AML Case Management: Build Investigation Workflows for Compliance Teams
Transaction-monitoring alerts land in email and spreadsheets. Investigations stall, STR deadlines slip, and audit trails fall apart when the FIC asks who decided what. Unstructured alert triage burns investigator capacity and leaves your MLRO exposed.
We build the investigation workflow that triages, assigns, evidences, decides, and hands off to goAML.
Sound Familiar?
These are the exact issues our clients faced before structured AML case management:
- Transaction-monitoring alerts land in email and spreadsheets with no owner, SLA, or triage queue
- Investigators burn 45 minutes on a typical middle-complexity alert while 90–95% clear as false positives
- Evidence sits in shared drives and chat threads, so case files are incomplete when the FIC asks
- STR decisions drift past the 15-day FIC window because escalation and goAML handoff are manual
- Examiners find who decided what only after the MLRO reconstructs the investigation from inbox history
FIC Guidance Note 4 requires STRs as soon as possible, and within 15 days excluding weekends and public holidays after you become aware of the facts. Late or incomplete filings are non-compliance under the FIC Act, and inspections increasingly test investigation quality and timely STR decisions, not just whether a policy exists on paper.
What the Investigation Workflow Actually Does
Alert arrives → case assigned → evidence gathered → decision logged → goAML pack ready. No human hunting through inboxes.
Alert Triage
TM alert opens a queued case with priority, SLA clock, and risk context attached
Assign & Investigate
Owner gathers statements, KYC, counterparties, and prior alerts in one case file
Decide or Escalate
Clear, monitor, or escalate for STR with mandatory findings and rationale
goAML Handoff
STR pack assembles for filing; audit trail locks who decided what and when
Everything You Need for Structured Compliance Cases
Alert Triage Queues
Every TM alert opens an investigation case with priority, owner, and SLA. High-risk patterns surface first; routine clears leave the queue fast.
Investigator Assignment
Route cases by product, risk tier, or jurisdiction. Level 1 clears noise; complex investigations land with senior investigators or the MLRO.
Evidence Gathering
Attach statements, KYC packs, counterparties, and prior alerts to the case. Investigators stop hunting across drives, CRM notes, and email threads.
Decision & Escalation
Clear, continue monitoring, or escalate for STR with mandatory rationale. Escalation ladders keep suspicious cases from going cold before the FIC clock runs out.
goAML Handoff Pack
STR-ready case files assemble narrative, parties, transactions, and supporting evidence for goAML submission. Less re-keying, fewer incomplete filings.
Inspection-Ready Audit Trail
Who triaged, who investigated, what evidence was reviewed, who decided, and when. Built for FIC inspections that test investigation quality, not just policy wording.
Systems We've Wired Into Investigation Workflows
From 6.5 Days to 18 Hours Mean Alert-to-Decision
How a mid-size South African payments FSP stopped investigating TM alerts in spreadsheets and walked into a FIC engagement with complete case files.
The Spreadsheet Process
- TM alerts forwarded into a shared mailbox and Excel tracker with no SLA
- 44 hours a week across four investigators chasing evidence by hand
- Mean alert-to-decision: 6.5 business days, with STR deadlines slipping into the scramble
- Case narratives rebuilt from email threads when goAML filing was due
- MLRO spent weekends reconstructing files before inspection requests
The Structured Workflow
- Every alert opens a case with owner, priority, and evidence checklist
- Level 1 clears routine false positives; escalations route with findings attached
- Mean alert-to-decision dropped to 18 hours; STR packs assemble for goAML
- Every disposition writes who, when, why, and what evidence was reviewed
- Inspection pack exports in minutes instead of a weekend reconstruction
Before vs After AML Case Management
How It Works
From first conversation to live investigation workflow in 4–8 weeks.
Tell Us Your Setup
Where TM alerts land today, how investigations run, and where STR and audit gaps worry your MLRO most.
Free Scoping Call
30-minute call to map triage rules, assignment, evidence packs, decision codes, and goAML handoff.
Build & Test
We build the AML case management workflow, test with real alert volumes, and validate case files with your compliance officer.
Go Live & Monitor
Switch off spreadsheet investigations. Dashboards keep queues moving and STR deadline risk visible.
Frequently Asked Questions
How is this different from World-Check or sanctions hit review?
Screening hit review clears name matches at onboarding or rescreen. This workflow manages transaction-monitoring investigations: triage alerts, assign cases, gather evidence, document findings, and escalate for STR or SAR filing via goAML. If your team already screens names but investigates TM alerts in email and Excel, this is the missing investigation layer.
How long does an AML case management workflow take to build?
A focused investigation queue into one CRM or case tool typically takes 4–6 weeks from scoping to go-live. Multi-team escalation with evidence packs and goAML handoff usually sits closer to 6–10 weeks.
Do we need a new transaction monitoring system?
No. Keep your existing TM rules engine. We build the case management and investigation workflow around the alerts you already generate, whether they arrive via API, batch export, or ops inbox, and sync status back into your CRM or core system.
Will this help with FIC STR deadlines and inspections?
FIC Guidance Note 4 requires STRs as soon as possible, and in any event within 15 days excluding weekends and public holidays after you become aware of the facts. We design queues, escalations, and case files so decisions move inside that window and examiners can reconstruct who investigated what. Your RMCP still owns the policy; the system executes it consistently.
What happens when a case needs an STR?
Escalated cases assemble a goAML-ready pack: narrative draft inputs, parties, transactions, and attached evidence. Investigators and the MLRO review and submit through your existing goAML process. The case record retains the filing decision and timestamps for audit.
How much does AML case management integration cost?
Focused investigation queues typically start from around R45,000. Multi-team escalation with CRM sync-back and goAML handoff packs usually sits in the R60,000–R110,000 range. Teams clearing hundreds of TM alerts a month often recover the build cost within 3–5 months from investigator time alone.
Stop Investigating AML Alerts in Spreadsheets
If your compliance team is still triaging transaction-monitoring alerts in email and Excel, you are burning investigator capacity on a problem that already has a proven workflow.
Tell us where alerts land today, how cases get assigned, and where STR and audit gaps worry your MLRO most. We will show you exactly how structured AML case management would work inside your TM and CRM stack.