The Job Nobody Writes For

Most investigation guides teach corporate fraud. This one teaches the queue.

Search "fraud investigation guide" and almost everything you find describes a different job: an investigator engaged to look into suspected embezzlement, with weeks to work, authority to interview staff, and chain-of-custody procedures aimed at court admissibility. Genuinely useful, for that job.

It is not the job of a fraud analyst at a bank, a payments firm, or a fintech. That job has an alert queue, incomplete information, a decision to make today, and an output that is not a court case. It is a disposition and a file, and the file has to survive being read eighteen months later by someone who was not there.

This guide covers the parts of that job that get taught least: how to test a theory rather than confirm one, where the legal boundary actually sits on contacting a customer, why sequence reveals what individual facts do not, and what a defensible file actually contains.

How to use this guide

Read the four patterns and the process chain first. Then work each scenario, make your call, and read why, both for the right answer and every wrong one. The knowledge check at the end pulls the same patterns from new angles. Do not skip ahead.

Four Patterns

Four patterns, four cards

Most weak investigation files trace back to one of these four shapes. Learn to recognise them before the scenarios test them.

🎯
The Theory-First File
Deciding what happened, then collecting the evidence that agrees.

The first plausible explanation arrives early and it is comfortable. Everything gathered afterwards gets read through it: facts that fit are recorded as confirmation, facts that do not are explained away as noise or set aside as irrelevant. The file ends up looking thorough and reading as conclusive, but it never actually tested the conclusion, it only decorated it. A good investigation starts by asking what would prove this theory wrong, and records the answer either way.

Trap
An early explanation feels like a finding rather than a hypothesis.
Tell
Contradicting evidence gets rationalised rather than written down.
Do
Look actively for what would disprove the working theory, record it regardless of what it shows.
🤐
The Careless Disclosure
The offence is revealing the report, not asking the question.

Under section 333A of the Proceeds of Crime Act 2002, it is a criminal offence in the regulated sector to disclose that a suspicious activity report has been made, or that a money laundering investigation is being contemplated or carried out, where that disclosure is likely to prejudice an investigation. It is strict liability, no criminal intent is required, and on conviction on indictment it carries up to two years' imprisonment.

What it is not is a blanket prohibition on speaking to customers. Nothing in POCA prevents making normal enquiries about a transaction or a relationship. The line is disclosure of the report or the investigation, not the enquiry itself. Analysts routinely get this wrong in both directions, some volunteer far too much in the name of transparency, others refuse any contact at all and lose information they were entitled to seek.

Trap
Either extreme feels safe, saying everything, or saying nothing.
Tell
The question is whether a specific disclosure reveals the report or the investigation, not whether contact happened at all.
Do
Make normal enquiries where they are useful. Never disclose the SAR or the investigation. When unsure what can be said, ask the MLRO before speaking, not after.
🧭
The Missing Timeline
Individually explainable facts stop being explainable once they are put in order.

A login, a password change, a payment, a support call, each one has a mundane reading in isolation. Sequenced, with timestamps, the same four facts can describe an account takeover in progress. Investigations that collect evidence into a list rather than a chronology systematically miss patterns that only exist in the ordering, and the reasoning becomes much harder to explain to a reviewer who cannot see the sequence either.

Trap
A collection of facts feels like an analysis.
Tell
The file has evidence but no constructed chronology.
Do
Build the timeline before reaching a conclusion, most fraud patterns live in the sequence rather than the individual events.
✍️
The Unwritten Reasoning
The file records what was found and what was decided, but not why one led to the other.

While the case is live the logic feels self-evident, so it never gets written down. Months later the file contains evidence, a disposition, and a silent gap between them. A reviewer, an auditor, or a regulator cannot reconstruct the reasoning, and an unexplained decision reads as an unconsidered one even when it was neither. The test is not whether the analyst understood it at the time, it is whether someone unfamiliar with the case can follow it cold.

Trap
Obvious reasoning feels like it does not need recording.
Tell
The file jumps from evidence to disposition with nothing connecting them.
Do
Write the reasoning for a stranger reading it in eighteen months, not for yourself today.
The Reporting Chain

The process, end to end

Four stages, two decision points. The first fork asks whether you have suspicion at all. The second, and by far the more consequential one, asks whether anything you are about to do would itself be a principal money laundering offence.

Stage 1 · Detection
A case reaches the queue
All routes feed the same triage step. The route a case arrived by is itself information worth recording.
Transaction monitoring alert Screening hit Staff referral Customer or victim report Institution or law enforcement notification
↓
Stage 2 · Investigation
Secure records, then build the picture
Secure the records before contacting anyone. Build the timeline. Test the working theory by looking for what would disprove it. Make normal enquiries where they would genuinely help, without disclosing suspicion, a report, or an investigation.
↓
Stage 3 · The decision point
Do you have knowledge or suspicion of money laundering?
No
Document the reasoning, close the case, and feed the outcome back into detection rules so the same false positive pattern gets tuned out rather than recurring indefinitely.
Yes
Make an internal report to the MLRO. In the regulated sector this is an obligation under section 330 of POCA, not a discretionary escalation.
↓
Stage 4 · After the internal report
MLRO assesses and files a SAR with the NCA where warranted
Under section 331. Then a second question determines everything that follows.
↓
Is there a proposed act that would be a principal money laundering offence?
Sections 327 to 329, for example processing the very transaction that triggered the alert
No
The SAR stands on its own. No further authorisation is needed because nothing is being authorised.
Yes
A defence against money laundering request is required under section 338. See below.
Most frequently missed
A SAR is not a DAML.
This is the most consequential distinction in the entire process. Filing a SAR and then processing the transaction anyway leaves the firm with no statutory defence, and the act itself may constitute a principal money laundering offence. The report does not authorise anything, it only reports.
Granted
The NCA grants the request within the seven working day notice period. A defence is available.
Deemed consent
The notice period expires with no response at all. A defence is available under section 335(2).
Refused
A moratorium of 31 calendar days begins on the day of refusal. The prohibited act must not be carried out, though other work on the file can continue. Extendable by court under section 336A up to 186 days.
Running throughout stages 3 and 4: the tipping off constraints under section 333A apply with full force, and the NCA cannot grant a defence for tipping off or for prejudicing an investigation. Those offences sit outside the DAML regime entirely, no consent route exists for them.

Stage 1, detection

A case reaches you through a small number of routes: a transaction monitoring alert, a screening hit, a referral from customer-facing staff, a report from the customer or a victim, or a notification from another institution or law enforcement. All of them feed into the same triage step, and the route a case arrived by is itself information worth recording.

Stage 2, investigation

Secure the records before contacting anyone. Build the timeline. Test the working theory by looking for what would disprove it. Make normal enquiries where they would genuinely help, without disclosing suspicion, a report, or an investigation.

Stage 3, the decision point

Do you have knowledge or suspicion of money laundering?

  • If no, document the reasoning, close the case, and feed the outcome back into detection rules so the same false positive pattern gets tuned out rather than recurring indefinitely.
  • If yes, make an internal report to the MLRO. In the regulated sector this is an obligation under section 330 of POCA, not a discretionary escalation.

Stage 4, after the internal report

The MLRO assesses it and files a SAR with the NCA where warranted, under section 331. Then a second question determines everything that follows: is there a proposed act that would be a principal money laundering offence under sections 327 to 329, such as processing the very transaction that triggered the alert?

  • If no, the SAR stands on its own.
  • If yes, a defence against money laundering request is required under section 338. This is the most consequential distinction in the entire process and the most frequently missed one. A SAR is not a DAML. Filing a SAR and then processing the transaction anyway leaves the firm with no statutory defence, and the act itself may constitute a principal money laundering offence. The report does not authorise anything, it only reports.

Once a DAML is submitted:

  • A notice period of seven working days begins, starting the first working day after the disclosure is made.
  • If the NCA grants the request, or the notice period expires with no response at all, a defence is available. The no-response route is deemed consent under section 335(2).
  • If the request is refused, a moratorium period of 31 calendar days begins on the day of refusal. The prohibited act must not be carried out, though other work on the file can continue.
  • A senior law enforcement officer can apply to court under section 336A to extend the moratorium in further increments, up to a maximum of 186 days.

Throughout stages 3 and 4 the tipping off constraints under section 333A apply with full force, and the NCA cannot grant a defence for tipping off or for prejudicing an investigation. Those offences sit outside the DAML regime entirely, no consent route exists for them.

Where the underlying matter is fraud rather than pure money laundering, two further threads run alongside this chain: the account and relationship decision, and victim remediation where a reimbursement obligation applies.

🎯
Scenario 01 · Testing vs. confirming
The Comfortable Theory
The Theory-First File
⚖️
What do you do? Make the call

An alert flags a series of round-figure payments from a customer's business account to an unfamiliar overseas counterparty. Your working theory is invoice fraud, the pattern fits and you have seen it before. Partway through the investigation you find a signed supply agreement between the two parties, dated eight months before the first payment, with terms matching the payment amounts and schedule.

🤐
Scenario 02 · The disclosure boundary
The Question You Are Allowed to Ask
The Careless Disclosure
⚖️
What do you do? Make the call

You are investigating an alert on a customer's recent high-value transfer. No SAR has been filed and none is currently contemplated, you are still establishing the facts. You want to understand the transfer's stated purpose. A colleague tells you not to contact the customer at all, because "tipping off is a criminal offence."

✍️
Scenario 03 · What a file has to show
The Silent File
The Unwritten Reasoning
⚖️
What do you do? Make the call

You review a colleague's closed case from four months ago. The file contains the original alert, account statements, the customer's KYC record, a copy of a supplier invoice, and a disposition of "no further action, alert closed." Every document is present and legible. There is no written explanation of what the analyst concluded or why.

Knowledge Check
Five questions. Would your file survive being read cold?
1. What does section 333A of POCA 2002 actually prohibit?
2. Does the tipping off offence require intent to prejudice an investigation?
3. Why does contradicting evidence need recording even when it complicates the theory?
4. What is the practical test for whether a file's reasoning is adequately documented?
5. What is the central argument this guide makes about fraud investigation in a regulated firm?
0/5
Frequently Asked

FAQ

Does making an enquiry of a customer ever become tipping off on its own? +
The enquiry itself is not the offence. The offence under section 333A is disclosing that a report has been made, or that a money laundering investigation is contemplated or underway, where that disclosure is likely to prejudice an investigation. An enquiry becomes a problem when its framing reveals one of those things, which is why phrasing matters more than the fact of contact.
What if a customer directly asks whether a report has been made about them? +
This is the situation where firms most often get into difficulty. The answer cannot confirm the existence of a report, and an evasive answer that effectively confirms it is no safer. Firms should have an agreed position on this before it happens rather than leaving analysts to improvise, and any doubt should go to the MLRO before a response is given.
How much detail does the reasoning in a file actually need? +
Enough that someone unfamiliar with the case, reading it cold with no ability to ask questions, can follow how the evidence produced the disposition. That usually means stating what was considered, what was concluded, and what specifically supported that conclusion, not a lengthy narrative.
Should a disproved theory be recorded, or only the final conclusion? +
Record it. A file showing that a theory was considered and ruled out on specific evidence is stronger than one that only presents the final answer, because it demonstrates the conclusion was tested rather than assumed. Investigations that only document the winning theory look thinner under review, not cleaner.
Quick Reference

At a glance

Four patterns, the trap that makes each one look routine, the tell that actually gives it away, and the response that fits.

🎯
The Theory-First File
Deciding what happened, then collecting the evidence that agrees.
Trap
An early explanation feels like a finding rather than a hypothesis.
Tell
Contradicting evidence gets rationalised rather than written down.
Do
Look for what would disprove the working theory, record it either way.
🤐
The Careless Disclosure
The offence is revealing the report, not asking the question.
Trap
Either extreme feels safe, saying everything, or saying nothing.
Tell
The question is whether a disclosure reveals the report, not whether contact happened.
Do
Make normal enquiries. Never disclose the SAR or the investigation. Ask the MLRO before speaking, not after.
🧭
The Missing Timeline
Individually explainable facts stop being explainable once they are put in order.
Trap
A collection of facts feels like an analysis.
Tell
The file has evidence but no constructed chronology.
Do
Build the timeline before concluding, most fraud patterns live in the sequence.
✍️
The Unwritten Reasoning
The file records what was found and what was decided, but not why one led to the other.
Trap
Obvious reasoning feels like it does not need recording.
Tell
The file jumps from evidence to disposition with nothing connecting them.
Do
Write the reasoning for a stranger reading it in eighteen months, not for yourself today.
The File Is the Output

The file is the output, not a by-product of reaching a decision.

FinCrimeRadar's Scenario Lab puts the same investigative decisions in front of you under real time pressure and partial information, free, no signup required.

Want to practise the decisions rather than read about them? Free. No account needed. Work real cases under time pressure and partial information.
Open the Scenario Lab →