Suspicious Activity Investigation

A suspicious activity investigation is the inquiry that a bank, payment firm or other regulated business carries out when a customer's behaviour or a transaction has been flagged as possibly connected with money laundering, terrorist financing, fraud or sanctions evasion. Its purpose is to establish the facts, to decide whether there are grounds for suspicion that must be reported to the authorities, and to determine what the firm should do about the customer. It is carried out by the firm's financial crime compliance or financial intelligence team.

The investigation is the middle stage of a longer process. It follows detection, through transaction monitoring, screening or a staff referral made by suspicious activity escalation, and it precedes the reporting decision. It is an internal, private-sector inquiry, distinct from a criminal investigation by law enforcement, although its output often becomes the starting point for one.

Most cases begin as automated alerts that could not be closed at first review, a filtering step described under alert triage. Others originate from branch or relationship staff, from adverse media, from enquiries by law enforcement such as production orders or subpoenas, from information shared by another institution, or from a correspondent bank's request for information about a payment. A single case may combine several alerts on the same customer or on a group of connected customers.

Although procedures vary, an investigator typically works through the following:

1. Scope the case. Identify the subject, connected accounts and parties, and the period under review.
2. Review customer information. Compare the activity with what the firm knows about the customer's identity, business, ownership, expected turnover and source of funds.
3. Analyse transactions. Examine the pattern, counterparties, geography and purpose of the flows, looking for known typologies such as structuring, rapid movement of funds or unexplained third-party payments.
4. Search external sources. Check company registries, sanctions and adverse media sources, and, for crypto assets, use blockchain analytics.
5. Seek clarification where appropriate. Request information from the customer through the relationship manager, taking care not to reveal that suspicion exists.
6. Conclude and document. Record the findings, the reasoning and a recommendation.

The work is recorded in a case management system, which holds the evidence, the narrative and an audit trail of decisions. The analytical methods used are described under financial intelligence analysis.

The investigator recommends one of a small number of outcomes, recorded as the alert disposition. If the activity has a reasonable explanation, the case is closed with reasons. If suspicion remains, the case goes to the money laundering reporting officer or an equivalent decision-maker, who decides whether to file a suspicious activity report, known in many countries as a suspicious transaction report, with the national financial intelligence unit.

Separately, the firm decides how to manage the relationship. Options include applying enhanced due diligence, restricting products, increasing monitoring or ending the relationship. In some jurisdictions the firm must obtain consent from the authorities before completing a transaction it suspects involves criminal property.

The test for reporting is suspicion, not proof. An investigator does not need to identify the underlying crime or to show that an offence occurred; it is enough that there are reasonable grounds to suspect it. This low threshold is deliberate, as the firm's role is to pass on information, not to prosecute.

Timing is regulated. In the United States, a report must generally be filed within 30 calendar days of the date on which facts supporting a filing were first detected, extended to 60 days where no suspect has been identified. Guidance suggests a follow-up report on continuing activity after each 90-day period, although the regulator confirmed in 2025 that this timetable is not mandatory. Other countries require reporting promptly or as soon as practicable. Firms therefore set internal deadlines for each stage and track ageing cases, since an alert backlog that delays reports is a frequent subject of enforcement.

The existence of an investigation and of any report must be kept from the customer. The anti-tipping-off rule makes disclosure an offence in many countries, and it shapes how questions are put to customers and how account closures are explained. Access to case files is restricted, and laws usually protect firms and staff from liability for reports made in good faith.

Regulators assess investigations on their reasoning and records. Common criticisms are narratives that describe transactions without explaining why they are suspicious, cases closed on unverified customer explanations, failure to look across related accounts, and defensive reporting of matters that were never properly examined. Quality assurance sampling, investigator training and feedback from investigations into monitoring rules are the usual responses.

• Financial Action Task Force
• Financial Crimes Enforcement Network