Lesson 11 of 26

Nasser triages the open AML alerts

For: AML officerAbout 6 min

What you will be able to do

This lesson is for the AML officer. Transaction monitoring raises alerts, for example on large cash payments or on a pattern of payments kept just under a threshold. Nasser, the AI agent for financial crime, can run the monitoring, look at each open alert and say which need attention. You will ask Nasser to triage the open alerts, answer its go-aheads and its question, and read its findings.

Before you start

  • You are signed in as the AML officer of Meridian Souq Trading LLC.
  • The earlier alerts were reviewed at the quarterly AML reviews; in October one wholesale customer paid cash for four invoices, each under the AED 55,000 cash threshold.

Steps

  1. 1

    Ask for a triage of the alerts

    Open the AI team's Chat for Meridian Souq Trading LLC, type @ and pick Nasser, the financial crime agent, and write your request: run transaction monitoring and triage the open alerts on the company.

    • Type Message to the AI team: @Nas
    • Choose NNasserAIFinancial crime
    • Type Message to the AI team: @Nasser please run transaction monitoring and triage the open AML aler…
  2. 2

    Select Send

    Select Send. Nasser's card under your message is marked Working.

    • Select Send
  3. 3

    Follow Nasser's to-do list

    Nasser writes its to-do list: run the monitoring scan, read the open alerts, look into anything that looks like a pattern, and record its findings on the alert. The line Now: says what it is doing.

  4. 4

    Answer Nasser's go-aheads and question

    The scan raises a new alert: four cash sales to one wholesale customer, each just under the threshold. Changing an alert is a change, so Nasser asks first: the go-ahead sets the alert to Investigating, with notes listing the four invoices and the warning signs. Approve it. Next Nasser asks two things: who the MLRO is, and whether to draft a suspicious activity report. Type that you are the MLRO and send. A last go-ahead escalates the alert and assigns it to you: approve it.

    • Select Approve
    • Type Your answer: I'm the MLRO, Hamad Ali.
    • Select Send
    • Select Approve
    The screen at step 4: Answer Nasser's go-aheads and question
  5. 5

    Read Nasser's findings

    Nasser's green Answer says the scan raised one new alert, the only open one. It lists the four cash sales, totalling 75,350 dirhams, and why they look like structuring: a business buyer paying cash, one order split into four invoices under the threshold, and no due-diligence file on the customer. The alert is escalated to you. Nasser did not draft a report, because your answer named the MLRO but didn't say whether to draft one: tell Nasser if you want it, and filing stays with you.

  6. 6

    See the steps

    On Nasser's card, select the line that says how long it worked. The steps show the scan, the transactions it read, your answer, and the changes it made with your go-aheads.

    • Select Worked for 2 min · 36 step(s) · 3 change(s)
  7. 7

    Check the alert in AML/CFT

    In the left menu, under Financial crime, open AML/CFT. The dashboard counts no active alerts: the structuring alert is no longer new, it is escalated and waits for your decision. Open the Monitoring tab to find it, assigned to you, with Nasser's notes. The next decision is yours.

How to check it worked

Nasser's green Answer says the scan raised one new alert, a possible structuring pattern, explains why it looks suspicious, and says it escalated the alert to you with your go-ahead. Under AML/CFT, Monitoring, the alert is Escalated and assigned to you. No suspicious activity report was drafted or filed: that is the MLRO's decision.

Common mistakes

  • Closing alerts because the agent called them low risk. Read the reason, then decide.
  • Answering only part of a two-part question. Nasser asked who the MLRO is and whether to draft a report; it acts only on what you answered.

Check your understanding

  1. 1. Several cash sales from one customer, each just under the threshold. What might that be?

    1. A.A sign of structuring, worth investigating
    2. B.Always normal
    3. C.A VAT error
    4. D.A payroll payment
    Show answer

    Answer: A. A sign of structuring, worth investigating

    Splitting payments to stay under a threshold is a known red flag; it is investigated, not ignored.

  2. 2. Who decides to report suspicious activity?

    1. A.Nasser
    2. B.The MLRO
    3. C.The bank
    4. D.The customer
    Show answer

    Answer: B. The MLRO

    Reporting is a person's legal decision; the agent prepares the facts.