Each alert an AML investigator works during the practicum gets one entry: the agent's draft disposition, what the investigator found that the draft missed, their decision and rationale, the senior investigator's independent decision, whether the two match, and whether a red line was in play. The template below is a numbered field list for any case tool.
Why does an AML practicum need its own log?
Because AML decisions are slower, rarer and heavier than most review work. An investigator might decide ten alerts a day, so a fortnight produces around a hundred entries, not several hundred. Each one carries more weight, and each rationale has to stand up later if the case is looked at again.
The log also tests the specific skill agents change in this role. The agent assembles the case file and drafts the narrative at depth 2. The investigator's job shifts from gathering to challenging: spotting the link the draft left out, the declared business activity nobody verified, the counterparty that appears in three unrelated alerts. A good log records those catches. How the fortnight is set up is in how to run a two-week practicum for AML investigators.
Who keeps it?
The investigator writes the decision and rationale. The senior investigator, holding a current certificate, records an independent decision before reading the investigator's. The agent pre-fills the alert facts and its own draft from the record at depth 1. The money laundering reporting officer, or equivalent, reviews any entry that moves towards a suspicious activity report.
The practicum log template
Header
- Investigator name and team.
- Senior investigator and certificate number.
- Practicum dates (ten working days).
- Alert sources in scope: transaction monitoring, screening, referrals.
- Bar: at least 95 correct in every 100 decisions, and no missed red line.
- Red lines: closing an alert with clear indicators unaddressed; any action or contact that could tip off the customer; closing a potential sanctions match without resolving it.
Per-alert entry
- Entry number and date.
- Alert ID and source.
- Typology or rule that fired.
- Agent's draft disposition and deciding bound.
- Facts relied on, each with its provenance: sealed (core ledger), signed (verified counterparty data), declared (customer's own account of their business), external (adverse media, web pages).
- Gaps the investigator found in the draft narrative.
- Investigator's decision: close, escalate, recommend a report, or request a restriction.
- Investigator's rationale, in two or three sentences.
- Senior investigator's decision, recorded first.
- Match: yes, no, or defensible.
- Red line in play, and whether it was caught.
- Debrief note.
Day-ten summary
- Decisions made, and correct decisions as a count.
- Red lines in play and caught.
- Gaps found in agent drafts, as a count: a measure of challenge, not just agreement.
- Senior's recommendation and the assessor's sign-off.
A worked example
Take a sample retail bank's financial crime team. Values are illustrative.
Entry 37. Alert TM-2291, rapid movement of funds. The agent's draft proposes closure: inbound transfers to a sole trader's account match its declared activity as a market stall supplier. Facts: account flows (sealed), business description (declared). Gap found: the declared activity was never verified, and twelve of the inbound transfers come from personal accounts that also appear in two other open alerts. Investigator: escalate. Senior: escalate. Match: yes. Red line: closing with clear indicators, caught.
Entry 38. Screening alert, partial name match to a sanctioned individual; different date of birth in the core record (sealed) against a news article (external). Investigator: close, citing the date of birth. Senior: close, but only after confirming nationality and address too. Match: defensible. Debrief note: "One discriminating fact is not always enough; record each one checked."
Entry 39. The agent refused to draft an email asking the customer about the source of a large deposit while the alert was open. Investigator: overrode in a note, proposing a call instead. Senior: agree with the refusal; no contact until the case is decided. Match: no. Red line: tipping off, missed. The bar fails on this entry alone, which is the point of having one.
Logs for other roles share the same spine but differ in their red lines; compare the practicum log for collections agents, where contact is the job rather than the risk, or the log for paralegals.
Where the Academy fits
Pryme Intelligence Academy's Certified Pryme Operator requires a written exam and a two-week practicum of real review decisions, at least 95 in every 100 correct with no missed red line, signed off by a Pryme assessor. For AML teams, module tests are set in the learner's own industry and role. More in AI literacy and certification for people who work with agents.
Questions people ask
Can investigators close alerts on their own during the practicum?
No. The senior's decision is the one actioned; the investigator's is logged for assessment. That keeps live cases safe while the investigator is being tested.
What counts as "defensible" rather than a match?
A decision the senior would not have made but accepts as reasonable on the evidence, with a rationale that would satisfy a later review. Write that definition into the header before day one.
Does passing the practicum change who is accountable?
No. The organisation still answers for its reports and closures. How responsibility sits between the investigator and the agent is covered in whether AML investigators are accountable for an AI agent's mistakes, and the question of approval rights in do AML investigators need a certificate to approve AI agent actions.