Abrigo's Kevin Gulledge, CAMS, a Principal Consultant who advises financial institutions on Bank Secrecy Act (BSA)/AML, fraud, and compliance programs, and Kimberly Harrison, CAMS, a Senior Financial Crimes Investigator with hands-on experience in BSA/AML investigations and SAR filings, explored the issue in a recent webinar on fragmented investigations. They offered the following advice for those working in AML/CFT and fraud areas at financial institutions.
Where the alert analysis splits
Investigators often work alert by alert while critical context sits somewhere else. Gulledge and Harrison said financial institutions experience several places where the customer or member story breaks apart:
- Alerts are reviewed without access to related cases or prior dispositions.
- Accounts and products are separated from customer relationship data.
- Know your customer (KYC), ownership, and beneficial owner changes live in different systems.
- Transaction activity is divided by channel, geography, or line of business.
- Counterparties and connected customers or members are difficult to trace.
- Investigator notes and rationale are not reusable in the next review.
A common scenario in which fragmentation extends investigations is when a colleague who worked on an alert has moved on from the institution, Harrison said. Nobody can explain the reasoning described in the notes, so the next investigator has to review the entire client relationship again. Multiply that by every handoff, and the duplicate research becomes a standing cost for a bank or credit union.
The time cost adds up. In an informal poll during the webinar, 47% of respondents said searching across systems for customer context takes the most investigative time. Another 32% named reconciling alerts, cases, and prior dispositions, and 15% named re-researching customers they had already reviewed.
“We're really spending a lot of time just collecting data,” Harrison said. “We've got all kinds of activities that can be costing us extra time and energy.”
The different goals of AML and fraud teams, especially when they operate separately, can also contribute to fragmentation. AML teams often measure success by their ability to maintain regulatory compliance through alert-to-SAR ratios, successful audits, and SAR or data quality. Fraud departments, meanwhile, may focus on providing the customer or member with a positive experience, including making sure the customer or member is protected. Fraud teams may also prioritize preventing losses to the bank or credit union and limiting work tied to false-positive alerts.
Fraud and AML teams often look for different red flags, too, even as they evaluate the same risk. Fraud teams watch for account takeovers, device changes, payment velocity, and mule behavior. AML/CFT red flags include signs of structuring, rapid movement of funds, unusual counterparties, specific geographies, and mismatching profiles. Without connecting red flags spotted across fraud and AML teams, investigators can miss valuable information that explains the risk.
