An immigrant residing in the United States opens a bank account that includes a debit card. Several months later, the transactional monitoring system identifies small deposits into the account followed by corresponding ATM withdrawals from a country bordering a conflict zone. How should the bank respond?

When a transaction monitoring system flags potentially suspicious activity, the standard and required procedure is to conduct an investigation. This investigation serves to determine whether the activity is inconsistent with the customer's profile and if there are reasonable grounds to suspect a connection to illicit activities, such as terrorist financing. The combination of red flags (small deposits, immediate withdrawals, high-risk jurisdiction) warrants a thorough review. Filing a report (B) or blocking an account (A) without first investigating the alert is premature. The investigation is the critical step to validate the suspicion before taking further action, such as filing a suspicious transaction report (STR).

A. Block any further activity: This is an extreme measure that should only be taken after an investigation confirms illicit activity or upon legal instruction, as it can alert the customer.
B. File a suspicious transaction report: Filing an STR is the outcome of an investigation that confirms suspicion. The initial alert requires investigation first to substantiate the suspicion and avoid defensive filing.
D. Contact the customer if the transaction activity continues: Contacting the customer about suspicious activity carries a high risk of "tipping off," which is illegal in many jurisdictions and could compromise an investigation.

1. ACAMS CAMS 6th Edition Study Guide. Chapter 4, "Conducting the Investigation," outlines the standard process following an automated alert. It states, "Once an institution’s AML/CFT monitoring system or an employee identifies unusual activity, the institution should have a policy and procedure for the investigation of that activity to determine whether the filing of a suspicious transaction or activity report is necessary." (p. 218). This confirms that investigation is the correct initial response to an alert.

2. Financial Action Task Force (FATF). FATF Recommendations (Updated October 2021). Recommendation 20 and its Interpretive Note require reporting when an institution "suspects or has reasonable grounds to suspect" illicit activity. The process of forming "reasonable grounds" is the investigation that follows an initial indicator or alert. The investigation substantiates the suspicion required for reporting.

3. The Wolfsberg Group. Frequently Asked Questions (FAQs) on Risk Assessments for Money Laundering, Sanctions and Bribery & Corruption (2015). The document emphasizes a risk-based approach where alerts and potential issues are reviewed and investigated. It states, "The purpose of transaction monitoring is to monitor customer transactions, on a periodic and ongoing basis, in order to detect unusual or suspicious transactions which may warrant further investigation." (p. 17). This highlights investigation as the step following detection.