AML Compliance KPIs: 12 Metrics Every BSA Team Should Track
12 AML compliance KPIs every BSA team should track, from alert-to-SAR conversion and SAR timeliness to QA defect rate and cost per alert.
TL;DR: An AML investigation process turns an alert into a defensible decision through ten steps: intake, L1 triage, escalation to L2, scoping the subject and related parties, evidence gathering, 314(b) requests, typology analysis, documentation, the file or no-file decision, and QA with continuing activity review. The FFIEC BSA/AML Manual expects a clear escalation path from initial detection to disposition, and the SAR is due 30 calendar days after the bank determines activity is suspicious. FinCEN received approximately 4.7 million SARs in fiscal year 2024, each one the output of this process.
What an AML Investigation Actually Decides
An AML investigation is the work a financial institution does between an alert of unusual activity and a decision on whether that activity is suspicious enough to report. The output is a disposition: close the alert, file a SAR, or keep watching. The investigation does not have to prove a crime. The FFIEC BSA/AML Manual's suspicious activity reporting section states that banks are not obligated to investigate or confirm the underlying crime, because that is the responsibility of law enforcement. The bank's job is narrower: establish what happened, whether it has a reasonable explanation, and whether it meets a reporting ground.
The FFIEC Manual describes five interdependent components of an effective monitoring and reporting system: identification of unusual activity, managing alerts, SAR decision making, SAR completion and filing, and monitoring and filing on continuing activity. The investigation process sits across the middle three.
A small bank may run all ten steps below through one analyst. A large bank may split them across intake teams, L1 and L2 investigators, and a SAR committee. The sequence is the same.
The Ten Steps at a Glance
- Intake the alert or referral and register a case.
- Triage at L1: close what has a documented explanation.
- Escalate to L2 with a written reason.
- Scope the subject, related parties, and review period.
- Gather KYC, transaction, and external evidence.
- Send 314(b) requests where another institution holds the missing piece.
- Analyze the activity against a named typology.
- Document findings and the audit trail.
- Make the file or no-file decision inside the SAR clock.
- Run QA and set the continuing activity plan.
Steps 1 to 3: Intake, Triage, Escalation
Every investigation starts with a source. The FFIEC Manual lists employee referrals, law enforcement inquiries such as grand jury subpoenas and 314(a) requests, regulatory advisories, and the output of transaction monitoring systems. Intake should capture the source, the triggering rule or referral text, the account and customer identifiers, and a timestamp. That timestamp is not day zero for the SAR, but examiners compare it against the decision date to judge whether the review took a reasonable period.
L1 triage answers one question: is there a documented, plausible explanation for this activity already on file? The FFIEC Manual's own examples are a real estate sale, an inheritance, or a gift that produces a credit inconsistent with normal activity, and it notes that a monitoring flag is not initial detection. Triage closes those alerts with a short rationale and escalates the rest.
Escalation to L2 should carry a written reason, not just a status change. "Volume of incoming wires from three unrelated senders inconsistent with expected activity for a sole-proprietor landscaping business" gives the L2 investigator a hypothesis to test. "Escalated per rule 14" does not. The escalation note becomes the first entry in the case file and frames everything that follows.
Step 4: Scope the Subject Before Pulling Data
Scoping decides who and what the investigation covers. The subject is usually the alerted customer, but the case rarely stops there. Related parties include joint account holders, authorized signers, beneficial owners, businesses the subject controls, and frequent counterparties who appear on both sides of the flagged activity. The FFIEC Manual notes that inconsistencies may require a global relationship review, which means pulling every account the subject touches across business lines, not just the alerted one.
Set three boundaries at the start and write them down: the parties in scope, the accounts in scope, and the review period. Written scope prevents two common failures: the narrow review that clears the alerted account while missing the linked account carrying the actual flow, and the open-ended review that never reaches a decision.
Steps 5 and 6: Gather Evidence, Then Ask Other Banks
Evidence comes in three layers. The first is internal customer data: CIP records, CDD and EDD files, expected activity profiles, risk ratings, prior alerts, prior SARs, and any law enforcement requests on file. The FFIEC Manual names CDD and EDD information as the core internal research tools. The second is transaction data across the review period: deposits, withdrawals, wires, ACH, card activity, cash, and monetary instruments, with counterparty details where they exist. The third is external: corporate registries, adverse media, sanctions and PEP screening results, and open-source research on counterparties.
The goal is to fill the gaps in the escalation hypothesis: where the funds originated, where they went next, and whether the stated business explains the counterparties. Each answer should be tied to a specific record.
Some gaps cannot be filled from inside one institution. When funds arrive from or leave to another bank, the counterparty's activity on that side is often the missing piece. Section 314(b) of the USA PATRIOT Act lets registered institutions share information with one another to identify and report possible money laundering or terrorist activity, under a safe harbor. FinCEN 314(b) information sharing requires both institutions to be registered and the purpose to be permitted. According to FinCEN's fiscal year 2024 year-in-review, more than 6,100 institutions were registered for 314(b), and 1,693 of them referenced 314(b) in a total of 48,223 SAR narratives. A good request names the subject, the accounts, the date range, and the specific question. It does not ask for "anything you have."
Step 7: Analyze Against a Typology, Not a Hunch
Analysis turns evidence into a finding. The most reliable way to do that is to map the activity to a named typology: structuring, funnel accounts, money mule activity, trade-based laundering, elder financial exploitation, sanctions evasion, human trafficking, check fraud, or another pattern described in FinCEN advisories. Mapping forces the investigator to compare the facts against known red flags, and it gives the eventual SAR its activity categories in Part II and the key terms FinCEN asks filers to include in the narrative.
A typology is a frame, not a verdict, and the analysis should record facts that cut against it. FinCEN's October 9, 2025 SAR FAQs are explicit that cash activity at or near the $10,000 CTR threshold, by itself, does not require a SAR. The institution must know, suspect, or have reason to suspect the activity is designed to evade reporting. An investigator who writes "deposits between $9,000 and $9,900" without addressing intent has described a pattern, not suspicion.
The analysis ends with a one-paragraph conclusion stating the activity, the reporting ground it meets or misses, and the reasoning. That paragraph is what the decision maker reads first.
Step 8: Write the File So Someone Else Can Defend It
The case file is the investigation. An examiner, an auditor, a QA reviewer, or a successor analyst should be able to reconstruct the decision from the file alone, without asking the investigator. A defensible file contains the intake record, the escalation reason, the written scope, every piece of evidence with its source and retrieval date, the 314(b) correspondence, the typology analysis, the conclusion, the recommendation, and the identity and timestamp of every person who touched the case.
Retention has a regulatory floor. Under 31 CFR 1020.320(d), a bank keeps a copy of any SAR filed and the supporting documentation for five years from the filing date. Supporting documentation is deemed filed with the SAR and must be provided to FinCEN or law enforcement on request. Treat the case file as supporting documentation from day one.
Step 9: The File or No-File Decision
The FFIEC Manual describes the decision step plainly. After research and analysis are complete, findings go to a final decision maker, either an individual or a committee, with authority to make the filing call. The Manual calls the filing decision "an inherently subjective judgment." A bank that follows its own documented process and decides not to file should not be criticized unless the failure is significant or accompanied by evidence of bad faith.
The SAR clock is where investigations most often get into trouble. A SAR is due within 30 calendar days of initial detection of facts that may constitute a basis for filing, extendable to 60 days only when no suspect has been identified. The FFIEC Manual places initial detection at the point when the review establishes that activity is suspicious, not when the alert fired. The review itself still has to be completed in a reasonable period. A detailed walkthrough of the thresholds and the clock is in when to file a SAR.
When the decision is to file, the case file becomes the source for the narrative. The FFIEC Manual calls the narrative section "critical" because it is the only part of the SAR that summarizes the activity. Strong narratives follow the who, what, when, where, why, and how structure covered in how to write a better SAR narrative. When the decision is not to file, the October 2025 FAQs state that the BSA imposes no requirement or expectation to document that decision. Most institutions still record a short statement for QA.
Step 10: QA and Continuing Activity
Quality assurance closes the loop. A QA function samples completed investigations, both filed and closed, and scores them against the standard: was the scope right, was the evidence sufficient, does the conclusion follow, was the clock met. Closed cases deserve particular attention because missed suspicious activity lives there. The design of a sampling plan and scoring rubric is covered in building an AML quality assurance program.
Continuing activity is the last decision on the case. FinCEN once suggested filing on continuing activity at least every 90 days, and later guidance set a 120-day deadline after the prior SAR. The October 2025 FAQs clarified that a separate post-filing review of the customer is not required. Institutions may rely on risk-based monitoring to catch continued activity instead. Institutions that choose the traditional schedule, with a subject identified, file the initial SAR by day 30 and the continuing SAR by day 150. Either way, the FFIEC Manual expects escalation criteria for repeat filings, covering senior or legal review, full relationship review, account closure, and law enforcement notification. A law enforcement request to keep an account open should be in writing.
Where Case Management Software Fits
Teams searching for a case management platform to streamline regulatory investigations often find general-purpose investigation tools built for HR, ethics, or IT service workflows. An AML investigation needs more than task tracking: the SAR clock tied to the detection date rather than the alert date, related-party scoping across accounts, typology tagging, 314(b) correspondence logging, five-year retention of supporting documentation, and QA sampling on closed cases. A comparison of tools built for this work is in the best compliance case management software.
Where Sphinx Fits
Sphinx's AI agents work steps 2 through 8 inside the systems an institution already uses. Agents triage alerts, pull KYC and transaction history, run external research, map activity to typologies, and write a case file that records every source and every reasoning step. The filing decision stays with the institution's designated decision maker. When the decision is to file, Auto-SAR drafts the report from that case file. Sphinx reports an 80% reduction in case review time across this work, with the audit trail intact for examiners and QA.
Frequently Asked Questions
What are the steps in an AML investigation?
A standard AML investigation runs through alert intake, L1 triage, escalation to L2, scoping the subject and related parties, gathering KYC, transaction, and external evidence, 314(b) requests where needed, typology analysis, documentation, the file or no-file decision, and QA with continuing activity review.
What is the difference between L1 and L2 in AML investigations?
L1 triage decides whether an alert already has a documented, reasonable explanation and closes those alerts with a short rationale. L2 investigation takes escalated alerts, scopes the subject and related parties, gathers full evidence, and recommends whether to file a SAR.
When does the 30-day SAR clock start during an investigation?
The clock starts at initial detection, which the FFIEC BSA/AML Manual defines as the point when the review establishes that activity is suspicious, not when the monitoring system generated the alert. The SAR is due 30 calendar days later, or up to 60 days if no suspect has been identified.
Do banks have to document a decision not to file a SAR?
No. FinCEN and the federal banking agencies stated in the October 9, 2025 SAR FAQs that the BSA imposes no requirement or expectation to document a no-file decision. A short, concise statement is usually sufficient for institutions that choose to record one, with more detail reserved for complex investigations.
How long must AML investigation records be kept?
Under 31 CFR 1020.320(d), a bank must keep a copy of each SAR filed and its supporting documentation for five years from the filing date. Supporting documentation is deemed filed with the SAR and must be provided to FinCEN or law enforcement on request.
