Alerts

The alert is an object

In the Guardline Suite the AML alert is neither a flagged decision nor a loose notification. It is a record of its own, with identity and life cycle:

Field	Content
Subject	Customer or counterpart, with typed document and country
Scenario	Catalog code and version, translated name and regulatory reference
Severity	High, medium or low, with the origin recorded (scenario configuration or inherited from the decision)
Window	Start and end of the period the alert covers, when it is per entity
Evidence	The transactions that support the alert, stored as a snapshot at the moment of the trigger
Amount	Aggregate amount of the evidence, with explicit currency
State and outcome	Open, dispatched, confirmed, archived, reported, according to the Desk’s verdict
Origin	The engine decision or the evaluator round that produced it
Dispatch	Whether it was sent to the Desk, when, and the corresponding case

The evidence is a snapshot: the alert preserves the transaction as it was at the trigger, even if the transaction is reprocessed later. It is the property a regulatory dossier needs.

Two types of alert

Per transaction. Born when a rule in the AML workflow triggers during the evaluation of a transaction. Carries the originating decision and the transaction as evidence.

Per entity. Born from the periodic evaluator: one subject, one scenario, one window and all the operations in the window as evidence. It is the alert that detects accumulations no single transaction would show.

Both types live in the same object, appear in the same list and reach the Desk through the same contract.

Consolidation

Several triggers of the same subject in the same scenario within the scenario’s consolidation window do not generate several alerts. The first trigger creates the alert and, when dispatched, opens the case in the Desk; the following ones add evidence to the same alert and update the same case. The window is anchored to the business date of the operations, which keeps consolidation stable across reprocessing and parallel processing.

This way the analyst works the subject and the typology, and not a queue of repetitions of the same occurrence.

Fraud alerts

Fraud prevention produces alerts in the same object, inheriting the severity from the decision: a block is high, a review is medium. They stay in the FPP workbench, linked to the analyst case of the same decision, and serve the customer 360 view and the metrics. Fraud alerts are not dispatched to the Decision Desk.

What turns alert production on in a tenant is the catalog: a rule that points to an active scenario produces an alert, a rule without a scenario does not. There is no hidden switch.

The alert list in the FPP

The AML tenant sees in the FPP panel a read-only alert list, ordered by date, with a severity filter, the evidence of each alert and the link to the case in the Decision Desk. An alert not yet dispatched appears as such. The case operation (triage, investigation, committee) takes place in the CMP; the FPP list is the follow-up point for those who parametrize the scenarios and for those who need to see what the engine is producing.