Study this credential as a decision-making syllabus. For each domain, learn the named concepts (triage, investigative hypothesis, source reliability, network map, case rationale, tipping off), then practice the decision each concept feeds: classify the intake, plan the evidence, choose the disposition, write the narrative, respect the disclosure limits. Finish with timed paper cases and score yourself against a rubric of observable skills.
Triage: turning an intake into a governed case decision
Triage converts an intake into a governed decision: what kind of case this is, who owns it, how urgently it must move, and what the first documented action is — before investigative work begins.
Distinguish alert review from investigation intake. A monitoring hit becomes a case only after triage weighs risk, urgency, regulatory deadlines, customer impact, and evidentiary strength. Name the intake source explicitly — transaction monitoring, sanctions, fraud, KYC refresh, law-enforcement request, adverse media, referral, or whistleblower — because the source dictates handling constraints: a law-enforcement request carries different confidentiality and response obligations than an internal fraud referral. Record case ownership and the escalation path in the file so a reviewer can reconstruct why the case moved when it did.
Worked scenario: two alerts arrive the same day — a potential sanctions name match on a legacy customer, and a cash-structuring pattern on an active account. The tempting move is to work the sanctions match first because sanctions feels like the highest risk label. The better decision: check which item triggers an immediate action under policy (a sanctions match may require an urgent block or freeze plus escalation, while the structuring pattern may carry a filing deadline). Triage urgency against deadlines and required first actions, not against a single risk label.
Building an investigative hypothesis and an evidence plan
An investigative hypothesis is a testable statement of who may be doing what, how, and why; the evidence plan lists the sources that could confirm or refute it, with the legal basis for using each one.
Write the hypothesis before opening files. It sets scope, prevents scope creep, and gives you a criterion for relevance. Keep hypothesis and conclusion separate: a hypothesis is falsifiable and provisional; a conclusion is reached only after evidence is tested. Evaluate every source — customer file, transactions, counterparty data, documents, device data, OSINT, adverse media, subpoenas, law-enforcement information — for reliability, relevance, completeness, and legal or privacy limits. Then organize what you find into chronologies, flow-of-funds analysis, and entity links rather than scattered notes.
Worked scenario: a merchant account receives rapid inbound wires from unrelated individuals and sends funds onward to a crypto exchange. The common mistake is documenting only the transactions that fit the laundering hypothesis and overlooking an invoice trail that matches legitimate settlement — classic confirmation bias. The better approach: build the full chronology, check whether inbound senders map to actual customers of the merchant, and record the alternative explanation in the rationale. A one-sided file cannot survive second-line review and can misdirect a filing.
Network typologies: shells, nominees, mules, and layering chains
Typology knowledge supplies patterns to test — shell companies, nominees, professional facilitators, mule networks, trade flows, crypto off-ramps — but each pattern must be verified through entity links, not inferred from one red flag.
Build network maps deliberately: nodes are accounts, entities, or people; edges are funds flows or control relationships. A shell company is identified by attributes — no apparent operations, minimal staff, a registered-agent address, unexplained cross-border links — not by a label. Professional facilitators connect cases that look unrelated; a shared director, address, phone number, or device can join files that triage split apart. Treat trade flows and crypto exposure the same way: trace the underlying document or wallet path instead of reacting to the surface indicator.
Worked example: three corporate customers are flagged separately, and each individual account looks defensible on its own. The plausible mistake is closing three low-value cases independently. The better decision: run entity-link analysis across directors, addresses, devices, and counterparty overlap. If all three share one registered office and alternate transfers among themselves, three weak files become one network case with a single owner and a coherent narrative. Fragmented ownership is exactly how a coordinated structure stays invisible.
SAR narratives and audit-ready case files
A SAR or STR narrative answers who, what, when, where, why, and how in plain factual language, and the case file must let any reviewer reconstruct the chronology without the writer present.
Separate facts from judgment. The narrative states observed activity and why it is suspicious; the case rationale records your reasoning, the hypothesis tested, and the alternatives considered. Keep the file audit-ready: dated entries, an attributed source for every fact, preserved evidence with its original context, and a documented trail for each escalation, restriction, or closure. Post-filing, a continuing activity review re-tests the original hypothesis against new transactions — it is not a fresh investigation from zero.
Contrast two narrative sentences. Weak: 'Customer's transactions appear suspicious and possibly involve structuring.' Strong: 'Between 1 and 14 March, the account received 11 cash deposits of $9,000 to $9,900 totaling $102,000 across six branches; no business income on file explains the cash.' The second version works because every element is specific, sourced, and checkable, and the suspicion rests on the pattern rather than on an adjective. Reviewers and law enforcement act on specifics; unsupported characterizations cannot be defended in QA or beyond.
Choosing the disposition: close, escalate, file, restrict, exit, or monitor
Every case ends in a documented disposition — file, escalate, restrict, exit, block, close, or continue monitoring — selected from risk, evidence strength, and policy, with reasons written down.
Closure without a filing is a legitimate outcome when the evidence does not support suspicion, but the rationale must show the hypothesis was actually tested — what you checked, what you found, and why it resolves the question. Conversely, ongoing activity after a filing calls for continuing reviews and, where policy allows, restrictions or exit. The transferable skill is mapping facts to your institution's decision framework rather than memorizing a universal answer, because identical facts can require different dispositions under different policies and jurisdictions.
Use this comparison as a decision drill. For each situation, articulate the key question and why the disposition matters before looking at any answer key:
| Case situation | Key question before deciding | Why the disposition matters |
|---|---|---|
| Evidence supports suspicion and activity is ongoing | Is a filing required, and should monitoring continue or restrictions apply? | Filing without a monitoring plan leaves the residual risk unmanaged |
| Evidence is insufficient after testing | Does the closure rationale show what was checked and what was found? | Undocumented closure looks like an unexamined decision in QA |
| Sanctions match is confirmed | Does policy require an immediate block or freeze and escalation? | Delay or continued servicing changes the exposure completely |
| A new, unrelated typology appears mid-case | Extend the scope or open a linked case with its own owner? | Mixing scopes muddles both narratives and deadlines |
| A law-enforcement request arrives on an open case | Who coordinates the response, and what confidentiality limits apply? | Uncoordinated contact risks disclosure violations and inconsistent answers |
Tipping off, confidentiality, and cross-border limits
Confidentiality limits what you may say, to whom, and when; tipping off and unauthorized cross-border sharing are conduct violations that can apply even when the underlying suspicion was well-founded.
Tipping off means telling a customer or an unauthorized third party that a report or investigation may occur. Contrast the two channels: lawful internal disclosure goes only to people who need to know under policy; disclosure outside that circle — including indirect hints through the business line — can be a violation. Privacy, data-localization, privilege, and cross-border sharing rules also constrain moving investigation files between entities and countries, so confirm the legal basis before transferring material, and escalate pressure to shortcut these limits rather than absorbing it.
Worked scenario: mid-investigation, the relationship manager wants to call the customer to 'clarify' unusual deposits and mentions that compliance is reviewing the account. The tempting agreement — it sounds like routine KYC housekeeping — is the mistake, because naming the review is itself the disclosure. The better decision: route the contact through the investigation team, ask only pre-approved questions that do not reveal the review, and document what was asked and answered. The disclosure would be the violation regardless of what the investigation later concludes.
A four-pass preparation sequence with a readiness rubric
Prepare in four passes: map the five domains and their concepts, drill decision points with scenarios, write practice narratives, then run timed mixed cases and self-score against an observable-skills rubric.
Pass one: build a one-page concept map per domain — intake sources, triage factors, evidence-plan elements, typology attributes, narrative components, confidentiality rules. Pass two: work paper scenarios for each decision type (classify an intake, write a hypothesis and evidence plan, pick a disposition with reasons). Pass three: draft two full narratives and rationales, then check them against the specificity standard in the documentation section. Pass four: run timed mixed cases from the free practice set and review every miss by domain, not just by answer. Compress or stretch the passes to fit your available weeks. For registration, eligibility, and other administrative details, rely on ACAMS directly.
Score readiness with observable milestones rather than a pass prediction. Aim to meet every item below without notes before you consider yourself exam-ready:
- Explain, in two sentences each, the difference between a hypothesis and a conclusion, and between triage and prioritization.
- Given any alert scenario, name the intake source, proposed owner, and first documented action within two minutes.
- Draft a ten-line factual narrative in which every sentence traces to a source in the file.
- Assign a disposition to five scenarios with a one-line written rationale for each.
- Identify at least three tipping-off risks in a sample relationship-manager dialogue.
References and further reading
Use these references to explore the concepts and check the latest information from the relevant organizations.