Alert queues grow faster than narrative quality. Analysts under pressure write “false positive — known customer” and move on. That shorthand collapses when an independent sampler asks why a sudden spike in inbound remittances from a new corridor was closed in eleven minutes.
A durable disposition note answers four questions without fluff: what triggered the alert, what evidence was inspected, what alternative explanations were ruled out, and who approved closure above the analyst’s threshold. Screenshots help; so do timestamps that match the case management log.
During AML programme health checks we often find strong screening coverage and thin closure language. The fix is rarely a new rule set. It is a short house style, a second-line spot check each week, and permission to escalate ambiguous cases instead of clearing them to protect ageing metrics.
If your board pack celebrates “average handle time” without showing how many closures were reopened, you are measuring speed rather than judgement. Fintech audits for AML programmes look for the latter.