Customer communication permitted? (Yes/No; approved wording reference)
Follow-up actions:
Tuning/rules update? (Yes/No)
Training reminder? (Yes/No)
Vendor issue? (Yes/No)
Template 4 — Customer Communication (Neutral, non-accusatory)
Use only if your policy allows customer messaging at this stage.
Option A — Short
“Your request is currently under compliance review. We will update you as soon as possible.”
Option B — Request for information
“To complete our compliance review, please provide the following information: [list]. Once received, we will continue processing.”
Option C — Decline (high level)
“We’re unable to process this request due to regulatory requirements.”
Do not say
“You are sanctioned.”
“We matched you to a watchlist.” (Unless explicitly allowed by policy.)
Template 7 — Control Tuning Proposal (Reduce noise safely)
Use when proposing changes to thresholds/rules/lists.
Control Tuning Proposal
Current issue: (false positives volume / false negatives / new pattern)
Evidence: (samples, metrics, screenshots)
Proposed change:
rule/threshold/list update:
expected effect:
Risk assessment:
risk of increasing false negatives:
mitigations (QA sampling, phased rollout):
Approval required from:
Implementation plan:
Post-change monitoring plan:
Quick reference: “Audit-ready” means these 7 questions can be answered
What triggered the case?
What did we stop, and when?
Who was involved (with identifiers)?
What was the activity context (amount, corridor, goods/services)?
Who decided, and why?
What action was taken (release/reject/block) and when?
What did we do to prevent recurrence (lookback/tuning/training)?
Knowledge check (5 questions)
If you cannot find a field (e.g., DOB), you should leave it blank to save time. True or false?
A good escalation includes both the match output and the transaction/shipping context. True or false?
“Stop” actions must be time-stamped and linked to a case ID. True or false?
Customer communications should avoid naming sanctions lists unless policy allows it. True or false?
Control tuning should consider false negatives risk, not only reducing false positives. True or false?
Answers
False. Write “Not available” so it’s explicit and auditable.
True. Context often determines whether restrictions apply.
True. Auditors expect traceability and a system of record.
True. Disclosures can be sensitive and policy-driven.
True. Efficiency improvements must not reduce effectiveness.
Continue
Next, learn how to triage alerts quickly: which identifiers matter most, how to resolve common false positives, and when to treat a case as high severity.