When a transaction is flagged by a rule-based monitoring system, what is generated?

When a transaction is flagged by a rule-based monitoring system, what is generated?

• A. A case
• B. An alert
• C. A SAR
• D. A watch list alert

Answer: (B)

Rule-based monitoring works by checking each transaction against predefined criteria such as thresholds, patterns, or risk indicators. When a transaction matches one of those criteria, the system generates an alert to notify investigators that something potentially suspicious needs review. This alert is the immediate output used to triage and guide further examination. A SAR is a formal report filed to authorities only after a detailed review confirms credible suspicion and determines that filing is warranted, not just from the initial alert. A case is a workflow container used to organize and track the investigation of related alerts and evidence. A watch list alert comes from screening against sanctioned or politically exposed person lists, which is a separate process from the standard rule-based transaction triggers.

Rule-based monitoring works by checking each transaction against predefined criteria such as thresholds, patterns, or risk indicators. When a transaction matches one of those criteria, the system generates an alert to notify investigators that something potentially suspicious needs review. This alert is the immediate output used to triage and guide further examination.

A SAR is a formal report filed to authorities only after a detailed review confirms credible suspicion and determines that filing is warranted, not just from the initial alert. A case is a workflow container used to organize and track the investigation of related alerts and evidence. A watch list alert comes from screening against sanctioned or politically exposed person lists, which is a separate process from the standard rule-based transaction triggers.