Alert Disposition

Alert disposition is the decision an analyst makes and records when finishing the review of an alert raised by a transaction monitoring scenario, a sanctions screening tool or a fraud system. The disposition says what the alert turned out to be, for example a false positive, a true match that needs further investigation, or activity that was unusual but explained, and it carries a written rationale and supporting evidence.

The word comes from operations and compliance practice rather than from any statute, and it is used both as a noun (the outcome) and as a verb ("disposition the alert"). Dispositions are the main audit trail examiners use to judge whether a firm's AML program is working. They are distinct from the later decision on a full case, which is where a firm decides whether to file a suspicious activity report.

Picture a smoke alarm in a large office. When it goes off, someone has to go and look, and then write down what they found: burnt toast, a faulty sensor, or a real fire that needed the fire brigade. The alarm itself does not know which it was. The note in the logbook is what tells the building manager, and later an inspector, that each alarm was checked properly.

Alert disposition is that logbook entry for financial crime alerts. The software raises the alarm when a payment or customer looks unusual. An analyst checks it, picks an outcome from a short list and writes why. If the note says "burnt toast", it should explain how the analyst knew; if it says "fire", the matter is passed to investigators.

Firms define their own list, but most fall into a few groups:

• False positive. The alert logic fired, but the activity is not suspicious, for example a known payroll run or a name that only resembles a sanctioned person.
• Closed, explained. The activity was unusual for the customer but has a documented legitimate reason, such as a house sale.
• Escalated. The analyst cannot rule out suspicion and moves the alert into a case for deeper investigation in the case management system.
• True match (screening). For sanctions screening, the party is confirmed as the listed person, so the payment is blocked or rejected and reported as required.
• Confirmed fraud. For fraud alerts, the transaction is confirmed as unauthorised or scam-related, triggering account action and loss recovery.

Many firms also record a reason code alongside the outcome, such as "matches expected activity" or "linked to existing case", so that patterns can be analysed later.

An analyst reviewing an alert usually works through a short sequence:

1. Read the alert details and the scenario that triggered it.
2. Compare the activity with the customer's profile from onboarding and customer due diligence, including occupation, expected turnover and past behaviour.
3. Look at counterparties, countries and linked accounts, and check internal notes and earlier alerts.
4. Where policy allows, contact the relationship manager or ask the customer for an explanation or documents.
5. Choose a disposition, write the rationale and attach evidence.

A good rationale says what was looked at and why it settles the question. "Reviewed, nothing unusual" is the kind of note that examiners criticise. Many firms apply maker-checker controls, so that a second reviewer approves escalations or a sample of closures, and they restrict who can close high-risk alerts through role-based access control.

Disposition data is one of the main inputs to managing a monitoring program. Quality assurance teams re-review a sample of closed alerts to check that the decisions and notes meet the standard. The share of alerts escalated or converted into reports for each scenario is used in transaction monitoring tuning: a scenario whose alerts are almost always false positives is a candidate for recalibration. Dispositions also feed the measurement of misses, because a later case that a closed alert should have caught is evidence of a false negative in the human review step, not only in the software.

Speed matters too. In the US, a SAR is generally due no later than 30 calendar days after the firm first detects facts that may justify filing, so slow dispositions can push cases toward the deadline. When alerts arrive faster than analysts can close them, the result is an alert backlog.

Supervisors such as FinCEN, the federal banking agencies and the UK's Financial Conduct Authority do not prescribe disposition codes, but they expect each decision to be explainable and the records to be kept for the required period (five years for most US BSA records). Weak or copy-pasted dispositions appear regularly in enforcement actions and in findings from an independent AML review. When automation is used to auto-close low-risk alerts, firms are expected to document the logic and test it the same way they would test a human reviewer.

• Financial Crimes Enforcement Network (FinCEN)
• Financial Conduct Authority