What is alert triage?

Alert triage is the first pass over a queue of compliance alerts to sort them by urgency and likely outcome before anyone decides them. It answers "which of these needs a person first, and what will they need to see?" It does not close alerts. That distinction matters most once AI agents do the sorting.

Why does alert triage matter once agents act?

Alert queues are large, and most alerts turn out to be harmless. Triage is where time is won or lost: a sanctions hit on a payment due to settle today should not wait behind a hundred low-risk name matches from a periodic rescreen.

An agent can do this sorting well, and it is natural work for compliance agents in the second line. It reads each alert, pulls the customer record and the transaction history, and assembles what an analyst would otherwise gather by hand. The danger is drift from sorting into deciding. A triage agent that quietly closes "obvious" false positives has become the decision-maker, which is why we argue for alert triage without closing alerts.

How does triage work in practice?

A triage pass usually does four things for each alert:

1. Enriches it with the facts the analyst will need: customer profile, risk rating, related alerts, the matched list entry or rule.
2. Prioritises it by deadline and severity, such as a payment held in a queue or a hit against a high-risk list.
3. Suggests a likely outcome, with the reasons and sources, clearly marked as a suggestion.
4. Routes it to the right analyst or team, with complex or sensitive cases sent to someone senior.

The analyst then reviews, decides and records the disposition. Our walkthrough on triaging sanctions screening alerts with an AI agent sets out each step and who acts.

An example from a payments queue

Take a payment firm's screening queue at the start of a shift: 400 open alerts. The agent enriches each one and finds that 30 relate to payments due to settle within hours, five of them against names on a high-priority sanctions list. Those five go to the top, routed to a senior analyst with the list entry, the payee's details and the reasons the match looks strong or weak.

The remaining alerts are ordered by deadline and suggested outcome. Every one still waits for a person to dispose of it, and the analyst can see at a glance where the agent was uncertain.

How is triage different from disposition?

Disposition is the decision: true match or false positive, escalate or close, with a recorded reason and a named decision-maker. It is the step a supervisor will examine, and the step that carries accountability. An AML alert disposition record captures exactly that.

Triage only prepares for the decision. It can be wrong without harm, because a person checks it. Disposition cannot be wrong without consequence. That is why the answer to whether an AI agent can clear a sanctions alert is different from whether it can triage one: the first is a decision, the second is preparation.

Which terms sit next to alert triage?

• False positive: an alert that, on review, does not indicate the risk it was raised for. Most triage effort goes into these.
• Escalation: passing an alert to a more senior reviewer or to the money laundering reporting officer.
• Alert ageing: how long an alert has waited; triage exists partly to stop it growing.

Where Pryme fits

In Pryme, a triage agent runs at depth 1 or 2: it reads the queue and drafts a suggested outcome, and a named analyst disposes. Closing an alert is a separate capability that would need its own certification. Every suggestion, and every analyst decision that agreed or disagreed with it, is filed.