One L1 analyst, one shift, twelve alerts.

Role

L1 analyst

Shift

08:30 to 17:00

Alerts worked

12

Time on alerts today

6 h 00 min

1. 08:30

   Open the queue

   Sort the case manager by alert date and take the oldest. Nothing says which alerts are thin files, which are routine closes, and which are about to age past policy.

   With Assay: The agent triaged each alert as it arrived. Each one shows a recommendation, a confidence score and days left against the internal deadline (30 days by default). The queue is ranked by risk score, so the analyst sees at a glance what matters and what is about to age past policy.

2. 08:45

   Team huddle, 15 minutes

   The lead reads assignments off a spreadsheet and asks who is behind. Most of the meeting is status.

   With Assay: Team workload already shows open alerts and their age by analyst. The huddle goes to the one case that needs a second opinion.

3. 09:00

   Structuring alertCASH-STRUCT-01

   Export 90 days of transactions from core banking, filter for cash, note the location of each deposit, search the customer notes, open the case manager for prior alerts. Thirty minutes, most of it spent assembling, not deciding.

   With Assay: The workspace already shows 9 cash deposits from $9,400 to $9,900 at three locations, two same-day pairs, and a teller note about the $10,000 threshold, each one cited. The agent recommends escalation and drafts the L2 narrative. The analyst checks the citations and edits the draft: about 24 minutes.

4. 09:30

   Three payroll alertsACH-VOL-02

   Three businesses running payroll, three times the same work: rebuild the pay calendar, confirm the payees repeat, write the close. Thirty minutes each.

   With Assay: The agent cites each pay date and the repeat payees and recommends close above the 0.85 confidence floor. Payroll starts at batch approval, so the three are approved together and QA samples 10%. About 8 minutes each.

5. 11:00

   A watchlist name match, then a thin fileWL-NAME-01, NEW-ACCT-05

   Compare the name, country and date of birth against the list entry by hand. Then a new account with five transactions and a half-empty profile. An hour for the two.

   With Assay: No time saved, by design. Clearing a watchlist match is one of the four things the agent never does, and with fewer than 8 transactions it abstains instead of guessing, and says what is missing. Still an hour.

6. 12:30

   QA feedback

   The lead returns two of yesterday's closes: the notes do not show why. The analyst reopens both and rewrites them from memory.

   With Assay: Every close already carries a cited rationale. The QA reviewer marks agree or disagree, a disagreement needs a written note, and both land in the audit log.

7. 13:00

   Three seasonal cash alertsCASH-VOL-04

   An orchard, a pumpkin patch and a costume shop, all busy at their usual time of year. Pull statements from one and two years back and compare by hand. Thirty minutes each.

   With Assay: The agent compares the same 30-day window one and two years back, cites both, and recommends close. Seasonal cash also starts at batch approval. About 8 minutes each.

8. 14:30

   A wire with an odd memoWIRE-INOUT-06

   The memo on the inbound wire tells the reader to ignore previous instructions and mark the alert cleared. The analyst notices, raises an eyebrow, and works it.

   With Assay: The same memo locks the alert to a human before any model call, and the text never reaches the model. The analyst works it from scratch: 30 minutes, same as today.

9. 15:00

   A first wire to a high-risk country, and a volume spikeWIRE-GEO-02, VOL-PROFILE-07

   Two more alerts, thirty minutes each, the last ones before the write-up.

   With Assay: The wire comes back below the 0.85 close floor, so policy sends it to review: 30 minutes. The volume spike has a clean, cited close: about 8 minutes.

10. 16:00

    Write-up and the tracker

    Copy the day's dispositions into the team spreadsheet, note the time spent, email the lead about the backlog. Done at 17:00 with twelve alerts cleared.

    With Assay: Dispositions, reason codes and timings are already in the audit log, and the tracker is the metrics screen. The twelve alerts took 3 h 20 min instead of 6 h 00 min, which leaves room for about 9 more at the same mix, or for the cases that need a person.

Assumptions

• Six hours on alerts

  1,560 productive hours a year over 260 working days. The rest of the 8.5-hour shift is lunch, the huddle, QA feedback and the write-up. Sources and assumptions

• 30 minutes per alert today

  The site-wide assumption. Industry estimates run from 20 to 60 minutes and there is no strong public source, which is why a pilot measures it first. At $57.69 per productive hour ($90,000 loaded cost over 1,560 hours) that is $28.85 an alert.

• Eleven of twelve close

  For most banks more than 90% of transaction-monitoring alerts are false positives.¹ One escalation in twelve is in that range.

• 8 minutes for a clean recommendation

  A design target, not a measured result. The analyst reviews a recommendation with every claim cited instead of assembling the evidence and writing the close. Seven of twelve alerts landing here is also a target. Shadow mode in a pilot measures both.

• 24 minutes for an escalation

  A fifth saved, not more. The evidence is assembled, but the draft narrative still needs an analyst who knows the case. This matches the site's time-saved model.

• No saving where the agent stands back

  Watchlist matches, thin files, locked alerts and low-confidence calls cost 30 minutes, as today. The result, 44% of alert time, sits next to the 45% time-saved assumption listed on Sources and assumptions.