AML case records be kept?
At least five years, which is the floor set by the FATF Recommendations.
FATF Recommendation 11 requires transaction records to be kept for at least five years, and customer due diligence records for at least five years after the business relationship ends. Case files sit between the two, because they refer to both. Set the case retention period no lower than that floor, and align it with the record-keeping rules in the 2018 implementing rules and your own board-approved policy.
Retention only helps if the record can be retrieved by customer, by case number and by date. An archive that takes days to search fails the same test as a record that was never kept.
Where do AML case management programmes usually fail an examination?
They fail in a handful of repeatable places, and most of them are about discipline, not technology.
- Boilerplate closure reasons. "Reviewed, no concerns" repeated across hundreds of cases tells an examiner that no one reviewed anything.
- Duplicate investigations. The same customer worked as separate tickets, with different conclusions.
- Evidence outside the system. Key documents live in email threads or shared drives, so the case cannot be reconstructed.
- No link to the customer's risk rating. The reviewer cannot show what the customer's risk profile was when the decision was made. Our guide to customer risk rating reviews covers why that snapshot matters.
- Unversioned rules. When thresholds change without a record, nobody can explain why an alert fired in March and would not have fired in June.
- No visibility of ageing. Cases sit without an owner until someone outside the team asks about them.
Each of these is visible in a sample of closed cases. That is exactly what an examiner will pull.
Which metrics show whether case management is working?
Six measures cover most of what a head of AML needs, and none of them requires a benchmark from outside the institution.
- Case ageing by priority, so the oldest open cases are known at any time.
- Disposition mix by rule, which shows which rules produce only false positives and feeds calibration.
- Quality-assurance results from a regular sample of closed cases, scored on whether the written reason is specific.
- Reopen rate, which signals closures that were premature.
- Time from determination of suspicion to filing, measured against the reporting window.
- Handovers per case, because every handover is a point where context can be lost.
Track them monthly and report them to the same forum that reviews rule tuning. The cases tell you which rules to change, and the rules tell you which cases are worth an analyst's hour.
How can a lean team run this without a large operations function?
A team of five to fifteen can run a defensible process with a few fixed rules, applied every time.
- 01One customer, one case. Link every related alert into the open case instead of starting a new one.
- 02Standard rationale codes. Give analysts a short list of closure reasons, and require a sentence of free text on top of the code.
- 03Four-eyes on the decisions that matter. Require a second approver for escalations, STR decisions and closures above a risk threshold set in policy.
- 04A weekly ageing review. Fifteen minutes on the oldest open cases, with a named owner for each.
- 05A monthly quality sample. Pull a small number of closed cases and score them on specificity, evidence and timing.
- 06A closing checklist. Confirm that the determination date, the approver and the evidence list are present before the record locks.
None of this needs new headcount. It needs the discipline to apply the same steps to every case and a system that makes skipping them visible.
For the wider examination context, see our BSP Circular 950 compliance guide.
How does Fyscal ARCX support this process?
Fyscal ARCX Case Management brings alerts from transaction monitoring and name screening into one case per customer, with the rule, the transactions and the customer profile attached to each linked alert. Every action is written to a timestamped timeline that locks when the case closes, each disposition carries a mandatory written reason, and the case queue shows ownership and age across the organisation. Its Case Copilot drafts case summaries and closure narratives for an officer to review and approve.
If you want to see how an alert becomes a locked, examiner-ready case record in a single workflow, book a walkthrough of Fyscal ARCX and bring a recent closed case to test it against.