Work the alerts and draft a suspicious activity report

Steps

1. 1

   Read the list of alerts

   On the Monitoring tab, Transaction Alerts lists each alert with its type, severity, amount, status, date and the actions you can take. Four are open: a sanctions alert, two for large amounts, and one from your cash rule.

2. 2

   Open the alert for the purchase

   Select the line for 78,500 dirhams. It opens to show the description, which names the rule, the amount and the supplier, and the transaction it belongs to.

3. 3

   Select Investigate

   Select Investigate on that line. A message says Alert updated and the status changes to Investigating. The buttons change to Escalate, Create SAR and Dismiss.

   • Select Investigate
4. 4

   Select Dismiss

   This purchase is from a screened supplier, with an invoice, paid by bank transfer. Select Dismiss. A window titled Dismiss alert asks you to say why the alert is not suspicious. The reason is shown on the alert and kept in the audit trail.

   • Select Dismiss
5. 5

   Type the reason and confirm

   In Reason for dismissing type what you checked, then select Dismiss in the window. The status changes to Dismissed, the buttons disappear, and the opened line now shows your reason.

   • Type Reason for dismissing: Regular supplier, screened and cleared. Invoice QAN-2026-0412 on file…
   • Select Dismiss
6. 6

   Investigate the large cash sale

   Now the alert for the sale of 126,000 dirhams with the type Threshold, automatic rule. Select Investigate on its line.

   • Select Investigate
7. 7

   Select Create SAR

   The customer paid in banknotes and has not explained why, so select Create SAR on that line. A form opens. Open Report Type: SAR is a suspicious activity report, about behaviour, and STR is a suspicious transaction report, about one transaction. Choose STR.

   • Select Create SAR
   • Select SAR — Suspicious Activity Report
   • Choose STR — Suspicious Transaction Report

   

8. 8

   Write the narrative

   In Narrative write what happened and why it is suspicious: the date, the amount, how it was paid, and what does not fit. Write it so that someone outside the company can follow it.

   • Type Narrative: On 6 October 2026 the customer bought homeware for 126,000 dirhams and…
9. 9

   Name the subjects

   In Subjects name the people and companies the report is about.

   • Type Subjects: Mirdif Lantern Homeware LLC, customer. Imran Rafiq Siddiqui, manager.
10. 10

    Select Create SAR to save the draft

    Select Create SAR at the bottom of the form. A message says SAR created, draft, and the form closes. The alert's own line still reads Investigating for the moment; it catches up at your next action on this tab.

    • Select Create SAR
11. 11

    Dismiss the alert that repeats the same sale

    The alert with the type Pattern, automatic rule, is for the same sale, raised by your cash rule. It is now covered by the report. Select Investigate on it, then Dismiss, and give that as the reason. Notice the line above it: the alert you reported stays Escalated, and under it a line reads Report being drafted, not filed yet. The alert follows its report: nothing has gone to the regulator yet.

    • Select Investigate
    • Select Dismiss
    • Type Reason for dismissing: Same sale as the reported alert; covered by the suspicious transaction…
    • Select Dismiss
12. 12

    Escalate the sanctions alert

    The critical alert is the possible sanctions match that the compliance officer escalated. Select Investigate on it, then Escalate. Select the line to open it: it now says Escalated for senior review, with a File SAR button for the case where the review ends in a report.

    • Select Investigate
    • Select Escalate
13. 13

    Open the SARs tab

    Scroll to the top and select the SARs tab. The report is listed with the type STR, the status Draft, the amount, and a Deadline for filing. Select the line to open it and read the narrative, the subjects and the alert it came from.

    • Select SARs1
14. 14

    Select Send to Review

    Select Send to Review on the line. A message says SAR status updated and the status becomes Internal review. The button is now Approve. A report must be approved by a different person from the one who wrote it, so your part ends here. The next lesson is the reviewer's.

    • Select Send to Review