Case Study 11.1: From Alert to SAR — Tracing a Complex Layering Investigation

The Situation

Organization: Cornerstone Financial Group (composite fictional institution) Case: A 6-month investigation from initial monitoring alert to SAR filing Focus: How the case management process works in practice — from alert escalation through investigation, network analysis, narrative drafting, and filing Characters: The analytical work involves members of Cornerstone's AML Investigations team; the case is managed through their case management system

Month 1: The Alert That Didn't Close Cleanly

In early April, Cornerstone's transaction monitoring system generated an alert for a business account held by "Meridian Commercial Services Ltd" (fictional UK company), a UK-registered private company in the import/export sector. The alert: rapid in-and-out movement — the account received £48,000 from two wire transfers on April 3 and sent out £45,800 across four outbound ACH payments over April 4–6.

The initial alert was assigned to a junior analyst. She reviewed the customer profile: - Meridian Commercial Services Ltd: incorporated 2021, 14-month account history - Declared business: "import/export trade facilitation" - Risk rating: Medium - Historical average monthly inbound: £31,000; outbound: £29,500 - No prior SARs or escalations

The analyst reviewed the specific transactions. The inbound wires were from two counterparties she had not seen before: "Sun Trading International" (HK) and "East Pacific Commerce Corp" (Singapore). The outbound ACH payments went to four UK-registered companies whose names she did not recognize.

She could not close the alert cleanly — she could identify no specific explanation for the pattern, but it also didn't immediately cross her suspicion threshold. She escalated to her team leader for a second opinion.

The team leader's response: "Let's keep this open and watch for 30 more days before deciding. Set a calendar review for May 7."

Month 2: The Pattern Becomes a Case

On May 7, the team leader reviewed the Meridian account again. The 30-day observation had produced new data:

May transactions: Two additional inbound wires (new counterparties: "Pacific Gateway Ventures," Thailand; and "Global Link Commerce," Malaysia) totaling £62,000. Six outbound ACH payments to eleven UK companies (including some repeat recipients from April) totaling £59,500.

Pattern now visible: Over two months, Meridian had received £110,000 from four international counterparties in four different jurisdictions (HK, Singapore, Thailand, Malaysia) and sent out £105,300 to fifteen UK companies. The account balance at the end of May: £4,700.

The team leader escalated to the Investigations team and opened a formal case.

The lead investigator, a senior analyst, began working the case in earnest.

Step 1: Customer profile deep-dive

The investigator pulled Meridian's complete KYC file. Key findings: - The company had been incorporated in April 2021 — two years before the case opened - The sole director and beneficial owner was a UK national named James Whitmore (fictional) - At onboarding, Whitmore had described the business as providing "trade facilitation services between UK suppliers and Asian importers" - The customer's declared annual revenue at onboarding: "approximately £180,000" - The two-month transaction volume already represented £110,000 in inbound — on track for £660,000 annualized, 3.7× the declared revenue

Step 2: Counterparty research

The investigator researched each inbound counterparty: - Sun Trading International: HK-registered, minimal public web presence, no corporate registry details publicly available - East Pacific Commerce Corp: Singapore-registered, Acra (Singapore corporate registry) confirms incorporation but no directors listed in accessible records - Pacific Gateway Ventures: Thailand-registered, could not be identified in Thai corporate registry with name alone - Global Link Commerce: Malaysia-registered, could not be identified with name alone

None of the four counterparties had any public business presence (no website, no LinkedIn, no trade publications). For a company claiming to be conducting international trade facilitation with clients in four Asian jurisdictions, the absence of verifiable business identity for all four counterparties was a significant red flag.

Step 3: Recipient research

The investigator researched the fifteen UK companies receiving outbound ACH payments: - All fifteen were registered UK private limited companies - All fifteen had been incorporated within the prior 18 months - Companies House records showed 11 of the 15 shared the same registered address (a London company formations agent) - Seven of the 15 had the same registered director (individual identified in Companies House records) - None of the 15 had any public business presence

The fifteen recipient companies were almost certainly shell companies — possibly all controlled by the same individual or group.

Month 3: Network Analysis

The investigator used Cornerstone's case management platform's network visualization tool to map the full transaction network for the April–May period.

The visualization revealed a structure that was not visible from the transaction table:

[HK: Sun Trading Int'l] ──£25,000──┐
[SG: East Pacific Comm] ──£23,000──┤
                                    ├──→ [MERIDIAN] ──→ [15 UK shells]
[TH: Pacific Gateway]  ──£31,000──┤
[MY: Global Link Comm] ──£31,000──┘

The structure: funds aggregated from four different Asian jurisdictions into a single UK intermediary (Meridian), then dispersed to fifteen UK shell companies. This was a textbook layering structure — the first layer separating the funds from their origin; the second layer dispersing them through UK-registered vehicles whose onward destination was unknown.

Betweenness centrality: Meridian was the single highest-centrality node in the network — all fund flows passed through it.

In/out ratio: Meridian's 2-month in/out ratio: £105,300/£110,000 = 95.7% — nearly all inbound funds were transited out.

The investigator also identified that three of the UK recipient companies had themselves received funds from other Cornerstone customer accounts (identified through the internal linking feature in the case management system). This suggested the network extended beyond Meridian.

Month 4: External Research and SAR Decision

The investigator conducted OSINT research on James Whitmore, Meridian's sole director: - LinkedIn profile: described as "international trade consultant"; no employer history; connected to 23 people, none identifiable as industry contacts - No adverse media - Companies House: Whitmore was also a director of two other companies — one recently dissolved, one still active

The active second company — "Whitmore Trade Consulting Ltd" — had its own Cornerstone account. The investigator flagged this for the team leader.

The team leader convened a senior review. Attendees: lead investigator, team leader, AML compliance manager, outside counsel (participating by phone).

Discussion of key factors: 1. The pattern (aggregation from multiple international counterparties, rapid distribution to UK shells) was consistent with a layering typology 2. The recipient companies were almost certainly shells — the shared addresses and shared directors were not consistent with legitimate independent businesses 3. The declared business purpose ("trade facilitation") was facially consistent but not corroborated by any identifiable clients 4. The declared revenue (£180K/year) was already being exceeded in 2 months 5. The international counterparties could not be verified as legitimate businesses 6. The "knows or suspects" standard under POCA was satisfied — the pattern was sufficient for objective suspicion

SAR filing decision: Yes, file a SAR. Additionally, open a linked case for Whitmore Trade Consulting Ltd.

Month 5: SAR Drafting and Filing

The lead investigator drafted the SAR narrative. The draft process:

Draft 1 (AI-assisted): The case management system's AI drafting tool extracted the key transaction data and generated a draft describing the transaction pattern, counterparties, and recipient companies. The AI draft was accurate and well-organized but contained generic language and did not adequately explain the significance of the shell company indicators.

Analyst revision: The investigator added three paragraphs: - The significance of the shared registered address across 11 of 15 recipient companies - The absence of any verifiable business identity for the four international counterparties - The discrepancy between declared annual revenue and actual 2-month transaction volume

Legal review: Outside counsel reviewed the narrative for accuracy and confirmed that the "knows or suspects" standard was met.

Approval: The compliance manager signed off on the SAR. Senior management approval was documented in the case management system.

Filing: The SAR was filed through the NCA's online portal. Case status: SAR filed; account under enhanced monitoring; relationship continuation under review.

Month 6: Post-Filing

Three weeks after filing, the NCA issued an Acknowledgment of Receipt. No consent refusal (the institution had not sent a defence SAR — the SAR was a notification SAR, not a consent request, because the suspicious transactions had already occurred).

The investigator's ongoing monitoring obligations: - Review account activity at 30-day intervals - File a continuing activity SAR if suspicious patterns continue - Note any law enforcement contact or NCA response

In the first 30-day review: Meridian's account activity had dropped to near-zero. Two small transactions — consistent with administrative costs. No new suspicious activity.

The investigator's assessment: the drop in activity may indicate that the account holder became aware of the monitoring, or simply shifted activity. The case remained open; Whitmore Trade Consulting Ltd case was progressing separately.

No formal law enforcement contact was received in the six months following filing.

Discussion Questions

1. The initial analyst escalated to her team leader rather than immediately opening a case or filing a SAR. Evaluate this decision: was it appropriate? At what point in the month-by-month timeline did the activity cross the "knows or suspects" threshold that would require SAR filing?

2. The case involved international counterparties in HK, Singapore, Thailand, and Malaysia. What additional due diligence options exist for verifying international counterparties that are not available through domestic sources? What are the practical limitations of these options?

3. The fifteen recipient companies had features suggesting shell company status — shared registered addresses, shared directors, recent incorporations. Can these features alone be sufficient to support SAR filing? What additional corroboration would strengthen this element of the investigation?

4. The case management system's AI drafting tool produced a technically accurate but analytically incomplete first draft. Describe the specific improvements the investigator made, and explain why these improvements were necessary for the SAR to have law enforcement intelligence value.

5. After filing, Meridian's account activity dropped to near-zero. What are the possible explanations for this change? How should the investigator's ongoing monitoring approach differ depending on which explanation is most likely?