AML case management and post-complaint case management: where one stops and the other starts

The line between them, in one sentence

AML starts with a signal the bank generated. Post-complaint operations start with a complaint somebody else generated.

That difference in origin changes everything downstream: who sets the deadline, what counts as a good outcome, and who asks about it afterwards.

An AML alert has no external clock until it becomes a report. An NCRP or I4C case arrives with a customer who is already calling, and the holds and grievances behind it run on the SOP's 7 and 15 calendar day clocks.

The two side by side

Look at the last row. Both failure modes are backlogs, which is why the two get shortlisted together. The work that clears them is not the same work.

Why they get confused

Three reasons, and all of them are reasonable.

They share vocabulary. Case, alert, investigation, disposition, audit trail. A feature list from either category reads almost identically.

They often share people. In a mid-sized bank the same team touches both, so the buyer genuinely has both problems.

And they share a root cause. Both degrade when evidence gathering takes too long per case, which is why the same operational fix helps both without either product replacing the other.

The overlap that is real

There is one place they genuinely meet, and it is worth building for.

A fraud complaint and a monitoring alert on the same account are two views of one event. Most operating models keep them apart: different queue, different team, different system, and no reliable way to notice that both fired on the same customer in the same week.

The preparation layer underneath is identical. Account history, counterparty picture, transaction trail, prior alerts and prior dispositions get gathered the same way whichever team is looking.

Gathering it once and presenting it to whoever opens the case is a change worth making regardless of which product you buy.

Mule accounts are the clearest example of the overlap. By 30 June 2026 the I4C Suspect Registry had shared 32.08 lakh Layer 1 mule accounts with participating banks and institutions. The same account can be a complaint in one queue and a monitoring alert in the other.

What CaseLEA does not do

• Transaction monitoring. We do not score transactions or generate alerts.
• Sanctions and watchlist screening. Not our function, and specialist tools do it properly.
• Customer risk rating. That is a model and a policy question owned by financial crime compliance.
• Filing regulatory reports on the bank's behalf. A person files. That is the bank's signature, not ours.

Stating this plainly costs us some shortlists. It saves both sides a procurement cycle that was never going to end well.

What it does do, and the evidence

CaseLEA runs the execution layer under post-complaint work: intake across channels, evidence assembly, a prepared recommendation, a response in the required format, and a record of what was checked and what was skipped.

Production outcomes at a leading Indian payments bank, 2026. Source: caselea.com and Patched data points.

None of those numbers is an AML outcome, and we do not present them as one.

Three questions that tell you which aisle you are in

1. Who told you about the case? If your own systems did, that is AML. If a customer or an agency did, that is post-complaint.
2. What happens if you do nothing for a week? An alert ages quietly. A complaint escalates, breaches a window, and becomes a grievance.
3. What does a good outcome look like? A defensible filing decision, or a case closed with a response somebody else accepted.

If the answers split across both columns, you have two problems - and buying one product for both is how banks end up with two half-solved queues.

What happens when a bank buys the wrong one

Buying the wrong category has a recognisable shape, and it usually takes two quarters to become visible.

A bank with a post-complaint backlog buys a financial crime platform. The platform works. Alert quality improves, the investigation workspace is better than what preceded it, and the complaint queue does not move, because nobody was struggling to decide those cases. They were struggling to assemble them.

The reverse happens too. A bank with a detection gap buys an execution layer, gets faster at handling the cases it already knows about, and remains blind to the ones it does not.

Both are expensive, and both were avoidable with one question asked early: who told you about the case?

When you genuinely need both

Plenty of banks do, and the sequencing matters more than the choice.

If your alert backlog and your complaint backlog are both growing, start with whichever has an external clock on it. A complaint escalates on a schedule set by somebody else, and the holds and grievances behind it run on the SOP's 7 and 15 calendar day clocks. An alert queue ages on your own terms until it does not.

Then build the shared preparation layer underneath both, because the evidence a scam complaint needs and the evidence an alert review needs are largely the same evidence gathered twice.