Transaction Monitoring Alert Triage

Transaction Monitoring Alert Triage

Purpose

Produce a structured, review-ready draft triage of a transaction-monitoring alert (or a small batch of alerts) on an existing customer. The skill inventories the alert data and the rule that fired, organizes the customer's profile and expected-activity baseline against the observed activity, structures the escalate / close / request-more-information analysis as explicit questions with the evidence bearing on each, and packages the documentation-of-rationale items a disposition file needs.

This skill provides workflow discipline and analytical structure. It produces draft work product for review by the firm's compliance function and a supervising attorney. This is not legal advice and not an alert disposition. The skill never decides that activity is or is not suspicious — the compliance officer decides. Any decision about whether to file a suspicious activity report, and any drafting of such a report, is outside this skill and belongs to compliance and counsel.

Use When

• A user says "triage this transaction-monitoring alert," "work through these TM alerts," or "help me document this alert review."
• A monitoring rule or scenario has fired on an existing customer and a first-pass, structured review is needed before the compliance officer dispositions the alert.
• An analyst needs the customer's expected-activity baseline organized against observed activity so the disposition rationale can be documented.
• A small batch of related alerts on the same customer needs to be organized into one coherent triage file.

Required Inputs

• The alert record(s): the actual alert data — the alert identifier, the monitoring rule or scenario that fired, its parameters or thresholds as stated in the alert or the firm's rule documentation, the review window, and the triggering transactions. If no alert record is provided, stop and request it.
• The customer profile: the KYC file or a current extract — customer type, current risk rating, the expected-activity or anticipated-transaction baseline recorded at onboarding or last review, and the nature of the relationship. If no profile is provided, stop and request it; expected-versus-observed comparison is the core of the triage.
• Transaction data for the review window: the triggering transactions and enough surrounding activity to give context, with dates, amounts, channels, and counterparties as recorded.
• The firm's alert-triage or investigation procedure: the firm document setting out disposition options, escalation criteria, and documentation requirements. If not provided, stop and request it. Do not apply triage criteria from model background knowledge.
• Prior alerts and dispositions (optional): the customer's alert history, if available.
• Screening results (optional): sanctions, PEP, and adverse-media results for the customer and alert counterparties, if a run has been completed. The skill does not perform live screening.