A financial crime rota is mostly a capacity plan. Investigations take days, so the question is how many cases each investigator can hold while still meeting the deadlines for reporting decisions. Add a daily triage reviewer for new escalations, a named MLRO or deputy for every reporting decision, and a quality reviewer who samples closed cases each week.
How is this different from a screening rota?
Screening teams decide many small holds quickly; their rota is about cover by the hour. Financial crime investigators work fewer, deeper cases. An investigation agent pulls transaction history, links related accounts, drafts the chronology and proposes whether the activity looks suspicious. It holds every conclusion for a person. The investigator decides, and the team's capacity is measured in open cases, not in minutes.
That changes the rota. It still names who is on triage each day, but most of its work is allocating cases so nobody holds more than they can investigate well. The head of financial crime owns the rota; the MLRO agrees the reporting deadlines it must meet. The guide to AI agent skills by role covers what investigators need, and what a reviewer rota is explains the term.
What are the steps?
- Agent, depth 1: reports open cases by age, stage and investigator. And incoming escalations by day.
- Person (head of financial crime): sets a caseload range per investigator. Based on case complexity and the deadline for each stage, not on a fixed number.
- Person (head of financial crime): names a triage reviewer each day. They review new escalations, close the clearly unfounded with a reason, and allocate the rest.
- Agent, depth 2: drafts the investigation pack. Transactions, linked parties, chronology, the provenance of each fact, and a proposed conclusion.
- Person (investigator): investigates and concludes. Agree, amend or reject the agent's proposal, with reasons that would satisfy the MLRO.
- Person (MLRO or deputy): decides on reporting. Named on the rota for every working day.
- Agent: holds account exit recommendations. Exiting a customer is hard to undo and needs a named approver, and the communication must avoid tipping off.
- Person (quality reviewer): samples closed cases weekly. Named on the rota, rotating among senior investigators.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Escalation intake | Reports new escalations | 1 | Triage and allocation |
| Investigation pack | Drafts chronology and links | 2 | Checking against source data |
| Conclusion | Proposes suspicious or not | 2 | The investigator's conclusion |
| Reporting | Drafts the report | 2 | MLRO decision and submission |
| Account exit | Drafts the recommendation, holds | 4 | Approval and careful communication |
| Quality review | Compiles closed-case sample | 1 | Assessment and feedback |
How should caseloads be set?
Start from the deadlines. If a reporting decision must be made within a set period of a case being opened, an investigator's caseload must allow every case to reach that point in time. The agent's history shows how long each type of case takes from allocation to conclusion; divide the available hours by that, and leave room for the case that turns out larger than expected.
Then adjust for skill and for leave. An investigator about to go on holiday should stop taking new complex cases a week or two beforehand, and their open cases need a named covering investigator, recorded on the case, before they go.
Then adjust for skill. A newer investigator holds fewer complex cases. The AI agent competency matrix for the financial crime team shows who is ready for which case types, and the approver authority matrix for the financial crime team shows who may approve an exit.
Which controls matter, and what evidence do they leave?
- Every escalation is triaged by a named person. Evidence: the triage reviewer's name and reason on each closed or allocated escalation.
- Every conclusion has a reason. Evidence: the investigator's reasoning on the case, alongside the agent's proposal and any amendment.
- Reporting decisions are made in time. Evidence: case opened, conclusion reached and MLRO decision dates in the record.
- Provenance is weighed. A customer's explanation of a payment is declared; an invoice from a known counterparty is signed. Evidence: provenance on each fact the conclusion relies on.
- Quality is sampled. Evidence: the weekly sample, findings and feedback given.
FATF's Recommendations set suspicious transaction reporting as a core obligation, and national law sets the details. This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What should be measured?
- Cases by age, against the deadline for each stage.
- Caseload per investigator, against their range.
- Conclusions changed at quality review, by reason.
- Triage closures later reopened.
- MLRO decisions made within the deadline.
Where does it usually go wrong?
Caseloads grow quietly. Escalations rise after a new monitoring rule, and the rota does not change. Review caseloads weekly against the range.
Agent proposals become conclusions. Investigators under load accept the agent's proposal with thin reasons. Quality review is where this shows; make sure it happens every week.
Tipping-off risk in exits. An exit letter drafted in haste can reveal too much. Keep exits with experienced approvers.
Support and operations teams plan rotas with a very different rhythm; compare the rotas for the support team and the operations team.
Questions people ask
Should investigators also take triage shifts?
Yes, in rotation. Triage keeps investigators close to what the monitoring rules produce, and spreads a skill that otherwise sits with one person.
Can the agent close escalations it judges unfounded?
Only if that capability has been certified on the team's own cases and placed within its bounds. Many teams keep every closure with a person.
How many quality reviews a week are enough?
Enough to see each investigator's work regularly, and every case type at least occasionally. Fix the sample size in advance so it is not quietly cut in a busy week.