Documenting Investigations and the Decision to Report

Why This Topic Matters

In the CAMS exam domain covering Controls, Investigations, and the AFC Organization, few topics are as frequently tested as how investigations are documented and how the decision to file (or not file) a suspicious activity report is reached and recorded. The reason is simple: regulators and examiners cannot see what an analyst was thinking. They can only see what was written down. An investigation that reaches the right conclusion but leaves no trail is, from a supervisory perspective, nearly indistinguishable from an investigation that never happened. Poor documentation is one of the most common findings in regulatory enforcement actions, and it exposes institutions to fines, consent orders, and reputational damage.

For the exam, this topic sits at the intersection of several core skills: recognizing red flags, escalating alerts, conducting a reasonable investigation, applying a defensible standard for suspicion, and preserving confidentiality. Questions in this area test whether you understand that documentation is not an administrative afterthought but a control in its own right.

What It Is

Documenting an investigation means creating a contemporaneous, complete, and retrievable record of what was reviewed, what was found, how it was analyzed, and what decision was made. The decision to report refers to the determination, following that investigation, of whether the activity rises to the level of suspicious activity requiring a report to the relevant financial intelligence unit (FIU), such as a Suspicious Activity Report (SAR) in the United States or a Suspicious Transaction Report (STR) in many other jurisdictions.

Key elements of proper investigation documentation include:

1. The trigger – What generated the review? A transaction monitoring alert, a referral from a front-line employee, a law enforcement inquiry, negative news, a subpoena, or a 314(a)-style request.
2. The scope – Which accounts, customers, time periods, and related parties were examined.
3. The evidence reviewed – KYC and CDD files, transaction histories, account opening documents, open-source research, prior alerts or SARs, and communications with the relationship manager.
4. The analysis – How the activity compared to the customer's expected profile, which typologies or red flags were present, and what plausible legitimate explanations were considered.
5. The conclusion – Whether the activity was deemed suspicious, unusual but explainable, or not suspicious.
6. The decision and rationale – A clear statement of whether a report will be filed and, critically, why or why not.
7. Approvals and dates – Who reviewed, who approved, and when, demonstrating adherence to internal timelines and regulatory filing deadlines.
8. Follow-up actions – Account restrictions, enhanced monitoring, relationship exit decisions, or continuing activity reviews.

How It Works in Practice

The investigation lifecycle. An alert is generated or a referral is received. The analyst performs an initial review to determine whether the activity can be quickly explained. If not, the matter is escalated to a case. The investigator gathers information, builds a narrative, and forms a conclusion. That conclusion is reviewed by a supervisor or a SAR committee, and a decision is recorded. If a report is filed, the institution must then consider whether to continue monitoring, file continuing reports, or exit the relationship.

The standard for filing. Most regimes require reporting when the institution knows, suspects, or has reason to suspect that funds derive from illegal activity, that transactions are designed to evade reporting requirements, that activity has no apparent lawful purpose, or that the institution is being used to facilitate criminal activity. The institution does not need proof of a crime. It needs a reasonable, documented basis for suspicion. The exam frequently tests this: an investigator does not need to identify the specific underlying offense, and the absence of a known predicate crime is not a reason to decline filing.

Documenting the decision NOT to file. This is arguably the most important and most tested concept. Regulators expect institutions to document their reasoning when they close an alert or case without filing. A "no-SAR" decision with no explanation is a red flag to examiners because it suggests either that no real investigation occurred or that the institution is suppressing filings. The rationale should explain why the activity, after review, was deemed consistent with the customer's profile or had a legitimate explanation supported by evidence.

The SAR narrative. When a report is filed, the narrative is the most valuable component for law enforcement. It should be clear, concise, and chronological, answering the essential questions: who, what, when, where, why, and how. It should identify all subjects, describe the activity in plain language, explain why it is suspicious, and reference supporting documentation that the institution retains. Avoid jargon, unsupported speculation, and unnecessary length.

Confidentiality and tipping off. The existence of a suspicious activity report, and the fact that one is being considered, must never be disclosed to the subject or to any unauthorized party. Documentation must therefore be stored securely with access restricted to those with a legitimate need. Internal communications should never reference a SAR in a way that could reach the customer. Disclosing that a report has been filed is a criminal offense in many jurisdictions.

Record retention. Supporting documentation for a filed report must be retained for the period required by law, commonly five years from the date of filing, and must be made available to regulators and law enforcement upon request. Supporting documentation is considered part of the filing and is subject to the same confidentiality protections.

Timeliness. Jurisdictions impose deadlines for filing once suspicion is formed. In the United States, for example, a SAR is generally due within 30 calendar days of initial detection, extendable to 60 days if no suspect has been identified. Documentation should show when the clock started and demonstrate that the institution met the deadline. Where ongoing activity is involved, continuing reports are typically filed at defined intervals.

Quality assurance and governance. Strong programs include independent quality review of investigative files, consistent case templates, defined escalation paths, and management reporting on alert volumes, case aging, and filing decisions. Board and senior management oversight of SAR decision-making is an expected element of a sound AFC program.

Common Pitfalls

- Closing alerts with boilerplate language such as "activity consistent with business" without evidence.
- Relying solely on a relationship manager's assurance without independent corroboration.
- Failing to link related alerts, accounts, or customers into a single holistic case.
- Writing narratives that describe transactions but never explain why they are suspicious.
- Including a copy of the SAR or references to it in the customer file or in communications accessible to the customer.
- Missing filing deadlines because the date of initial detection was not recorded.
- Declining to file because the investigator could not prove a specific crime.

Exam Tips: Answering Questions on Documenting Investigations and the Decision to Report

1. Look for the "document the rationale" answer. When a question asks what an institution should do after deciding not to file, the correct answer almost always involves documenting the reasoning for the decision. Options that suggest simply closing the alert or taking no further action are distractors.

2. Remember that suspicion, not proof, is the threshold. If an answer choice says the institution should wait until it can confirm a crime occurred or identify the predicate offense, it is wrong. Reasonable suspicion is enough to require filing.

3. Confidentiality is absolute. Any option that involves informing the customer, the account officer discussing the SAR with the client, or storing SAR details in the customer-facing file is incorrect. If a customer asks whether a report was filed, the correct response is neither to confirm nor deny.

4. Prioritize the holistic view. When a scenario describes multiple alerts on related parties, the best answer typically involves consolidating the review into a single investigation rather than clearing alerts individually.

5. Know the elements of a good narrative. Questions may ask what makes a SAR narrative effective. The answer emphasizes clarity, chronology, identification of all subjects, a plain explanation of why the activity is suspicious, and the five W's and how. Avoid answers that favor length, legal conclusions, or speculation about guilt.

6. Watch for timing details. If a scenario gives dates, calculate whether a filing deadline has been met. Remember that the clock starts at initial detection, which is generally when the institution forms suspicion after review, not necessarily the date of the first alert.

7. Escalation and independence matter. The compliance function, not the business line, should make or approve the final filing decision. An answer that lets a relationship manager veto a SAR is incorrect.

8. Supporting documentation must be retained and available. If asked what happens to the evidence behind a filed report, the answer is that it is retained for the required period and provided to regulators or law enforcement on request, while remaining confidential from the subject.

9. Read for the "most appropriate" or "first" step. CAMS questions often ask for the best next step. Gathering information and documenting findings typically precedes filing, exiting the relationship, or freezing accounts. Do not jump to the most drastic action unless the scenario clearly warrants it.

10. Eliminate answers that weaken the audit trail. Any option that involves deleting records, relying on verbal approvals, or leaving the file undocumented is a distractor. The exam rewards choices that produce a complete, defensible, retrievable record.

Summary

Documentation transforms an investigator's judgment into institutional evidence. It demonstrates to regulators that the program works, supports law enforcement with usable intelligence, protects the institution against claims of negligence or willful blindness, and ensures consistency across analysts and over time. For the CAMS exam, anchor your answers in four principles: investigate thoroughly, document everything including the reasons for not filing, file on reasonable suspicion rather than proof, and protect confidentiality without exception.