Every closed alert needs a record a supervisor can follow. An AML alert disposition record documents what triggered a monitoring or screening alert, the evidence gathered, the analyst's decision and reasons, and who reviewed it. Where an AI agent helps, it also separates the agent's triage from the analyst's disposition, so a person visibly closed the alert.
What is a disposition record for?
Every alert ends with a decision: close it, escalate it for investigation, or consider a suspicious activity report. The disposition record is the evidence for that decision. Supervisors and auditors sample these records to see whether the AML process works, and a closed alert with a one-word reason is one of the commonest findings against a financial crime team.
With an agent involved, the record has a second job. It must show the boundary between what the agent prepared and what the analyst decided. Alert triage is where an agent adds value: pulling transactions, comparing with the customer's profile, checking prior alerts, summarising. Closing the alert is not. The argument is set out in alert triage without closing alerts.
When should the record be completed?
For every alert, at the point of disposition. The agent opens the record when the alert arrives and fills the triage section at depth 2. It may set a suggested priority for the queue. It holds the record for an analyst. The analyst completes the disposition section and the record is filed.
Teams hoping agents will cut false positives should read whether an AI agent can reduce false positives in AML screening. The gain comes from faster, better-evidenced triage, not from the agent closing alerts on its own.
How do you fill in each field?
Triage section (agent prepares) - Alert details: rule or scenario, score, date. - Transactions in scope, with counterparties and countries. - Customer profile: expected activity, risk rating, occupation or business. - Comparison: how the activity differs from the profile, in specific terms. - History: prior alerts and their outcomes. - Open questions the analyst should consider.
Disposition section (analyst decides) - Decision: close as explained, escalate to investigation, or refer for SAR consideration. - Reasons: specific facts that explain or fail to explain the activity. - Evidence relied on, with provenance. - Analyst name and date. - Quality review, if sampled.
The AML alert disposition record template
| No. | Field | Completed by |
|---|---|---|
| 1 | Alert ID, rule or scenario, date | Agent |
| 2 | Customer, account, risk rating | Agent |
| 3 | Transactions in scope | Agent |
| 4 | Expected activity on file | Agent |
| 5 | How actual activity differs, specifically | Agent |
| 6 | Prior alerts and outcomes | Agent |
| 7 | Additional evidence gathered, with provenance | Agent |
| 8 | Open questions for the analyst | Agent |
| 9 | Suggested queue priority | Agent |
| 10 | Disposition | Analyst |
| 11 | Reasons for the disposition | Analyst |
| 12 | Evidence relied on | Analyst |
| 13 | Analyst and date | Analyst |
| 14 | Quality reviewer and result, if sampled | Reviewer |
A filled sample
A hypothetical bank's monitoring system raises a rapid-movement alert on a personal account.
| No. | Entry |
|---|---|
| 1 | Rapid in-and-out movement scenario |
| 3 | Five incoming transfers totalling 9,500 from five individuals over two days; 9,400 sent out the same days to one account abroad |
| 4 | Salaried employee; expected monthly turnover around 3,000 |
| 5 | Turnover over two days roughly three times expected monthly; pass-through pattern; new foreign counterparty |
| 6 | No prior alerts |
| 7 | Customer's chat message last week: "collecting money from family for a wedding abroad" (declared) |
| 8 | Do senders share a surname or address with the customer? Is the receiving account linked to a wedding venue or family member? |
| 9 | High |
| 10 | Escalated to investigation |
| 11 | Senders' surnames differ from customer's; no link found between receiving account and stated purpose; declared explanation not supported by evidence |
| 13 | Financial crime analyst |
The agent's open questions shaped the analyst's work. The customer's explanation might have been true, and an agent could have accepted it. The analyst tested it and found it unsupported.
Where Pryme fits
In Pryme, an AML triage agent holds depth 2: it assembles the record and holds it for a named analyst. Customer statements arrive stamped declared, so they cannot close an alert on their own. Screening hits are handled the same way; see whether an AI agent can clear a sanctions alert. The wider position is in AI compliance agents: second line, never the last word.
Questions people ask
Can the agent pre-fill the disposition as a suggestion?
Avoid it. A suggested disposition anchors the analyst and turns review into approval. Open questions are more useful because they direct the analyst's thinking without deciding.
How should quality assurance sample these records?
Sample across analysts and outcomes, with extra weight on closures. Check that reasons rest on specific facts and that the analyst's decision engages with the agent's open questions.
What if the analyst disagrees with the agent's triage?
They record what they found differently. Repeated disagreements on the same kind of alert are a signal to review the agent's brief or sources.