AML Case Management Without the Two-Hour Assembly

$5.4M to $6.5M per year in investigation cost reduction.

And 36,000 to 44,000 analyst hours moved off assembly work and onto judgment.

Clearing the noise is only half the AML problem. The other half is what happens to the alerts that survive triage, and this is where a bank's most experienced people do their least valuable work.

• Roughly 25,000 alerts a year escalate into real investigations. And what happens next is almost entirely assembly: KYC profile from one system, transaction history from another, counterparty records from a third, adverse media by hand, then a timeline pieced together.
• Two hours for a standard case, past twenty for a complex one. At one global bank analysts averaged four hours per alert, most of it spent ruling things out rather than establishing anything.
• $435 per escalated investigation, about $10.9M a year. But the money was not the point. The people qualified to spot a laundering network were spending their week doing data entry, and the ones who were good at it burned out and left.
• Time to detection suffered. A case sitting in an assembly queue is a case not being decided, and in AML the interval between the activity and the filing is a number the regulator looks at directly.
• Narrative quality became uneven. When narrative writing is a manual craft under backlog pressure, SARs vary by author. The SAR FAQs FinCEN issued on 9 October 2025 clarified expectations on completeness, including that critical items be answered or affirmatively marked unknown, and a thin filing invites a second look at the whole programme.
• The bank did not want the investigator out of the decision. It wanted everything that happened before the decision taken away.

• Every alert gets triaged, and noise clears with a documented rationale. Genuine risk is enriched, classified, and escalated to a human as a near-complete case, so the analyst's day stops being a queue to empty.
• Evidence assembly happens before a person opens the case. KYC profile, transaction history, counterparties, and adverse media consolidated in parallel rather than pulled from three systems by hand.
• Activity is classified against known typologies. And against the bank's own scenario library, so the disposition carries a typology rationale rather than a score.
• Separation of duties is a defensibility requirement. An examiner needs a clean split between gathering evidence, classifying risk, and reaching a conclusion. That is why it is many narrow agents rather than one model.
• Analysis runs inside the bank's boundary. Control plane and storage sit in the bank's region, each investigation in its own guest kernel, with egress allowlisted in the kernel so transaction data cannot leave.
• The filing decision stays with a human. Permanently and by design. The agents assemble, classify, and draft. The person decides.

The filing decision stays with a human, permanently and by design. What changed is what the investigator is holding when they make it.

• Standard investigation from two hours to 48-60 minutes. And complex cases from twenty-plus hours to eight to ten, a 50% to 60% compression on escalated work.
• SAR narrative drafting from hours to minutes. Because the narrative is assembled from evidence the crew has already gathered rather than composed from a blank page.
• $5.4M to $6.5M a year off a $10.9M base. Cost per escalated investigation falls from roughly $435 to between $174 and $218.
• 36,000 to 44,000 investigator hours returned. A redeployment argument, not a headcount one, and a different kind of hour from those recovered by clearing false positives. These belong to the bank's most experienced people.
• Time to detection improved 35% to 50%. A target measured against the bank's own Phase 0 baseline, not a borrowed industry benchmark. This is the number that matters most to an examiner, because catching genuine activity faster is what the regulator rewards.
• Every draft is built from the same evidentiary structure. Which removes the author-to-author variance of writing narratives by hand under backlog pressure. Against the SAR FAQs FinCEN issued on 9 October 2025 with the Federal Reserve, FDIC, NCUA and OCC, which clarified what a complete filing looks like, consistency is not cosmetic.
• 100% of decisions replayable, including recommendations not to file. The investigator's judgment sits on top of an inspectable evidentiary chain rather than a black-box conclusion.

Phase 0 measures the bank's actual investigation time per case, cost per case, SAR volume, current time to detection, and its own narrative quality bar. That baseline becomes the contract's yardstick.

Build and integration to the monitoring system, KYC store, transaction data, and enrichment providers runs along allowlisted paths. Shadow mode follows, with agents assembling cases in parallel with the human team and producing draft narratives that are never filed. Agent dispositions are compared to investigator dispositions case by case. Go-live is gated on disposition agreement and narrative quality, not on speed.

Success criteria, agreed up front against the Phase 0 baseline: investigation time down at least 50%, no change in disposition accuracy against the human team, draft narratives meeting the bank's existing quality bar without additional rework, and 100% audit coverage of every decision.