Guides
Investigate and close a case
Assembling context, recording action, and closing with the evidence still attached.
Written for: Analysts and MLROs
Written from docs/case-workspace.md
A case gathers everything about one subject: the customer record and ownership, the alerts and screening hits, the transactions in scope, notes and evidence. It is assembled rather than assembled-by-you, which is the point — an investigation whose context was gathered by hand cannot be reconstructed by anyone else.
Working a casePermalink to this section
- 1
Take ownership
Assignment is recorded. Reassignment adds to the history rather than replacing it.
- 2
Record as you go
Notes and evidence accumulate against the case. Nothing is edited away; a correction is a new note.
- 3
Decide
A disposition with its rationale and its author.
- 4
Escalate or close
Escalation may produce a regulatory report; closure retains everything the decision rested on.