Transaction monitoring alert triage against your disposition rules
For each alert, the agent gathers the transactions, the customer profile and past alerts, applies your disposition rules, and sends anything unusual to an analyst with the context already assembled.
Works with
- Custom REST
- Monitoring system · via Custom REST
- Case system · via Custom REST
and any system with an API via Custom REST
What is transaction monitoring alert triage?
The procedure
Your monitoring system raises an alert when activity crosses a rule or a score. Triage is the first look: an analyst gathers the transactions, the customer's expected activity and past alerts, then recommends closing the alert or escalating it. Gathering that context takes time before anyone can judge the alert.
What the agent does
Pulls the alert and recent transactions through Custom REST
Reads expected activity and earlier alerts from your case system
Screens counterparties in ComplyAdvantage
Applies your disposition rules and drafts the rationale or case summary
What your team decides
Confirming each closure the agent recommends
Escalating activity the profile does not explain
Whether a counterparty screening hit stands
Any decision to report suspicious activity, made by your MLRO or compliance officer
Example runs for transaction monitoring analysts, MLROs or compliance officers, and financial crime teams
Alert Triage Agent
Gathers context for each alert and applies your disposition rules.
- API
- +1
Trigger: Inbound webhook · new alert
From a procedure Alert triage · v1.2
Marcus
Triage the new alert on the Halden Trading account.
Alert Triage Agent
- Pulled the alert and the last 90 days of transactions through Custom REST
- Pulled the customer profile and expected activity from the case system
- The pattern matches the customer's stated payroll activity
alert.pattern in profile.expected - Saved the rationale to the case folder and queued the closure for an analyst to confirm
Closure recommended. The alert matched expected activity under your disposition rules. An analyst confirms the closure, and a sample goes to QA.
4 steps · 0 reviews
Alert Triage Agent
Gathers context for each alert and applies your disposition rules.
- API
- +1
Trigger: Inbound webhook · new alert
From a procedure Alert triage · v1.2
Priya
Triage the new alert on the Corvid Freight account.
Alert Triage Agent
- Pulled the alert and the last 90 days of transactions through Custom REST
- Pulled the customer profile and earlier alerts from the case system
- Activity is outside the customer's expected profile
alert.score > policy.review_above - Routed to an analyst: the score is above your review threshold Waiting for a reviewerTom: unexplained, escalate to your MLRO or compliance officer
- Assembled the case summary and saved it to the case folder
Escalated. Tom could not explain the activity, so the case went to your compliance officer with the summary and transactions attached.
5 steps · 1 review
Alert Triage Agent
Gathers context for each alert and applies your disposition rules.
- API
- +1
Trigger: Inbound webhook · new alert
From a procedure Alert triage · v1.2
Diego
Triage the new alert on the Lumen Print account.
Alert Triage Agent
- Pulled the alert and the counterparty details through Custom REST
- Screened the counterparty in ComplyAdvantage: 1 possible match
- Sent the hit to an analyst before any disposition Waiting for a reviewerLena: possible match not ruled out, escalate
- Recorded the decision and linked the screening result to the alert
Escalated. A screening hit on the counterparty took the alert to Lena, who escalated it. The alert and the screening result are linked.
4 steps · 1 review
Setting up the Alert Triage Agent
Connect your systems
Read alerts and transactions from your monitoring system through Custom REST, screen counterparties in ComplyAdvantage, and keep the case summary in Google Drive.
- Custom REST
- Monitoring system · via Custom REST
- Case system · via Custom REST
Write the rules
Your disposition rules are CEL conditions. Expected activity gets a closure recommendation; a high score or a screening hit goes to an analyst.
alert.score > policy.review_aboveAsk an analystscreening.hits > 0Ask an analystalert.pattern in profile.expectedRecommend closureAdd reviewers where the procedure says
The analyst receives the transactions, profile and history already gathered, and the disposition is logged with their reason.
Review requested: Corvid Freight alert
- Reason
- Activity outside the expected profile
- Rule
- alert.score > policy.review_above
- Procedure
- Alert triage · v1.2
Close with rationaleEscalate
Start it from the event
Each new alert from your monitoring system starts triage through a webhook. An hourly schedule picks up alerts still unassigned, and a reopened alert starts a fresh run.
- Inbound webhook · new alert
- Every hour · alerts still unassigned
- Inbound webhook · alert reopened
Version and evaluate
Build scenarios from alerts your team has already worked, such as payroll activity, an unexplained pattern and a listed counterparty. A new version publishes only when they pass.
Alert triage · v1.2Published
12/12 scenarios passed
Alert triage · v1.2 Superseded
Alert triage · v1.1 Superseded
Share with the team
Monitoring analysts confirm closures and escalations, financial crime leads author the disposition rules, and auditors read each alert's run, rationale and version.
Admin
Author- Reviewer
Auditor
Questions about transaction monitoring alert triage
Does the agent close alerts?
No. It can recommend closure when activity matches the customer's expected profile, and an analyst confirms it. The rationale is saved to the case folder either way.
Does Verkflo raise the alerts?
No. Alerts come from your monitoring system. Verkflo reads them through Custom REST and runs your triage procedure on each one.
What does the analyst receive?
The alert, the transactions, the customer profile, earlier alerts and any screening result, gathered before the run pauses. Their disposition and reason go into the audit log.
Can unassigned alerts be picked up?
Yes. An hourly schedule picks up alerts that are still unassigned, and a webhook starts triage again when an alert is reopened.
Controls your auditors will ask about
These controls apply to each agent you build. Sample data
- Admin
- Author
- Reviewer
- Auditor
Role-based access
Admin, Author, Reviewer and Auditor roles, scoped to each workspace.
- 41
7c2e… - 42
a91f… ← 7c2e - 43
03d8… ← a91f
Hash-chained audit log
Each entry carries the hash of the one before it. Verifying the log recomputes the chain and flags entries that no longer match.
- 41
- v1.1v1.2v1.3Published
Versioned specs
Each run records the exact version it followed; old versions stay readable.
- vault/sumsub/key
Secrets in a vault
Steps point to a vault path, and the key stays in the vault.
- Signed delivery accepted
- Unsigned delivery rejected
Signed webhook triggers
Unsigned or stale deliveries are rejected before a run starts.
- SandboxLive
Sandbox before live
New versions run on test data first. Going live is a separate step.
Related use cases
-
KYC onboarding reviewCheck documents, screen the applicant and apply your risk rules, with a reviewer where the procedure asks.
-
KYB and beneficial ownershipMap owners and controllers above your threshold, screen each one and flag gaps for a reviewer.
-
Sanctions screeningScreen counterparties before the first payment and send each possible match to a person.
Run this procedure as an agent
Book a demo with your own version of this procedure, and we'll show it running with each step logged.
Book a demo