When reviewing an alert for potential suspicious activity do you focus on only the suspicious activity that has been flagged or do you look at the entire account/history? If so, do you input this information into the narrative?

I have heard a few trains of thought:

1. Just review the suspicious activity. It increases the liability if you widen the scope and look at other accounts and potentially miss something.
2. Complete a cursory review of all accounts/history and notate this in the narrative.

It's usually best to take a wider view because an alert is generated off specific conditions. I always take a look for similar activity within recent months that may not have been picked up, while on the other hand, my co-worker will review all transactions over the last six months for activity not necessarily of the same character but indicative of money laundering, etc. The difference between the two methods is time spent. If you have the staff, the latter is a good practice, but if you don't, the former I believe is reasonable.

I am not sure how you can only look at an alerted transaction(s). A single transaction or series of transactions may not appear to be suspicious when taking an isolated look, but when you expand the scope of your review, they may appear to be suspicious.

Do you look across all accounts or just the account that the transactions were flagged on? For example, if a member had 18 accounts, would you look across all accounts?

A wise rule of thumb is to remember to "follow the money." If you have an alert for a spike in cash deposits, ACH, or incoming wire, I would want to know the source of those deposits and see how the customer spent that money. Alternatively, an alert for a spike in cash withdrawals, ACH Debits, or sent wire, I would want to know the purpose of those transactions and review account history to see where the money came from that funded those transactions. That may or may not involve all 18 accounts.

tgray - I can tell you what we generally do, but it may not be appropriate for your shop. We have a 3T systems of alert, case, SAR/No SAR.

At the alert level, we look at thirty days of activity, at a minimum. We only extend past 30 days if we are unable to determine the source or ultimate usage of the funds. Meaning, if a cash deposit triggered the alert, the analyst must analyze the usage of the funds after the deposit (Assuming they did spend the funds). For outgoing flagged activity, the analyst must review the source of funding. We only bring in associated accounts if there is a transfer between the flagged account.

If the activity appears to be unusual, it is escalated to a case, and an investigator will review 120 days of activity to make a SAR/No SAR decision. Again, we only bring in associated accounts if there is a transfer between the flagged account.

We also conducted relationship reviews based on client risk, and those reviews are conducted periodically based on the current client risk. This is where we would include the 18 accounts in your example.