Investigation Techniques and Information Gathering

Why This Topic Matters

Investigation Techniques and Information Gathering sits inside the CAMS domain Controls, Investigations, and the AFC Organization, and it is one of the most heavily tested practical areas of the exam. The reason is simple: every other part of an AML/CFT program – customer due diligence, transaction monitoring, sanctions screening, suspicious activity reporting – ultimately produces an alert or a referral that someone must investigate. If the investigation is weak, the institution files poor-quality Suspicious Activity Reports (SARs/STRs), misses genuine criminal activity, exposes itself to regulatory penalties, and may even commit an offense itself by tipping off a suspect. Regulators, law enforcement, and FIUs rely on financial institutions to turn raw data into intelligence. The CAMS exam therefore expects you to know not just what suspicious activity looks like, but how a competent investigator builds a case: where to look, in what order, how to preserve confidentiality, how to document findings, and how to work with law enforcement.

What an AML Investigation Is

An AML/CFT investigation is a structured, documented process of gathering and analyzing information to determine whether activity is suspicious, whether a report must be filed, and what action the institution should take regarding the customer relationship. It is not a criminal investigation – the institution does not have to prove a crime occurred or identify the specific predicate offense. The standard is reasonable suspicion: does the activity, taken in context, lack an apparent lawful or business purpose, or is it inconsistent with what the institution knows about the customer?

Investigations are typically triggered by:
• Transaction monitoring system alerts (structuring, rapid movement of funds, unusual wire patterns, velocity, round-dollar amounts)
• Internal referrals from front-line staff, branch managers, relationship managers, or other business lines
• Negative news or adverse media screening hits
• Sanctions or PEP screening matches that require resolution
• Law enforcement inquiries such as subpoenas, production orders, search warrants, or FinCEN 314(a) requests in the United States
• Requests from correspondent banks or other financial institutions, including 314(b) information-sharing requests
• Regulatory examination findings or FIU requests for additional information
• Periodic KYC reviews that reveal inconsistencies with the stated customer profile
• Whistleblower reports or internal audit findings, including suspected employee complicity

How an Investigation Works: The Lifecycle

1. Intake and Triage. The investigator receives the alert or referral, records it in a case management system, and assigns a priority based on risk (amount, customer type, geography, potential sanctions or terrorist-financing nexus, law enforcement involvement). High-risk matters such as potential terrorist financing or sanctions violations are escalated immediately.

2. Internal Information Gathering. The first and most important step is to exhaust the institution's own records before going outside. The exam consistently rewards answers that start internally. Key internal sources include:
• The KYC/CDD file: account opening documents, identification, stated occupation or business, expected activity, source of wealth and source of funds, beneficial ownership information
• Complete transaction history across all accounts and products linked to the customer, not just the account that alerted
• Wire transfer details: originator, beneficiary, intermediary banks, originator-to-beneficiary information fields, countries involved
• Cash transaction reports (CTRs) and monetary instrument logs
• Prior alerts, prior investigations, and prior SAR filings on the customer or related parties
• Correspondence, call notes, branch memos, and relationship manager comments
• Signature cards, authorized signers, powers of attorney, and linked accounts (common addresses, phone numbers, employers, IP addresses, devices)
• Loan files, credit applications, and safe deposit box records
• Interviews with the employees who deal with the customer – conducted carefully so the customer is not alerted

3. External and Open-Source Information Gathering. Once internal information has been reviewed, the investigator expands outward:
• Commercial databases (World-Check, LexisNexis, Dow Jones, Dun & Bradstreet) for identity verification, corporate affiliations, litigation, and adverse media
• Public records: corporate registries, beneficial ownership registries, land and property records, court filings, bankruptcy records, professional licensing boards, UCC filings
• Sanctions lists (OFAC, UN, EU, UK HMT) and PEP databases
• Internet and open-source intelligence (OSINT): search engines, news archives, company websites, social media, cached pages, and archived versions of websites. Good practice includes searching name variants and transliterations, using Boolean operators and quotation marks, searching addresses and phone numbers, and reviewing image results
• Information from other financial institutions under a legal safe harbor such as USA PATRIOT Act Section 314(b) in the United States, which permits voluntary sharing between registered institutions for the purpose of identifying money laundering or terrorist financing
• Information from law enforcement or the FIU where a channel exists

Investigators must be alert to the limits of open-source research: information may be outdated, inaccurate, or planted; social media profiles may be fake; and data privacy laws (such as the GDPR) may restrict how personal data is collected, stored, and transferred across borders.

4. Analysis. This is where information becomes intelligence. Core techniques include:
• Transaction analysis – reconstructing the flow of funds (source and destination), identifying patterns such as structuring below reporting thresholds, rapid in-and-out movement, funnel account activity, round-dollar transfers, activity inconsistent with the stated business, or transactions with high-risk jurisdictions
• Link analysis – mapping relationships between accounts, individuals, entities, addresses, phone numbers, IP addresses, and counterparties to reveal networks and hidden beneficial owners
• Timeline or chronology analysis – sequencing events to show how activity evolved, which is especially useful for identifying when behavior changed
• Comparison to peer groups and expected activity – asking whether the activity makes sense for a customer of this type, size, and geography
• Counterparty analysis – researching who the customer is transacting with and whether those parties are themselves subjects of concern
• Red flag assessment – matching observed behavior against typologies published by FATF, the FIU, the Wolfsberg Group, and the Egmont Group

5. Decision and Escalation. The investigator documents a conclusion: no suspicious activity (close with rationale), continue enhanced monitoring, file a SAR/STR, and/or recommend restrictions or exit of the relationship. Decisions to file or not file must be documented with clear reasoning, and the decision to exit a customer is a business and risk decision that must not be communicated in a way that tips the customer off to the filing of a report.

6. Reporting. If a SAR/STR is warranted, the narrative should answer the essential questions: who conducted the activity, what instruments and methods were used, when it occurred, where it took place, why the institution believes it is suspicious, and how it was carried out. The narrative should be clear, chronological, factual, and free of jargon, so that a law enforcement reader with no prior knowledge can understand it. Supporting documentation must be retained for the required period (five years in many jurisdictions).

7. Documentation and Case File. Every step must be recorded: sources consulted, searches run (including negative results), analysis performed, people interviewed, and the rationale for the decision. A well-documented case file demonstrates to examiners that the institution has a functioning program and protects the institution if the decision is later questioned. Evidence should be preserved in a way that maintains its integrity.

Confidentiality and Tipping Off

A defining feature of AML investigations is that the subject must never learn that they are under suspicion or that a report has been or will be filed. The exam tests this repeatedly. Key rules:
• Never disclose the existence or contents of a SAR/STR to the customer or any unauthorized person; in the US and most jurisdictions this is a criminal offense
• Do not ask the customer leading questions that reveal the investigation. It is acceptable to ask ordinary CDD questions as part of a routine review, but not to say, for example, that transactions appear to be structured to evade reporting
• Limit the circle of employees who know about the investigation to those with a need to know
• When exiting a relationship, give a neutral business reason, never a reference to suspicious activity or a filed report
• If a subpoena or law enforcement request is received, do not inform the customer unless the law specifically permits or requires it

Institutions filing in good faith generally enjoy a safe harbor from civil liability, which encourages reporting.

Working with Law Enforcement

Investigators frequently interact with law enforcement, and the exam tests the correct procedures:
• Verify the authenticity of any request; confirm the identity and authority of the requesting officer
• Designate a single point of contact (often the compliance officer or legal department) to receive and manage requests
• Involve legal counsel, especially for search warrants, broad subpoenas, or cross-border requests
• Respond fully but only within the scope of the request; keep a log of what was produced and when
• Preserve all relevant records once a request is received (litigation hold); do not destroy documents
• Cooperate with search warrants but do not obstruct; staff should not volunteer information beyond the warrant and should request to see the warrant
• Consider whether the law enforcement inquiry itself should trigger an internal review and possible SAR filing, since the institution now has knowledge that may be relevant
• Continue to protect SAR confidentiality even when cooperating – law enforcement may request supporting documentation for a SAR without a subpoena, but the institution should still follow its procedures

Cross-border cooperation occurs through FIU-to-FIU channels (Egmont Group), Mutual Legal Assistance Treaties (MLATs), and letters rogatory. Institutions should be aware that foreign data privacy and bank secrecy laws may restrict sharing of customer information across borders even within the same corporate group.

Law Enforcement Investigative Techniques You Should Recognize

CAMS also expects familiarity with techniques used by government investigators, since financial institutions support them:
• Following the money and asset tracing to identify and seize criminal proceeds
• Net worth analysis and source-and-application-of-funds analysis to prove unexplained wealth
• Review of bank records obtained by subpoena or production order
• Surveillance, undercover operations, informants, and cooperating witnesses
• Electronic evidence: email, device forensics, IP address analysis, and blockchain analytics for virtual assets
• Grand jury subpoenas, search warrants, and wiretaps (in the US)
• Civil and criminal forfeiture proceedings

Internal (Employee) Investigations

When an employee is suspected of complicity – for example, waiving CDD requirements, processing structured deposits, or leaking information – the investigation must involve Human Resources and Legal from the outset, be conducted discreetly, preserve system access logs and communications, consider suspending access, and comply with employment law. The institution may also have a SAR filing obligation regarding the employee's conduct.

Common Red Flags Investigators Look For

• Cash deposits structured just under reporting thresholds across multiple branches or days
• Wire activity to or from high-risk or secrecy jurisdictions with no business rationale
• Funds that pass through an account quickly with minimal balance retention
• Activity inconsistent with the customer's stated occupation, income, or business type
• Use of shell companies, nominee directors, or complex ownership structures with no apparent purpose
• Reluctance to provide information, false or inconsistent documents, or frequent changes of address or ownership
• Multiple unrelated accounts funding a single beneficiary (funnel activity)
• Negative media linking the customer to fraud, corruption, drug trafficking, or terrorism

Exam Tips: Answering Questions on Investigation Techniques and Information Gathering

Tip 1 – Start internally, then go external. When a question asks for the first or most appropriate step after an alert, the answer is almost always to review the institution's own records (KYC file, transaction history, prior alerts) before contacting third parties or running public searches. Contacting the customer or law enforcement as a first step is usually wrong.

Tip 2 – Never tip off. Eliminate any answer that involves telling the customer about the alert, the investigation, or a SAR; asking the customer pointed questions about structuring; or giving a suspicious-activity reason for closing the account. This is the single most common distractor pattern.

Tip 3 – Follow the escalation path. The correct answer typically involves escalating to the AML compliance officer or following documented procedures rather than an individual employee acting alone, filing a report unilaterally, or unilaterally freezing funds.

Tip 4 – Involve Legal for law enforcement contact. For subpoenas, search warrants, or informal requests from officers, the best answers involve verifying the request, routing it to the designated point of contact or legal counsel, preserving records, and responding within scope. Answers that involve refusing to cooperate, handing over everything without review, or notifying the customer are wrong.

Tip 5 – Look at the whole relationship. If an answer choice limits the review to a single account or a single transaction when the customer has multiple accounts or linked parties, it is probably incomplete. The exam favors reviewing all related accounts and counterparties.

Tip 6 – Documentation is always right. Any answer that emphasizes documenting the steps taken, the sources reviewed, and the rationale for the decision (including decisions not to file) is generally a strong candidate.

Tip 7 – Know the SAR narrative formula. Expect questions about what belongs in a good SAR narrative: who, what, when, where, why, and how, in plain, chronological language. Narratives that are vague, omit the reason for suspicion, or simply list transactions are poor.

Tip 8 – Reasonable suspicion, not proof. If an answer says the institution should wait until it can prove a crime or identify the predicate offense before filing, it is wrong. The institution reports suspicion; law enforcement proves crimes.

Tip 9 – Remember information-sharing safe harbors and their limits. Sharing between institutions under provisions such as 314(b) is permitted only for AML/CFT purposes and only between registered participants. Sharing a SAR itself, or sharing for marketing or credit purposes, is not permitted.

Tip 10 – Treat open-source information critically. Questions on internet research reward answers that verify information from multiple sources, consider name variants, and respect data privacy law, and penalize answers that rely on a single unverified webpage or social media post.

Tip 11 – Watch for timing words. Phrases like immediately, first, next, and before signal that the exam is testing sequence. Build a mental order: record the alert, review internal data, conduct external research, analyze, escalate, decide, document, report.

Tip 12 – Employee investigations need HR and Legal. If an employee is the subject, choose answers that involve HR, Legal, discreet evidence preservation, and restricted system access, rather than confronting the employee alone or ignoring potential SAR obligations.

Quick Review Summary

• Investigations turn alerts into decisions; the standard is reasonable suspicion
• Internal sources first (KYC, transactions, prior SARs), then external (databases, public records, OSINT, 314(b))
• Core analytical tools: transaction flow analysis, link analysis, timelines, red-flag typologies
• Confidentiality is paramount – no tipping off, SARs are secret, need-to-know only
• Law enforcement requests: verify, centralize, involve Legal, preserve, respond within scope
• Document everything, including negative findings and decisions not to file
• SAR narratives answer who, what, when, where, why, how

Master these principles and the sequence in which a professional investigator applies them, and you will be well prepared for the investigation-related questions on the CAMS exam.