Case File & Evidence Lifecycle

The case file is the durable output of an AML/KYC/KYB operation. It should allow a reviewer to reconstruct what was checked, what evidence was collected, what remained uncertain and why the case was routed for review or escalation.

Lifecycle overview#

intake
→ declared-data inventory
→ source plan
→ source checks
→ evidence capture
→ discrepancy register
→ risk trigger summary
→ review reports
→ gate event log
→ handover note

Local runner case folder#

00_case_metadata/
01_declared_data/
02_verification_plan/
03_source_checks/
04_evidence/
05_discrepancies_and_risk/
06_reports/
07_audit_trail/
08_handover/

This folder structure is a neutral example. A real implementation can map it into an internal case management system, document repository or evidence vault.

Evidence capture principles#

Evidence should be captured when a material source check is performed, not after the summary is written.

Each evidence item should include:

  • evidence reference;
  • source name or category;
  • date and time captured;
  • query or identifier used;
  • file path, URL or internal reference;
  • capture method;
  • confidence or quality label;
  • limitation note.

Source check records#

A source check record should explain:

  • what source was checked;
  • why the source was relevant;
  • what exact query or identifier was used;
  • what result status was observed;
  • which evidence item supports the result;
  • what limitation affects interpretation;
  • what next action is required.

Discrepancies#

A discrepancy is not automatically a risk conclusion. It is a fact conflict or uncertainty that must be classified and handled.

Examples:

  • declared name differs from registry name;
  • address differs across sources;
  • ownership percentages do not reconcile;
  • source unavailable or not checked;
  • possible sanctions / PEP / adverse-media match requires manual review;
  • website or domain exposure conflicts with declared business activity.

Reports#

A review-ready case file may include:

  • operation review summary;
  • stagegate status;
  • gate event log;
  • source checks report;
  • evidence index;
  • discrepancy register;
  • risk trigger summary;
  • handover note.

Reports should support review. They should not create a final approval or rejection unless that decision is made by an authorized analyst reviewer outside the reviewer-generated output.

Retention and audit#

Retention periods, evidence vault rules, access controls and domestic recordkeeping obligations are implementation-specific. The public framework defines the structure and discipline; each institution must define retention and access rules under applicable law and policy.

Value Trail vs Money Trail#

AML review should not focus only on visible bank payments. A money trail follows funds through accounts and payment rails. A value trail follows how economic value moves, changes form or becomes legitimised through goods, services, assets, invoices, ownership structures, wallets, loans or professional intermediaries.

This matters because some cases are not explained by a payment alone. The reviewer may need to understand:

  • what value moved;
  • who owned or controlled it;
  • what document claims to explain it;
  • whether the commercial story is plausible;
  • whether goods, services, invoices, assets and payments align;
  • whether the value trail creates unresolved risk even when the payment trail looks ordinary.

Asset tracing and recovery handoff#

Where a case may support freezing, confiscation or asset recovery, preserve an additional handoff layer:

  • asset identifiers and ownership/control links;
  • chronology of transfers and changes in title;
  • source provenance and access dates;
  • jurisdiction and custodian information;
  • legal restrictions on disclosure or preservation;
  • unresolved gaps requiring FIU, legal or law-enforcement action.

SRC-UNODC-UNCAC-AR-001 and SRC-STAR-ASSET-001 provide the institutional asset-recovery context. They do not authorise the analyst to freeze, seize or disclose assets without the applicable legal process.