An examiner rarely asks whether you caught every launderer. They ask to see a case: why the alert fired, what the analyst looked at, who decided, when, and why they filed or did not. Many money transfer operators can answer the first question and struggle with the rest, because the evidence sits across a monitoring tool, an inbox and a spreadsheet. This guide is for MLROs, compliance analysts and operations leads at established MTOs who want every case to read the same way from alert to filing. Figures in the worked case are illustrative.
The principle: a case is only as good as the file an examiner can read afterwards. If the analyst works from the same record the examiner will see, the file writes itself as the work is done.
On RemitSo, a white label remittance platform, a customer's risk triggers already read as a case file: each check that fired explains itself in plain language, links to the records that tripped it and keeps the evidence. The analyst starts from an explained alert rather than a bare score. Your team still investigates, decides and files; the platform does not decide suspicion.
Not legal advice: reporting thresholds, deadlines and documentation rules vary by jurisdiction and licence. Confirm current obligations with your regulator or adviser.
One alert, followed to a decision
A customer signed up three weeks ago. Their first transfer was ordinary. Over the next twelve days they sent nine transfers of between 850 and 950 to three recipients in the same payout country. Two of those recipients also receive money from four other customers who signed up in the same month, and one card used by the customer has been used by another customer too.
No single transfer is large. Together they fire several indicators: frequent transfers to the same recipient, linked transaction patterns, and payment details reused across customers. The customer's risk score reaches 68, which is in the High band, and above the threshold at which transfers stop for a person. The tenth transfer waits Under Review, and the compliance team is alerted.
| Step | Owner | Target | What happens in this case | Evidence kept |
|---|---|---|---|---|
| 1. Alert | Platform | As the transfer is placed | Indicators fire; score 68; transfer held Under Review | Each indicator, in plain language, with links to the transfers, recipients and card |
| 2. Triage | Analyst | Same working day | Rules out a data error. Shared recipients and a shared card are real. Opens a case | Triage note and the reason for escalating |
| 3. Due diligence | Analyst | 1 to 2 days | Asks the customer, inside the app, for source of funds and the relationship to each recipient | The request, the documents returned, the KYC decision |
| 4. Analysis | Analyst | 1 to 2 days | Maps the five linked customers, their sign-up dates, devices and shared recipients | The linked records and the analyst's summary |
| 5. Decision | MLRO | Within a day of escalation | Explanation does not hold: a payslip covers a fraction of the amounts sent, and the customer cannot say who two recipients are. Suspicion formed | The decision, the reasoning and the date suspicion was formed |
| 6. File | MLRO | Within the legal deadline | SAR prepared and submitted; the held transfer is not released; linked customers reviewed | The report, its submission and the follow-up actions |
| 7. Monitor | Analyst | Ongoing | The filed SAR becomes an indicator in its own right, so future activity is scored with it | Rule history and later reviews |
The same case could just as easily close. Suppose the customer had shown that they run a small family business, the three recipients were relatives, and the shared card belonged to a spouse with their own account. The analyst records the explanation and the documents, the MLRO closes the case with a reason, and the transfer is released. A closed case with a clear reason is as valuable to an examiner as a filed one.
The date that matters: most deadlines run from when you detected the activity or formed a suspicion, not from when the case was closed. Record that date as a fact in the file, not as something to reconstruct later.
Doing it with RemitSo
Each step in the table maps to something already in the admin panel.
| Step | In RemitSo |
|---|---|
| Alert | 47 ready-made risk indicators, including frequent transfers to the same recipient, linked transaction patterns, payment details reuse across customers, and high-risk countries, which you combine into your own rules. Risk Radar shows the evaluated indicators and outcomes. Transfers at or above your risk threshold stop Under Review; alerts such as "High customer risk score detected" and "Transaction under manual review" go to the people you subscribe |
| Triage | The customer's risk page explains each trigger and links to the records behind it |
| Due diligence | On-demand KYC and enhanced due diligence inside the customer's app; KYC decisions kept with rejection labels and reasons |
| Analysis | Customer profile, payment accounts, devices and login sessions, sanction lookups and notes on one customer page |
| Decision and filing | Suspicious Activity Reports prepared and managed in the console, then filed by your compliance officer |
| Monitoring | Indicators for an internal SAR filed, SAR reported and SAR not reported feed your rules |
Behind it sit the records an examiner will ask for: screening rulings, KYC decisions, AML rule history, login sessions, and a searchable, plain-language audit log of who changed what, and when, in which every override of an AML limit is recorded. Sanctions screening runs on every sender and recipient against 8 lists reloaded every night, and an officer can confirm a match as well as clear it. Risk rule pages are permission-controlled, so only the people you choose can change what raises a case. See the admin features, or book a demo to walk through a case from trigger to report.
Triage: deciding what becomes a case
Most alerts should not become cases. The job of triage is to separate a pattern from a coincidence quickly, and write down why. Three questions do most of the work:
- Is the data right? A duplicated customer or a mistyped name can fire an indicator. Fix the record and close the alert with a note.
- Does the activity fit what we know? Compare it with the customer's stated purpose, occupation and history. A steady monthly sender who doubles one month before a holiday is not a case.
- Is anyone else involved? Shared recipients, shared cards or a cluster of sign-ups is the strongest reason to open a case, because one customer's explanation cannot cover the others.
If your team closes most alerts at triage with the same reason every time, that is a tuning problem, not a workload problem. Adjust the rule, and keep the history of the change. Our guide to transaction monitoring rules covers tuning.
What a complete case file contains
| Item | Why an examiner wants it |
|---|---|
| The alert and the indicators that fired | Shows your monitoring works and what it saw |
| Triage note | Shows a person looked, and why they escalated |
| Customer due diligence gathered | Shows what you asked for and what came back |
| Linked customers and transfers reviewed | Shows you looked beyond one account |
| Date suspicion was formed, or the case closed | Starts the reporting clock |
| Decision, decision-maker and reasoning | Shows accountability sits with a named role |
| Report and submission, or the closure reason | Shows the outcome was acted on |
| Follow-up: monitoring, exit, linked reviews | Shows the case changed how you treat the customer |
Tipping off: when you ask a customer for more information, ask as part of normal due diligence. Telling a customer, directly or indirectly, that a report has been or may be made is an offence in most jurisdictions.
Where and when to file
| Country | Report and recipient | Deadline |
|---|---|---|
| United States | SAR to FinCEN | 30 calendar days from initial detection, for a money services business |
| United Kingdom | SAR to the National Crime Agency | As soon as practicable; a DAML request before proceeding with a suspect transaction |
| Canada | Suspicious transaction report to FINTRAC | As soon as practicable |
| Australia | Suspicious matter report to AUSTRAC | 3 business days after forming the suspicion; 24 hours for terrorism financing |
Structuring is a common trigger in remittance: splitting money into smaller amounts to stay under a reporting threshold, such as cash payments of $9,500 against the $10,000 US currency transaction report threshold. FinCEN's October 2025 SAR FAQs add a caution: a transaction near that threshold does not by itself require a SAR; the question is whether it was designed to evade reporting.
Five mistakes that weaken a case
- No date of suspicion. Without it, nobody can show the report was on time.
- Evidence outside the system. Screenshots in an inbox are hard to find and easy to lose. Keep evidence on the customer record.
- One-account thinking. If a recipient or card links customers, review them together.
- Closing without a reason. "No further action" is not a reason. Write what explained the activity.
- Nothing changes afterwards. A filed or closed case should change how the customer is scored or monitored.
Sources
- 31 CFR 1022.320, Reports by money services businesses of suspicious transactions
- FinCEN, Frequently Asked Questions Regarding Suspicious Activity Reporting Requirements (October 2025)
- National Crime Agency, Suspicious Activity Reports
- FINTRAC, Reporting suspicious transactions to FINTRAC
- AUSTRAC, Suspicious matter reports
Checked October 2026. Regulations change; confirm current requirements with the regulator or your adviser.
Frequently asked questions
What is the difference between an alert and a case?
An alert is a signal from monitoring. A case is opened when triage finds something that needs investigation. Most alerts should close at triage with a short, recorded reason.
Who should decide whether to file a SAR?
A named role, usually the MLRO or nominated officer. Analysts gather and summarise the evidence; the decision and its reasoning should sit with the person accountable for reporting.
When does the reporting clock start?
It depends on the country. In the US, a money services business has 30 calendar days from initial detection. In Australia, it is 3 business days after forming the suspicion, or 24 hours for terrorism financing. Record the date in the case file.
Can we ask the customer questions during an investigation?
Yes, as part of normal due diligence, such as asking for source of funds. Do not tell them, directly or indirectly, that a report has been or may be made.
Does RemitSo decide whether activity is suspicious?
No. RemitSo raises and explains the alert, holds risky transfers for a person, keeps the evidence and lets you generate and submit the SAR from the console. Your team investigates and decides.
Is a closed case worth keeping?
Yes. A case closed with a clear explanation shows an examiner your monitoring works and your team thinks. Keep it as carefully as a filed one.