Sift

• A1-structuring

  sub-$10k cash across branches → escalate

• A2-cash-consistent

  cash-intensive store, consistent → close

• A3-funnel

  funnel/pass-through to UAE → escalate

• A4-remittance

  established 18-month remittance → close

• A5-round-wire

  round invoice wire from known UK client → close (note acceptable given the repeat pattern with A11)

• A6-new-velocity

  new account, high velocity vs no-income → escalate

• A7-payroll

  scheduled payroll → close

• A8-deviation

  profile deviation, new Cyprus beneficiary → escalate

• adv-A11-benign-trap

  large round cross-border wire from an established client with a prior closed alert → close (over-escalation guardrail)

Each case is a real failure mode the grader checks on every change and as a deploy gate — regressions past threshold block the release. Adversarial cases probe the failure modes the golden set doesn't.

Briefing

• Front-line triage of transaction-monitoring alerts: clears the false positives efficiently, escalates activity that genuinely warrants investigation.
• The central test is fit — can the flagged activity be reconciled with who the customer is, their expected activity, and their history?
• Weighs recognized typologies (structuring under reporting thresholds, funnel and pass-through flows, new-account velocity) against benign explanations like a cash-heavy business with a consistent record.
• Doubt resolves upward: anything it cannot reconcile goes to investigations rather than being closed to empty a queue.
• Hands off with a risk score, reason tags, and a short narrative; it files nothing itself.