Escalate to filing when the evidence cannot reasonably explain the activity through legitimate customer behaviour and the case record supports that conclusion. The decision should follow a defined approval path, because inconsistent escalation creates both under-reporting risk and unnecessary filings that dilute analyst attention.
What makes a suspicious activity case ready for filing?
A case is ready for filing when the facts no longer point to a plausible legitimate explanation, and the record can show why the activity crosses the organisation’s filing threshold. That usually means the narrative is consistent, the indicators are corroborated, and the reviewer can defend the decision without relying on intuition alone.
The practical test is not whether the activity is unusual, but whether the evidence supports an external reportable concern after reasonable explanation has been ruled out. Good filing decisions therefore depend on both case quality and decision discipline, not on volume or analyst instinct.
What evidence should sit behind the escalation decision?
The strongest cases typically combine transaction pattern anomalies, customer profile mismatch, adverse information, or internal alerts that reinforce one another. A single weak signal is usually not enough; filing becomes appropriate when multiple facts point in the same direction and the case file preserves that linkage clearly.
That record should explain what was observed, what was checked, what benign explanation was considered, and why the remaining explanation was not sufficient. In practice, this matters because a filing decision must be auditable after the fact, especially when later reviewers or regulators ask why the case was escalated.
Where the organisation uses a defined review path, the escalation should align with that process rather than bypass it. FATF Recommendations and the AML/KYC framework provide the policy context for suspicious transaction reporting, customer due diligence, and the expectation that suspicious activity decisions are based on documented grounds.
When does the threshold tip from review to filing?
The threshold tips when additional internal checking no longer improves the explanation enough to change the conclusion. At that point, keeping the case open only delays action and can weaken the timeliness of reporting, especially when the same pattern keeps repeating or the risk of dissipation is rising.
Filing should also be considered when the case shows a credible link to concealment, layering, third-party use, or other behaviours that make innocent explanation less likely. Those patterns do not prove wrongdoing by themselves, but they do increase the weight of the case when the facts already fail to support a reasonable legitimate account.
For practitioners, the decision should be tied to consistency: similar fact patterns should lead to similar outcomes unless a documented distinction justifies a different result. That is what keeps escalation from becoming either over-inclusive noise or an under-responsive control.
Risk and Threat Considerations
Inconsistent escalation creates two opposite failures: under-reporting, where reportable activity is missed, and over-filing, where false positives consume attention and reduce confidence in the process. Both weaken the control environment because they make it harder to trust the filing queue as a serious risk signal.
Failure mechanism: The organisation either over-relies on subjective judgement or under-weights the case record, so similar fact patterns are treated differently and the filing threshold drifts over time.
Impact: That drift can expose the organisation to regulatory criticism, missed suspicious activity, and inefficient use of analyst capacity, while also making quality assurance and management review harder to defend.
Practitioner Guidance
Decision rule: If the case cannot be reasonably explained by legitimate behaviour after documented review, escalate it for filing rather than leaving it in limbo. If the explanation is still plausible, keep investigating until the record can support one clear conclusion or a documented non-filing decision.
What to verify: Confirm that the case note shows the key facts, the benign hypotheses tested, and the reason those hypotheses were not accepted. A filing decision is strongest when another reviewer can follow the logic without reconstructing the case from memory.
Common mistake: Treating filing as a judgment of guilt instead of a reporting decision. The real question is whether the evidence supports a suspicious activity report, not whether the customer is definitively involved in wrongdoing.
Practitioner takeaway: Escalation should be driven by defensible evidence and consistent thresholding, because the value of the filing process depends as much on disciplined exclusion as on timely inclusion.
Related resources from NHI Mgmt Group
- How do organisations decide when to refuse a suspicious ID and escalate the case?
- When should organisations escalate suspicious Salesforce activity to an incident response process?
- How should banks design fraud detection to catch suspicious activity before losses escalate?
- Why does suspicious LDAP activity matter for identity security?