Case Management System

A case management system (CMS) in financial crime compliance is software that collects alerts from monitoring, screening and fraud tools, lets analysts group them into investigations, records every step and decision, and supports the filing of regulatory reports. It is used by anti-money laundering, sanctions and fraud teams at banks, payment firms, money services businesses, crypto exchanges and insurers.

A CMS sits downstream of detection. A transaction monitoring system decides which activity looks unusual; the case management system is where people decide what it means and keep the evidence. Some vendors sell both in one platform, while other firms connect separate tools. The same term is used in other industries, such as healthcare and law, for unrelated software.

Think of a detective's office. Tips come in from many places: phone calls, letters, people walking in. The detective opens a folder for each matter, puts every tip about the same person in that folder, adds photos and notes, and writes down what was decided and why. When the chief asks about a case months later, the folder tells the whole story.

A case management system is that filing cabinet and desk, in software. Alerts arrive from the bank's various warning systems. The system sorts them into folders, usually one per customer or scheme, gives each to an investigator, and keeps a record of everything that was looked at. When a report has to go to the authorities, the system helps write it and stores a copy.

• Alert intake. Feeds from transaction monitoring, sanctions screening, fraud engines, staff referrals and law enforcement requests arrive in one queue.
• Consolidation. Related alerts on the same customer, account or network are linked, so that one investigation covers them all.
• Customer view. The analyst sees know-your-customer data, risk rating, account history and earlier cases on one screen instead of searching several systems.
• Workflow. Alerts and cases move through defined states (new, in review, escalated, closed) with assignment rules, deadlines and maker-checker approvals.
• Evidence and notes. Documents, screenshots, customer responses and the written rationale for each alert disposition are attached to the record.
• Reporting. Draft narratives and data fields for a suspicious activity report or its local equivalent, often exported to the financial intelligence unit's filing system.
• Audit trail. Every view, edit and status change is logged with user and time.

1. One or more alerts arrive and are triaged by score, age and risk.
2. Level 1 analysts review alerts and close false positives or escalate.
3. Escalated alerts become a case for a Level 2 investigator, who gathers more information, may request documents from the customer and may look at linked parties.
4. The investigator recommends filing or not filing a report, and a senior reviewer or the MLRO approves the decision.
5. If a report is filed, the case records the reference and any follow-up actions, such as exit through offboarding or ongoing review.

In the US, reports are submitted through FinCEN's BSA E-Filing System; many other countries' financial intelligence units use goAML, software developed by the United Nations Office on Drugs and Crime. A CMS that maps its fields to these formats saves manual re-keying.

Because every alert passes through it, the CMS is the main source of figures on workload and quality: alerts received and closed, ageing, escalation rates by scenario, time to file and the size of any alert backlog. These numbers support staffing decisions, transaction monitoring tuning and reporting to senior management and the board. Fraud teams also use case data to track losses and recoveries by fraud typology.

Access control matters. Case files contain sensitive data, and in many countries the fact that a report has been filed must not be revealed to the customer, so firms restrict access through role-based access control and log every view. Record keeping must follow the firm's data retention schedule; US BSA rules generally require SAR records and supporting documents to be kept for five years from filing.

Firms weigh build versus buy, integration with core banking and onboarding systems, configurability of workflows, and how easily examiners and an independent AML review can trace a decision. Newer tools add network graphs, automated data gathering and suggested narratives. These can raise productivity, but firms remain responsible for the final decision and for checking any generated text. Poor data migration is a common problem when a firm switches systems, as historic cases and links between alerts can be lost.

• Financial Crimes Enforcement Network (FinCEN)
• United Nations Office on Drugs and Crime