Understanding and Investigating a Transaction Monitoring Case

A Transaction Monitoring Case centralizes all triggered alerts for a specific entity (either a customer or a counterparty) into a single, context-rich environment. This allows analysts to assess a party's overall behaviour rather than just isolated events.

When you create a scenario, you choose whether it should group alerts by customer or counterparty. Any new alerts for that entity will be automatically added to their open case until it is closed.

Case Structure

Cases are designed to give you a complete picture of an entity's potentially risky activity. The hierarchy is as follows:

• Case: The top-level container, focused on a single customer or counterparty.

• Alert: A case can contain multiple alerts. Each alert represents a specific scenario that was triggered.

• Transaction: An alert can contain one or more transactions that met the scenario's criteria.

How to Investigate a Case

Follow this workflow to effectively analyse and make a decision on a case.

1. Navigate the Alerts Use the Alerts side panel to select and review each individual alert contained within the case.

2. Review Alert Details For each selected alert, you will see the alert priority, the list of triggering transactions, and the specific conditions that were met. The system shows you the scenario's required parameters alongside the actual values from the transaction, explaining exactly why the alert was created.

3. Set the Status for Each Alert After reviewing an alert, assign it a status: True Positive, False Positive, In Progress, or Not Started. Repeat this for all alerts in the case.

4. Make an Overall Case Decision Once all alerts have been reviewed and assigned a status, make a final decision on the case as a whole.

5. Document Your Findings Use the Case Notes section and the notes on your final decision to record your reasoning and share information with your team. This provides a clear audit trail for your decision-making process.