Decision Desk and the return path

Dispatch to the Desk

A dedicated FPP process reads the AML alerts ready for dispatch and sends them to the CMP of the same tenant. Two rules govern the sending:

• Severity. Medium and high severity alerts go to the Desk. Low severity alerts are recorded and aggregated in the FPP, available to Compliance, and do not open a case. The minimum dispatch severity is a scenario parameter, editable by Compliance.
• Double gate. Dispatch only happens when the tenant’s profile includes AML and there is an active AML workflow. No AML material reaches the Desk from a fraud-only tenant, and no AML alert is delivered to the institution’s fraud integrator.

Dispatch uses the same delivery mechanism that serves the platform’s webhooks: durable queue, retries with backoff, exhaustion alert and authentication by the tenant’s API key.

The contract between FPP and CMP

The alert reaches the Desk in a jurisdiction-neutral contract, the same whatever the tenant’s jurisdiction:

Block	Content
Identification	Stable alert identifier (idempotency key), type (per transaction or per entity) and domain
Subject	Document with type and country, without inference
Scenario	Code, name, jurisdiction, catalog version and regulatory reference
Severity	Level, severity origin and scenario SLA
Window and amount	Period covered and aggregate amount with mandatory currency
Evidence	The alert’s transactions, with a declared cap and a truncation flag when the cap is reached
Customer risk	Risk level with provenance and measurement date; empty when there is no measurement, never invented
Engine	Score and score scale, so that the Desk can rescale without heuristics

The Desk replies saying what happened: case created, consolidated into an already open case of the same subject, or updated (new trigger of the same alert). The FPP stores the correlation between the alert and the case number, which is what the alert list shows and what the return path uses.

What the Desk does with the case

The CMP owns the case. In the AML desk the case goes through triage, investigation, review by another user and committee, and the Desk organizes the case dossier with which the institution files its report with the regulator. New alerts for the same customer with an active case are consolidated into it. How the AML desk, the committee and the audit trail work is described in the Case Management Platform.

The case reaches the Desk with amount, currency, scenario, severity and risk level filled in from the alert, and the AML screens of the Desk are jurisdiction-agnostic: country resolved from the case, currency and date in the locale format, in the language of the jurisdiction.

The return path

The Desk’s verdicts return to the FPP. The CMP emits its AML events (triage concluded, committee approved, committee rejected, report filing recorded, rectified, canceled and submission error) to a signed FPP receiver, which:

1. verifies the signature and discards repeated deliveries, because the Desk redelivers on failure;
2. resolves the case to the correlated alerts (a case can contain several alerts);
3. writes the new state and the outcome to each alert;
4. records an event in the customer history, visible in the 360 view.

The verdict does not change the fraud score

By default, the committee’s verdict does not change the customer’s fraud score or the evaluation of future transactions. The history of confirmed alerts is available as a customer attribute, and the institution can choose, through deployment configuration and with the corresponding equivalence proof, to have that history feed the risk. The option starts turned off.

Customer risk level

The risk level sent to the Desk carries provenance and date. The customer’s hierarchical risk matrix belongs to the Onboarding Platform; when it is available, its level is what travels; when it is not, the FPP sends the level from its own formula, identified as such, or none. The platform never labels a formula as a matrix.