AML Case Study Simulation: Sample Investigation Examples

These are illustrative examples only -- invented to show the shape and depth of a real investigation, not an actual candidate's submission or a real customer's records. Every case worked inside the CAMP AML Investigation Simulator follows this same structure: a customer profile, a set of red flags, an investigation, and a graded disposition.

A Day in the Life: L1 Analyst to L2 Investigator

The case studies below are worked the same way a real AML/CFT desk works them -- through the two roles the CAMP AML Investigation Simulator puts you in as you progress.

As an L1 Analyst, your day starts with a queue, not a blank page: a stack of system-generated alerts -- a structuring pattern, a sanctions-list near-match, a sudden spike in a dormant account -- each with a customer profile and a transaction ledger attached. Most of your time goes to triage: is this alert explainable by ordinary customer behaviour, or does it need a closer look? You check KYC on file, compare the pattern against known typologies, and either clear the alert with a documented rationale or escalate it. The skill being graded isn't speed, it's judgment -- knowing which of a dozen similar-looking alerts is the one that actually matters.

As an L2 Investigator, the alerts reaching you have already been escalated -- your job is the deeper case investigation an L1 triage isn't meant to do. You pull the full transaction history, run beneficial-ownership and adverse-media checks, and build the narrative that connects individual transactions into a pattern: is this structuring, trade-based laundering, or a shell-company funnel account? The case ends the same way a real one does -- a disposition, and if it's warranted, a SAR/STR-style write-up with a rationale that would hold up to a compliance reviewer, not just a guess at the right checkbox.

Every case in the CAMP AML Investigation Simulator is graded against a deterministic rubric at both stages, with a Director and Investigation Lead reviewing your write-ups -- not just whether you flagged the right alert, but whether your reasoning would convince someone else it was right.

Structuring at a Retail Deposit Desk

Typology: Structuring / Smurfing

Customer profile: A retail customer with a declared cash-intensive small business (a convenience store) begins making cash deposits of $9,200–$9,800 across three different branches, four to five times a week, over a three-week period.

Red flags:

• Every deposit sits just under the $10,000 currency-transaction reporting threshold
• Deposits are deliberately spread across multiple branches rather than the customer's usual home branch
• Deposit frequency and pattern do not match the seasonal cash flow the business previously showed

Investigation: The alert is triaged first against the customer's 12-month deposit history to confirm the pattern is new, then the branch-spread and sub-threshold sizing are checked against known structuring indicators. A request for information is sent asking for supporting documentation on the recent cash volume increase.

Disposition: Escalated to L2, then L3: the customer's explanation (an unverifiable claim of "increased weekend sales") does not reconcile with point-of-sale records obtained separately, and a SAR/STR is recommended for structuring designed to evade currency-transaction reporting.

Under-Invoiced Exports in a Trade Finance Relationship

Typology: Trade-Based Money Laundering (TBML)

Customer profile: A corporate customer operating as a textile exporter requests financing against a series of export invoices to a buyer in a jurisdiction with weak AML controls, at unit prices roughly 40% below comparable market rates for the goods described.

Red flags:

• Invoiced unit price is materially below the going market rate for the stated goods
• Shipping documentation and invoice quantities show minor but recurring mismatches
• The buyer entity has no verifiable online presence or trade history prior to this relationship

Investigation: The case compares invoice pricing against independent trade-pricing data, cross-checks the bill of lading against the invoiced quantity, and runs adverse-media and corporate-registry checks on the buyer entity to establish whether it is a real, operating counterparty.

Disposition: Escalated to L3: the pricing gap and unverifiable buyer together meet the bank's TBML red-flag threshold, and the case is closed with a SAR/STR recommending enhanced monitoring of the entire trade relationship, not just the flagged transaction.

Shell-Company Layering Through a Funnel Account

Typology: Shell Company / Funnel Account

Customer profile: A newly onboarded corporate account with no employees on record and a registered address shared with dozens of other entities receives a high volume of small incoming wires from unrelated individuals, then sends the aggregated balance out as a small number of large outbound transfers within 24–48 hours each time.

Red flags:

• Shared registered address is a known company-formation/virtual-office address, not an operating business location
• Incoming senders have no apparent business or personal relationship to the account holder
• Funds are consolidated and moved out quickly, with little to no operating-expense activity in between

Investigation: Beneficial-ownership records are pulled to identify the entity's real controlling parties, the shared-address pattern is checked against other flagged entities at the same registration, and the funnel behaviour (many small credits, few large debits, minimal dwell time) is confirmed against the account's full transaction history.

Disposition: Escalated to L3: the combination of a shell-like registration profile with classic funnel-account movement meets the bar for a SAR/STR, and the account is recommended for exit rather than continued monitoring given the absence of any legitimate business rationale found.