Case Documentation Standards

Core components

Structured fields vs narrative

Structured fields feed labels, metrics and models (see Fraud Labeling and Feedback Loops). The narrative supports judgment, QA and SARs. A case needs both, and neither substitutes for the other.

Narrative structure

Every case narrative follows Facts → Analysis → Conclusion → Action:

1. Trigger. Why the case exists (alert, referral, complaint)
2. Facts. What the evidence shows, in chronological order, with sources
3. Analysis. What the facts mean; indicators present and absent; innocent explanations considered
4. Conclusion. Finding and confidence level (see Investigation Standards)
5. Action. What was done, and why it's proportionate

Writing rules

• Use facts instead of adjectives. "Three withdrawals totaling $4,200 to a debit card added 12 minutes after a phone-number change" beats "suspicious withdrawals."
• Source every fact. "Per login logs," "per customer call recording," "per device report."
• Dates and times in a consistent time zone.
• Distinguish observation from inference. "Device ID matches 6 other accounts (observed). Likely common control (inference)."
• Record exculpatory evidence. "Customer has 4-year tenure and prior withdrawals to a similar bank."
• No speculation about protected characteristics. No opinions on the customer's character.
• No detection-method detail in customer-facing fields.
• Plain language. Expand acronyms on first use for readers outside fraud.
• Write for a stranger. Someone with no context should be able to reconstruct the decision.

How to build it

SAR-ready notes

Where a case may lead to a SAR, the case record should already contain what the BSA function needs to write the narrative. The classic structure is who, what, when, where, why and how (see BSA-AML and SAR Filing):

Also capture:

• Date of initial detection. This starts SAR clocks: generally 30 days for banks, extendable to 60 if no suspect is identified.
• Relevant FinCEN SAR key terms where an advisory or alert asks for one (e.g., the 2023 pig-butchering alert and the 2024 deepfake alert each specify one)
• Supporting documentation location. For banks, supporting documentation is treated as filed with the SAR and must be retained for five years.

Reason codes

Every customer-facing action needs:

• An internal reason code (specific, from the taxonomy)
• A customer-facing message category (general, approved by legal and compliance)
• A support script reference

This lets support explain actions consistently without exposing detection logic, and lets complaints teams trace outcomes to rules (see Rule Governance and Change Management).

Regulatory documentation

Retention and access

• Retention periods set with legal and compliance by record type. SAR supporting documentation for banks: five years from filing.
• Access to case records is least-privilege and logged (see Insider Access Controls)
• Edits to closed cases are versioned with reason
• Attachments stored in the case system rather than personal drives or chat
• Privacy requirements for sensitive data (see Privacy and Data Use in Fraud Prevention)

Artifacts and templates

Alert decision note (short form)

Trigger: [Rule/model ID] – [one line]
Evidence reviewed: [checklist items]
Key facts: [2–4 bullet facts with sources]
Assessment: [why this is / isn't consistent with fraud; innocent explanations considered]
Decision: [disposition] | Confidence: [level]
Action: [what was done]
Reason code: [code]

Investigation case summary (long form)

1. Case ID / tier / investigator / dates
2. Trigger and investigation question
3. Subjects and linked entities (IDs + link rationale)
4. Timeline of key events (dated, sourced)
5. Money flow: in → movement → out; amounts; recoverable funds
6. MO and actor classification
7. Analysis: indicators present/absent; exculpatory evidence
8. Conclusion and confidence
9. Actions: account, recovery, victim remediation
10. Referrals: AML/BSA (date), legal, law enforcement, partners
11. Label updates (all entities)
12. Lessons / rule & model feedback

Referral to BSA/AML template

Referral date/time | Date of initial detection
Subjects (internal IDs) | Accounts involved
Activity summary (who/what/when/where/why/how)
Amounts and date range
Relevant FinCEN key term(s), if applicable
Evidence location (case system link)
Fraud team contact

Documentation QA checklist

• Structured fields complete and consistent with narrative
• Narrative follows Facts → Analysis → Conclusion → Action
• Every fact sourced
• Observation and inference separated
• Exculpatory evidence considered
• Action proportionate to stated confidence
• Referrals timestamped
• Reason code correct
• No SAR references in customer-visible fields
• No unnecessary sensitive data

Metrics

Pitfalls

• "Suspicious, declined." Notes that record a conclusion without facts.
• Copy-paste narratives. Templates help structure but shouldn't replace thinking. QA should look for identical narratives across different cases.
• Narrative contradicts disposition. The model trains on the disposition, so the inconsistency poisons labels.
• Evidence in chat threads. Chat isn't retained or searchable, so the evidence can't support the decision later.
• Over-documentation. Pages of screenshots no one reads; capture what supports the conclusion.
• AI-drafted narratives unchecked. Summaries can omit or invent facts. The analyst owns every sentence.

Related

• Fraud Program Overview · Investigation Standards · Alert Review Operations · Fraud QA Program
• Case Management Systems · BSA-AML and SAR Filing · Fraud Labeling and Feedback Loops
• Fraud Analyst Onboarding Curriculum · SOP Writing Standards

Sources and further reading

• eCFR, 31 CFR 1020.320: SAR timing from initial detection, 5-year retention of SAR copies and supporting documentation
• Cornell LII, 31 CFR 1020.320: the same rule text, including supporting documentation being deemed filed with the SAR
• CFPB, Regulation E §1005.11: the error-resolution timeline elements a claims case record must evidence
• FinCEN Alert FIN-2023-Alert005 (pig butchering): an example of a SAR key term requested in alerts
• FinCEN Alert FIN-2024-Alert004 (deepfake media): key term placement in SAR field 2 and the narrative