Case Management Platform (CMP)
What it is
Section titled “What it is”The Case Management Platform (CMP) is the Decision Desk of the Guardline Suite. It orchestrates the lifecycle of cases that require human analysis: fraud alerts, refund requests (MED), AML alerts, registration reviews of natural persons and legal entities, and committee deliberations.
The CMP centralizes backoffice work in a single platform, with configurable desks and queues, regulatory SLAs, automatic case distribution, customer communication through the institution’s own channels and a complete audit trail. It works both as a module integrated into the Guardline Suite and on its own, compatible with third-party decision engines.
Features
Section titled “Features”Desks and work queues
Section titled “Desks and work queues”Cases are organized into desks, each with its own entry point, its analysts, its SLAs and its distribution rules. Each desk has an entry queue, where new cases are distributed, and a supervisor queue, where escalated cases are sent.
| Desk | Scope |
|---|---|
| MED | PIX special refund mechanism requests |
| Fraude | Transaction alerts, suspicious patterns, device intelligence, counterparts |
| Cadastro PF | Onboarding of natural persons: document verification, biometrics, PEP, sanctions, legal proceedings |
| Cadastro PJ | Onboarding of legal entities: ownership structure, beneficial owners, legal representatives |
| AML | Money laundering alerts, triage, investigation, committee and communication to COAF |
| Comercial | Registration cases referred by the Cadastro desks, decided with the origin desk’s decision codes |
Queue names are defined at deployment time, following the institution’s vocabulary. Queues can be renamed, activated and deactivated by the administrator, and a queue with pending cases cannot be deactivated.
Regulatory SLAs
Section titled “Regulatory SLAs”The deadline of each case is defined by an SLA policy, per desk, per queue and per case status. The policies are adjusted by Guardline at deployment time, following the institution’s internal policy and the applicable regulation.
| Desk | Initial deadline per step |
|---|---|
| MED | 60 min new, 45 min in analysis, 30 min escalated |
| Cadastro PF, Cadastro PJ, Comercial | 24 h per step |
| AML | 45 days for selection and for analysis, 1 business day for committee and board |
| Fraude | Defined at deployment, according to the institution’s policy |
The deadlines above are the values delivered at deployment. The system monitors SLAs automatically:
- SLA at risk: flagged in the queue and in the case detail when 15 minutes remain before the deadline
- SLA breached: the case is highlighted in the queue and in the operational metrics
- Breach rate metrics: visibility by desk, queue and analyst in real time
The AML desk has monitoring of its own, in bands of calendar days until the deadline, suited to the scale of its flow, and tracks the specific regulatory deadlines: the alert selection deadline, the analysis deadline and the deadline to submit the communication to COAF.
Case distribution
Section titled “Case distribution”Distribution is configurable per queue and determines which analyst receives the next case.
| Strategy | How it works | When to use |
|---|---|---|
| Minimum idle time | Delivers to the analyst who has been available the longest without a case | Default. Balances the load naturally |
| By skill | Considers the registered skills, on the MED and Cadastro PJ desks; on the others it falls back to minimum idle time | Teams specialized by case type |
Automatic distribution respects real-time availability: only an analyst who is online and not on a break receives cases, and the maximum capacity of simultaneous cases is observed. Break types are registered by the institution.
The analyst can also pull the next case from the queue on their own, subject to the same rules. Direct assignment by the manager is an exception path: it hands the case to the chosen analyst regardless of availability, break or capacity.
Case file
Section titled “Case file”When the analyst opens a case, they get the case file on a single screen:
- Customer data (registration, score, segment)
- Transaction context and the counterparts involved
- Onboarding result, with decision tree, documents and biometrics, when the customer came in through the ONP
- Alerts and triggered rules, with the contribution of each rule to the score
- Behavioral baseline (UBA) and anomaly comparisons
- Standing on restrictive lists, PEP, sanctions, legal proceedings and public debts
- Attachments and evidence uploaded by the analyst
- History of the communications exchanged with the customer
- Audit timeline with every recorded event
Analyst actions
Section titled “Analyst actions”The available actions depend on the desk. Deciding requires the case to be assigned to the analyst themselves; supervisors, committee members, AML directors and administrators are exempt from that requirement.
| Action | Description |
|---|---|
| Approve | Release the transaction, the refund or the registration, with or without additional verification |
| Reject | Block or refuse, classifying the reason (fraud, invalid document, compliance) |
| Request information | Set the case pending while waiting for additional information from the customer or another area |
| Escalate | Send it to the supervisor queue of the same desk |
| Transfer to another desk | Send the case to another desk when the analysis reveals a different nature |
| Recalculate risk | Reprocess the risk of the case against the onboarding engine. Available only on the Cadastro PF desk |
| Record failure | Mark the case as failed when the occurrence could not be opened or processed |
Every action is recorded in the audit trail. A text justification is required on MED acceptance and rejection and on cross-desk transfer, and is optional, though recommended, on the other decisions. The analyst can keep personal justification templates to speed up recurring decisions.
Cross-desk transfers
Section titled “Cross-desk transfers”When the analysis reveals that the case belongs to another area, the analyst transfers it to the corresponding desk. The case keeps its type, its history and its audit trail, and returns the same way when the other desk finishes its opinion.
| From | To |
|---|---|
| Cadastro PF | Fraude, AML, Comercial |
| Cadastro PJ | Fraude, AML, Comercial |
| Fraude | Cadastro PF, Cadastro PJ |
| AML | Cadastro PF, Cadastro PJ |
| Comercial | Cadastro PF, Cadastro PJ |
Each transfer records origin, destination, actor and justification.
Customer communication
Section titled “Customer communication”The CMP talks to the customer from within the case itself, without the analyst having to leave the screen or use separate tools.
- Channels: email, WhatsApp, SMS and voice, integrated with the providers contracted by the institution
- Message templates: versioned templates, with validated variables and a preview before sending
- Automatic sending by status: rules that fire the message when the case changes status, configurable per desk and per channel
- History on the case: every message sent and every reply received is attached to the case and to the audit trail
- Operations: provider health panel, reprocessing of received events and requeueing of failed messages
AML flow
Section titled “AML flow”The AML desk runs a flow of its own, longer than that of the other desks, from the alert received to the communication to COAF.
New alerts for a customer who already has an active case are consolidated into that case, so the analyst works the customer and not the isolated alert. The exception is the cash operation report (COE, comunicação de operação em espécie): cash movements at or above R$ 50.000,00, when the source system identifies them as a cash operation, always open a case of their own, without consolidation, skip triage and go straight to XML generation.
The conclusion of the investigation is submitted for review by another user: the reviewer can be neither the analyst assigned to the case nor the person who concluded the investigation.
Decision committee
Section titled “Decision committee”When the investigation confirms indicators, the case automatically opens a committee session. Opening it checks whether there are enough eligible members for the quorum and freezes the composition and the quorum in force, so that a later configuration change does not alter the rules of a session in progress.
Committee flow:
Committee rules:
| Rule | Definition |
|---|---|
| Composition | Members registered by the administrator, with a free-form position (compliance, legal, operations) |
| Minimum quorum | Configurable, 3 members by default. The value in force at the opening applies until the closing |
| Voting | Approve or reject, one vote per member, with an optional individual justification |
| Automatic closing | As soon as all eligible members vote, the session closes and the result is applied |
| Early closing | Only the director of the session, with the quorum already reached and stating the reason |
| Tie-break | In a tie, closing requires the vote of the AML director, who decides the session |
| Record | Votes, justifications and the result are recorded on the session and in the audit trail |
Audit trail
Section titled “Audit trail”Every action in the Decision Desk is recorded automatically, append only, with no editing or deletion by the application:
- Case creation and its origin (rules engine, manual, external system)
- The full payload received, preserved as it came from the source
- Score calculated and risk assigned
- Analyst assignment and reassignment
- Start and end of each analysis
- Escalations and cross-desk transfers, with reason and destination
- Communications sent to the customer and replies received
- Committee votes with individual justification
- Final decision with a text justification
- Ingest rejections, with source, reason and network address
- Timestamp of each event
The record is directly accessible to the institution for export, serving as the regulatory dossier for COAF and internal audits, in compliance with BACEN Circular 3.978.
Report to COAF
Section titled “Report to COAF”When a case results in a mandatory report, the CMP organizes the people involved, the operations, the regulatory classifications and the case narrative and generates the SISCOAF-compatible XML, ready for the institution to submit. The protocol number, the receipt and the hash of the communication are recorded in the case, as are later rectifications and cancellations.
Compatibility with third-party engines
Section titled “Compatibility with third-party engines”The CMP does not require the use of the Guardline decision engine. Institutions that already have their own fraud, onboarding or AML engine can adopt the Decision Desk on its own, sending cases to the entry point of each desk and operating queues, SLAs, committee and audit trail over any source of alerts.
Access profiles
Section titled “Access profiles”| Profile | Access | Description |
|---|---|---|
| Analyst | Decision Desk | Analyzes and decides the cases assigned to them in the queues they take part in |
| Supervisor | Queues, redistribution, dashboards and user management | Tracks SLAs, reassigns cases and receives escalations |
| Committee member | Committee sessions, in addition to supervisor access | Votes in the sessions and records the justification for the vote |
| AML director | Committee, annual audit and communications, in addition to administrator access | Closes sessions early, decides the session in a tie and conducts the communication to COAF |
| Administrator | System configuration | Configures desks, queues, SLAs, distribution, communication, API tokens and users |
| Viewer | Read only | Follows cases and indicators with no power to act |
The analyst and supervisor profiles support variants by level and by area (analyst N1 and N2, AML supervisor), which inherit the permissions of the source profile and allow finer rules in the AML flow.
Version 18, updated on