Funds tracing alerts need a durable review process. Tie each observation to its source transaction, preserve the evidence snapshot and give the resulting case an owner. This guide covers triage and queue operations. For interpreting the underlying path, use the exposure evidence guide; for data representation, use the tracing data model.
Separate delivery identifiers from case identifiers
A repeated notification should not open another investigation. Deduplicate delivery using the documented provider identifier, then link the observation to a stable internal case. Several observations may belong to one case, and one later update may change its evidence. Preserve these relationships so queue volume reflects review work rather than webhook retries.
Store an evidence snapshot before assigning a decision
Keep the original response, chain, address, starting transaction, assessment time and any documented data version. Add the policy version applied by your system. Retain unknown or incomplete coverage explicitly. An empty response, a failed request and a completed assessment with no identified issue are different outcomes.
Map signals to a review queue
Define categories that correspond to your operational process and assign an owner for each route. Keep technical failures in an operational queue if they require infrastructure work rather than an analyst conclusion. Risk signals can prioritize review, but a numerical score should not be presented as proof of identity or wrongdoing. Confirm the available fields through AML Intelligence.
Handle changed scores without losing case history
Add a new assessment to the existing case when new evidence arrives. Record which data and policy produced each decision. A repeat delivery should leave the decision unchanged; a changed exposure path may require another review. Keep automated actions idempotent and make irreversible actions require the appropriate authorization in your operating process.
Define escalation and unavailable-data behavior
Set an owner and an expected next step when tracing times out, lacks coverage or produces contradictory evidence. The business must choose how to handle that uncertainty for its own workflow. A failed lookup must not silently become a low-risk result. Keep the reason for a hold, review or escalation visible to the authorized reviewer.
Test triage under retries and delayed evidence
Replay the same delivery, deliver updates out of order and simulate a provider outage. Confirm that one case retains all relevant evidence without duplicate actions. Measure queue age, unresolved technical failures and cases needing manual review. Use those observations to adjust staffing and controls rather than claiming the API eliminates investigation work.
Frequently Asked Questions
Should every tracing alert create a new case?
No. Define stable case grouping and delivery deduplication rules. A repeated delivery is different from new evidence that warrants another assessment.
What happens if a tracing check is unavailable?
Preserve the unavailable status and follow the workflow’s documented escalation rule. Do not replace an error or missing coverage with a low-risk score.
Can triage be fully automated?
Some routing can be automated, but the operating model must identify decision owners and authorization for consequential actions. Test the limits of automation with realistic uncertain cases.