In 2018, Block, Inc., the company behind Cash App, had about 18,000 transaction monitoring alerts waiting for review. By 2020 the backlog held over 169,000. On 10 April 2025, New York's Department of Financial Services announced a $40 million penalty and an independent monitor.
The consent order gives the timing. Block's own procedures gave analysts 60 days from an alert to a documented recommendation on filing. In the SARs the department reviewed from February 2021 to September 2022, a case investigation started 70 days after the alert on average. That wait sits in the case queue, after transaction monitoring raises the alert and before anyone files a report.
What is AML case management for compliance, and how does the software work?
AML case management is how a compliance team turns an alert into a decision it can defend. The analyst gathers facts, writes down the reasoning, then closes or escalates. The software keeps that work in one record, and buyers meet it as an AML case management system or solution. It's one module of the wider AML software stack.
That record is why AML case management is important. An examiner or auditor reads the case file to see what the firm knew and who made each call.
What triggers an AML case?
A case opens when a check finds something the customer file doesn't explain. Five triggers are common:
- An amount far above the customer's pattern or income.
- Structuring: smaller payments that stay under a reporting threshold.
- A sanctions or PEP screening hit.
- Adverse media that links the customer to a crime.
- A sudden change in behavior, such as new counterparties.
Picture a florist's account that took card payments for a year, then nine cash deposits of $9,500 in two weeks (illustrative). Size and structuring both fire, and you open one case for both.
Which steps take an AML case from alert to SAR filing?
Firms name the steps differently, but the work runs in six. Alert generation: a rule or a screening hit raises the alert. Case creation: the alert, the customer file and the transaction history become one record. Investigation: the AML analyst tests the activity against the file. Escalation: anything the facts don't explain goes up. Decision and resolution: the firm closes the case, watches the customer more closely, exits the relationship or files a suspicious activity report. Audit and documentation: every step stays on the record.
Which case management features do investigators need when you compare financial crime software?
Compare tools on what your investigators do with a case. Eight features carry that work:
- Every alert on one customer record. Screening, monitoring and fraud alerts on the same customer land in one case. Two analysts don't end up working one person from two queues.
- The rule and the signals with the alert. The investigator starts from why the alert fired: which rule, which threshold, which payments matched. An alert that reads only "velocity" sends your analyst into the payment history. One that reads "14 inbound transfers in 48 hours, threshold 10" starts the work on the customer file (an illustrative alert).
- Queues, deadlines and escalation. Each case has an owner and a due date. A case close to its deadline moves up before it breaks the firm's own rule, which at Block said 60 days.
- Four eyes approval. A second person signs the closures and filings your policy names, inside the tool and not in an email thread.
- Narrative and filing from the case. The SAR or STR is drafted from the case record in the format your FIU takes. Nobody types the facts twice.
- An audit trail that names who decided. Every note, override and closure carries a person and a time. An agent's work is logged the same way.
- Quality sampling. Your reviewer reopens a sample of closed alerts. A wrong closure is a false negative that nobody sees until an examiner does.
- Records kept as the rules ask, closed alerts included. The rules differ on what counts and when the clock starts, as the table below shows.
How long the case record is kept (rules as of 9 November 2026)
| Jurisdiction | What is kept | For how long | Rule |
|---|---|---|---|
| US (banks) | A copy of each SAR filed and its supporting documentation, which counts as filed with the SAR | 5 years from the filing date | 31 CFR 1020.320(d) |
| UK | Supporting records that let each transaction under customer due diligence or ongoing monitoring be reconstructed | 5 years from the end of the relationship, or from completion for an occasional transaction. Transaction records in a relationship: 10 years at most | MLR 2017, regulation 40 |
| EU, from 10 July 2027 | The record of each assessment of a possibly suspicious transaction, with the facts considered and the result | 5 years, counted from the end of the relationship, from an occasional transaction or from refusing either. A competent authority may require up to 5 more years | Regulation (EU) 2024/1624, Article 77 |
A cleared alert is part of that record. Under the EU rule, the assessment stays on file "whether or not" a report follows.
What are the common challenges in AML case management, and how fast does a backlog grow?
Four challenges come up in most teams: false positives fill the queue, cases move between spreadsheets and email, typologies change faster than rules, and each jurisdiction wants its own records. The first three end in a backlog.
The consent order names two causes of Block's backlog. The firm couldn't predict how a growing customer base would change alert volumes and staffing. New transaction monitoring tools also raised more alerts. The second cause is easy to repeat, and it compounds. In illustrative numbers:
- Eight analysts each clear 30 alerts a day, so capacity is 240.
- Arrivals run at 220 a day, and no queue builds.
- A new rule set lifts arrivals by 30 percent, to 286, and nothing about it looks like a failure on the day it ships. The queue now grows by 46 a day.
- After 20 working days the queue holds 920 alerts, 3.8 days of the team's work. After 60 it holds 2,760 (11.5 days). After 250, about a year, it holds 11,500 (47.9 days), so a new alert waits more than nine weeks before anyone opens it.
- Ten analysts stop the growth (286 / 30 = 9.5). Clearing the 11,500 within 60 working days takes about 16 ((286 + 191.7) / 30 = 15.9).
Supervisors watch the queue too. FinCEN's proposed program rule of 10 April 2026 lists ways a firm may learn that its program isn't being implemented, from independent testing to management reports. Among those reports are key risk indicators, "such as monitoring for potentially material backlogs in relevant AML/CFT processes" (91 FR 18714). At Block, the independent monitor reviews the measures meant to prevent another backlog.
Which investigation case management software helps a team that keeps its own detection?
Picture a regional bank that's keeping the transaction monitoring it has tuned for ten years and wants a better case tool (illustrative). For case management in banking like this, ingest comes first. Alerts from a system the bank keeps must land on the right customer with their evidence. Three vendors say so on their own pages. Lucinity: "Feed cases from your existing systems directly into Lucinity." NICE Actimize describes "the ability to ingest alerts and cases via a library of APIs". SymphonyAI calls SRI Investigation "detection agnostic".
A firm that's starting fresh can go the other way and put detection and cases on one engine. In complead that engine is complead Fusion. It runs onboarding checks, screening, monitoring, fraud and the investigation, and a customer keeps one risk score through all five. DLL took its screening to complead and gained case management with it. The Rabobank owned asset finance company had no case management in the screening tool it used before complead. Its case page lists "Case management and whitelisting, absent from the previous provider", and alert handling moved to "Case management with real time alerts".
Fraud raises the same ingest question. If fraud alerts come from a separate fraud detection tool, the case tool has to take those as well. When fraud and AML alerts concern one customer, how fraud and AML teams share a case matters as much as the software.
What is the best AML case management software in 2026? 8 tools compared
How we compared
complead publishes this page; we list ourselves first and say so. The other seven follow in alphabetical order. The set is the vendors with an English case management page in the search results for this term and in Flagright's own list. NICE Actimize joins because buyers search for its case manager by name in our ads data. Hawk and SAS are reserves, and Hawk's page answered our fetch with a 403 on the day. Each cell quotes or paraphrases the vendor's own page as read on 9 November 2026, or says "not on the pages read". The table has no scores or ranks. It has no prices either, because none of the eight publishes a case management price. The table covers the case tool alone, not sanctions screening or the monitoring and KYC modules that AML suites bundle.
AML case management software, read on each vendor's own page, 9 November 2026
| Vendor | Alerts it takes | AI in the case | Filing from the case | Review controls | Price published | Best for | Source |
|---|---|---|---|---|---|---|---|
| complead (ours) | Its own engine (screening, monitoring, fraud). Other systems: not in our fact sheet | Agents close routine cases once measured in shadow mode, leaving evidence, narrative and work log on each | "Reporting support within case management" | Rule fired and signals matched on each alert. The reviewer decides and the record shows who | Not published | A firm putting onboarding, screening, monitoring and cases on one engine | complead's own pages and release notes, 9 November 2026 (ours) |
| Flagright | Its own monitoring. Other systems' alerts: not on the pages read | "AI Forensics operates natively inside Case Management" | SAR filing to FinCEN and goAML countries (two counts on one page) | SLA timers by case type, jurisdiction or risk level, plus maker and checker approvals | Not published | A team that sets deadlines per jurisdiction | flagright.com |
| Hummingbird | Its own monitoring. More than 50 apps connect core banking and other tools | AI agents "automate routine casework" | "Automated SAR, STR, and CTR filing." | Not described beyond keeping "every decision defensible" | Not published | A US team filing CTRs as well as SARs | hummingbird.co |
| Lucinity | "any transaction monitoring system" or its own Scenario Builder | Luci, "our AI copilot" | "SAR filing directly from Lucinity's Case Manager" | Four eyes review, blind review, configurable checklists | Not published | A bank keeping its detection and adding a case layer | lucinity.com |
| NICE Actimize | Alerts and cases ingested "via a library of APIs", or by email | Robotic process automation for case tasks | Not on the pages read | Quality assurance with "dynamic sampling logic", approval flows and deadlines | Not published | One investigation hub across financial crime and compliance | niceactimize.com |
| Sumsub | "Ingest cases with no downtime" while moving from legacy systems | Not on the case page (Summy AI Copilot is a separate product) | Reports for suspicious activity "directly from the case workflow" | "Enforced checklists", four eyes approvals, time limits | Per verification prices only, none for case management | A firm that already verifies customers with Sumsub | sumsub.com |
| SymphonyAI | "Detection agnostic": its own or other systems' alerts | "A Manager Agent coordinates specialized Worker Agents" | Disclosure in regional formats with approval workflows | Mandatory Action Lists before case resolution | Not published | A bank that keeps its detection and wants agents to prepare cases | symphonyai.com |
| Unit21 | Agents "automatically ingest alerts". Source system not stated | Agents investigate, and "Final decisions always remain with your compliance team" | "Alerts to cases, to SARs, to QC in one place" | Targeted quality checks on sampled cases | Not published | A fintech that wants agents to gather the evidence | unit21.ai |
complead (ours)
complead, an AI native platform, keeps the case on the engine that raised the alert. Incoming alerts are routed to the right queue and assigned by load and skill. When an alert is at risk of breaching its SLA, the flow escalates it before the deadline. Agents work the routine cases to a close, and each closed case keeps its evidence, narrative and work log. Since the October 2026 release, an agent first runs in shadow mode, and its decisions are compared with your analysts' before it goes live. Your analysts keep the cases that need judgment. complead runs beside your current tool, on your own data. Demo test: ask for one closed case with its work log, and read who decided at each step.
Flagright
Flagright sets deadlines per jurisdiction. Its case page says "Configure SLA timers by case type, jurisdiction, or risk level", with maker and checker approvals and AI Forensics working inside the case. Filing is the claim to test. The page promises SAR filing for "FinCEN and 70+ GoAML jurisdictions" and, lower down, "GoAML coverage across 33 countries" (both read 9 November 2026). Ask which count covers your FIU.
Hummingbird
Hummingbird calls itself "an orchestration platform that gives your analysts and AI agents a shared place to work together". Its AI agents take routine casework. The page calls its SAR, STR and CTR filing automated, and more than 50 apps connect core banking systems, data providers and other tools. That fits a US team that files currency transaction reports as well as SARs. In the demo, ask which app carries alerts from a monitoring system you keep. Then watch one arrive.
Lucinity
Lucinity speaks to the bank that wants to keep its detection: "Feed cases from your existing systems directly into Lucinity." AML, fraud and sanctions investigations share one platform. Reviewers get four eyes review, blind review and configurable checklists, and Luci, the AI copilot, works inside the case. Analysts can "claim, close, assign, or merge multiple cases at once". Demo test: send one alert from your current monitoring and time how long it takes to appear as a case.
NICE Actimize
For a firm that wants one investigation hub across financial crime and compliance, NICE Actimize offers ActOne Extend as "the centralized location of investigation management". Alerts come in through APIs or by email. Its quality assurance adds "dynamic sampling logic", approval flows and deadlines, and robotic process automation takes routine tasks off the team. The overview page doesn't describe filing. Ask in the demo how a SAR leaves ActOne for your FIU, and who signs it.
Sumsub
Sumsub's case management suits firms that already verify customers with it. Four blueprints cover an AML investigation, suspicious activity, a screening hit and a KYC case, or you build workflows without code. Closures pass "enforced checklists", four eyes approvals and time limits, and reports come "directly from the case workflow". Published prices are per verification, none for case management. Ask what one case costs. Ask too whether the case tool is sold without verification.
SymphonyAI
In SRI Investigation, agents start the case before the investigator does. "A Manager Agent coordinates specialized Worker Agents" to gather customer context and transactions, and an Evidence Board lays out the findings. Mandatory Action Lists must be complete before a case closes. That fits a bank keeping its detection. In the demo, ask to see a case the agents couldn't finish and what they left for a person.
Unit21
Unit21's agents ingest alerts, enrich them with internal and external data and draft the narrative. The page is plain about the limit: "Final decisions always remain with your compliance team." Quality checks run on sampled cases, and alerts, cases, SARs and quality control sit "in one place". That suits a fintech that wants agents to gather the evidence. Ask which system the alerts come from when the detection isn't Unit21's.
What should a demo of AML case management software prove?
A demo shows screens. Ask for five tests on your own material instead, and time each one.
- A closed case, timed. Bring an alert your team closed last quarter. Run it from alert to decision and compare the time with what your analysts took.
- The export. Ask for the file an examiner or auditor would receive: every note, override and approval, with names and times. Hold it against the questions in the AML audit checklist.
- An alert from a system you keep. Send one of its alerts and watch it land on the right customer, with its evidence.
- A report in your FIU's format. goAML or a national form: see the draft built from the case, not retyped.
- A link between two customers. Two customers share an address or a counterparty. Check where the link is stored and whether it stays on the case after closure.
When is complead not the right fit?
Two situations. The first is a firm whose first need is document and biometric identity verification. In complead that check stays with your IDV provider. The verified identity reaches the risk model as an input. The second is a team that wants only a case layer over a detection engine it keeps. The published facts we used for this page don't cover alerts from another vendor's monitoring, so test that before you shortlist us.
Which 2026 dates matter to a case management buyer?
10 April 2026. FinCEN published its proposed AML/CFT program rule, with backlog monitoring among the risk indicators. Its 2024 proposal is "withdrawn and superseded". Comments closed on 9 June 2026, and no final rule had appeared by 9 November 2026.
3 July 2026. Unit21's June update announced "Case Agent is live": its agents now investigate the whole case before an analyst opens it.
6 October 2026. complead's September release: case summaries open from the list, and bulk actions keep your selection.
October 2026. Hummingbird acquired Quantimon, a monitoring company whose models learn from alert outcomes.
6 November 2026. complead's October release: a rule can now be capped at one alert a day for each customer.
10 July 2027 (scheduled). The EU AML Regulation applies, with its record rule for every assessment, reported or not.
Block's procedures said 60 days, and cases started after 70 on average. Three things to do this week:
- Measure two numbers on your own queue: days from alert to case start, and the age of the oldest open alert.
- Pull one closed case from last quarter, with its file.
- Send that case to every finalist, and time it in each demo against your own figure.
