Definition
Alert triage is the first-level review of alerts generated by transaction monitoring, sanctions screening or other detection systems, in which analysts prioritize alerts by risk, gather initial context, and decide whether each alert can be closed as explained or must be escalated for full investigation and a possible suspicious activity report.
How it works
Alerts enter a queue with a risk score or priority. A first-level analyst reviews the triggering activity, customer profile, prior alerts and readily available data, then either closes the alert with a documented rationale or escalates it to a second-level investigator. Investigators build a case, which may conclude in a SAR, an exit decision, or no action. Sanctions alerts are usually prioritized because transactions may be held pending review.
Requirements by jurisdiction
Triage processes are not prescribed in detail, but regulators expect them to be timely, documented and adequately resourced.
US: The FFIEC manual describes alert management as the processes for investigating and evaluating unusual activity, regardless of how it was identified, with a clear escalation path from detection to disposition and staff with adequate training and access to CDD data. A system flag alone is not "initial detection" for the 30-day SAR clock. OFAC has cited backlogs and unclear prioritization as root causes of sanctions violations.
EU: The AMLR assigns suspicious transaction reporting to the compliance officer from July 2027, so triage decisions feed that accountability chain.
UK: Internal suspicion reports go to the nominated officer (MLRO), who decides whether to report to the NCA under the Money Laundering Regulations and the Proceeds of Crime Act.
Common challenges
Large backlogs, inconsistent closure rationales between analysts, context scattered across systems, and pressure to close alerts quickly all undermine quality. Without feedback loops, triage outcomes rarely inform rule tuning.
How teams handle it in practice
Teams use risk-based queues with service-level targets, standardized closure reasons, and quality assurance sampling of closed alerts. Related alerts on the same customer are grouped into one review. Outcomes are fed back to monitoring tuning. Compliance platforms like Corsa can use AI agents to gather context and propose dispositions, with analysts making the final decision.
How Corsa helps:
Agentic Workflows →
Frequently asked questions
Who performs alert triage?
Typically level-one analysts, with escalation to level-two investigators and ultimately the BSA officer, MLRO or compliance officer for reporting decisions.
Does an alert start the SAR filing clock?
Not by itself. The FFIEC manual states that a system flag should not be considered initial detection; the clock starts when the institution knows or has reason to suspect the activity meets reporting criteria.
How should closed alerts be documented?
With a clear rationale and the evidence reviewed, so that auditors and examiners can understand why the alert did not warrant escalation.
Sources
