Alert triage scoring
A model trained on investigator disposition history that reranks the alerts typology rules already produced, so a fixed investigator queue works the highest-value cases first.
Part of the recommended approachTechnique: Supervised Learning
Alert triage scoring is the workhorse once a bank has enough disposition history, filed SARs and the closures that were not filed, to train on.
It replaces an arrival-order queue with a ranked one, sized to the investigator hours that actually exist, so the alerts most likely to convert to a filed SAR reach an analyst first instead of whichever alert a rule happened to generate at midnight.
A study on the data of Norway’s largest bank found that leaving out alerts that were investigated and closed, or leaving out ordinary uninvestigated transactions, can lead to worse results than learning from all three.
Get the label wrong and this approach does more harm than good: a filed SAR records suspicion, not a proven crime, and training on it as if it were ground truth bakes in whatever bias already exists in which alerts got a thorough look versus a quick close.
Because a score influencing a filing decision has to be explainable to the investigator and to model validation, the score needs to be traceable back to the specific typology and features that drove it, not delivered as a single opaque number.
This is the wrong starting point for a bank without a meaningful, consistently captured disposition history, where fixing that recording gap and tuning the existing rules will recover more value than a model trained on too few or too biased labels.
Strengths for this problem
- Combines weak signals across transaction history, KYC profile, and prior alert disposition into one ranked score, catching risk no single typology rule covers on its own.
- Sized to actual investigator capacity, it fills the queue with the alerts most likely to reach a SAR rather than whichever alert happened to arrive first.
- Retrains on newly closed cases, so it adapts faster to shifting typologies than a rule set that only changes when someone rewrites it.
Limitations for this problem
- Needs real disposition history, and the available label is weak: a filed SAR reflects an investigator's suspicion, not a confirmed crime, and the bank rarely learns whether it was later confirmed.
- If trained on which alerts got escalated rather than which alerts were actually filed, it reproduces whatever bias already shapes who gets a closer look.
- Investigators and model validators need the score explained in typology-specific terms, so a blended score that cannot say which typology drove it is not usable in a filing decision.
Data needed
- Alert and transaction data as it existed at alert time: amount, channel, counterparty, and rule that fired.
- KYC and CDD records, including beneficial ownership and stated expected activity, joined as of alert time.
- Investigator disposition history, including filed SARs with filing date alerts investigated but not filed, and a sample of uninvestigated transactions, used as a weak training label rather than ground truth.
How it is measured
- Alert-to-SAR conversion at the investigator capacity actually available, not a theoretical top percentile.
- Analyst hours spent per filed SAR, tracked against the unranked queue it replaced.
- Below-the-line testing results, meaning how often a sampled suppressed alert turns out, on manual review, to have merited escalation.
Pitfalls
- Treating a filed SAR as ground truth, when it is a documented suspicion that inherits every bias in who got investigated in the first place.
- Feature leakage from fields that only populate once a case is opened, such as an investigator's own case notes, which produces a score that looks excellent offline and fails on a fresh alert.
- Optimising for recall when investigator capacity is the binding constraint, which floods the queue with low-yield alerts and burns analyst trust in the score.
Human oversight
An investigator reviews every ranked alert and makes every filing decision. The score orders the queue and surfaces the typology-specific factors behind each rank; it never files a SAR or restricts an account on its own.