After the report

Filing a suspicious transaction report closes an investigation, but it does not close the risk. The customer may still be active, the same network may reach other accounts, and the report itself is a data point about how well the program works. What a firm does after filing, with the account, with feedback and with its own numbers, shows supervisors whether reporting is a living control or a box-ticking exercise.

Account decisions

A report does not oblige the firm to exit the customer, and an automatic exit after every report is poor practice: it can tip off, push activity to less vigilant firms, and lose visibility the authorities may value. The decision is a separate, risk-based judgment, recorded with the report.

Repeated reports on the same customer are a strong signal. Many firms set a policy that a second or third report triggers an exit review by a senior committee, so that a customer is not reported again and again while nothing changes. Exits themselves follow the procedures in the lesson Ongoing due diligence and exits.

A structured decision record keeps the link between report, decision and follow-up:

{
  "str_ref": "STR-2026-1172",
  "fiu_ack": "received 2026-09-22",
  "customer_id": "C-77310",
  "prior_reports": 1,
  "decision": "RESTRICT",
  "restriction": "fiat payouts suspended; crypto withdrawals to whitelisted addresses only",
  "monitoring": ["post-STR watchlist", "daily review of inbound USDT"],
  "review_due": "2026-12-22",
  "approved_by": "MLRO",
  "exit_review_trigger": "any further report"
}

The record ties the report reference and FIU acknowledgment to the account decision, the extra monitoring, a review date and the approver. The exit trigger makes the escalation rule explicit, so the next analyst does not have to rediscover it.

Continued monitoring

After a report, the customer is a known higher risk, and monitoring should reflect it:

• raise the customer risk score and shorten the periodic review cycle;
• place the account and linked accounts (shared devices, addresses, payment details) on a post-report watchlist with lower alert thresholds;
• screen counterparties identified in the report, so new customers linked to the same network are caught at onboarding;
• review the account on the set date and record whether the suspicion has grown, faded or been explained.

Where the report concerned a likely victim, for example a customer sending savings to an investment scam, continued monitoring has a protective purpose: warnings before further transfers to the same destinations, a cooling-off delay on large withdrawals, and a check that the customer has contacted the police. These steps protect the customer without revealing the report.

If suspicious activity continues, many FIUs expect a further report rather than silence. A follow-up report cites the earlier reference number, covers only the new period and says what has changed. National rules differ on whether continuing-activity reports are required and how often, so the firm's procedure states the local rule for each country.

FIU feedback and typology sharing

Recommendation 34 (Guidance and feedback) requires competent authorities, supervisors and self-regulatory bodies to establish guidelines and provide feedback that helps reporting entities, in particular in detecting and reporting suspicious transactions. Feedback comes in several forms:

The Interpretive Note to Recommendation 29 describes the FIU's strategic analysis of trends and patterns, which is the source of much typology material. International bodies add to it: FATF publishes red-flag and typology reports, and Egmont Group members share indicators with their reporting entities.

Feedback is often limited, especially case-specific feedback, because of confidentiality. Firms can still learn from indirect signals: a request for additional information, a production order citing the report, or a freeze order following it. Recording these signals against each report builds a picture of which cases authorities found useful.

Management information and board reporting

Senior management and the board need to know whether reporting works, without seeing confidential details. Reporting management information (MI) is aggregated and anonymized; names and case details stay with the compliance function.

Numbers alone do not tell the board what to do. A good quarterly report adds a short commentary: emerging typologies, notable cases in anonymized form, themes from FIU feedback, capacity against workload, and any decisions the board must take, such as accepting a backlog risk or funding more investigators.

Report volume is not a target. The Wolfsberg Group's Statement on Effective Monitoring for Suspicious Activity (Part I, July 2024; Part II, August 2025) argues that effectiveness should be judged by the quality of leads provided to law enforcement, not by how many reports are filed, and warns against defensive filing: reports made to protect the firm rather than because of reasoned suspicion. A sudden rise in volume may mean better detection, or a new scenario producing weak reports.

-- Monthly filing volume and median days from escalation to filing
SELECT EXTRACT(YEAR FROM filed_at)  AS yr,
       EXTRACT(MONTH FROM filed_at) AS mon,
       COUNT(*) AS reports,
       PERCENTILE_CONT(0.5) WITHIN GROUP (
         ORDER BY CAST(filed_at AS DATE) - CAST(escalated_at AS DATE)
       ) AS median_days_to_file
FROM str_register
WHERE filed_at IS NOT NULL
GROUP BY EXTRACT(YEAR FROM filed_at), EXTRACT(MONTH FROM filed_at)
ORDER BY yr, mon;
-- Median and date arithmetic differ by engine (MEDIAN, DATEDIFF, DATE_DIFF)

The query counts reports filed each month and the median number of days between escalation to the MLRO and filing. A median is used because a few complex cases would distort an average. Comparing the result with the firm's internal standard shows whether timeliness is slipping before an examiner finds it.

Lessons-learned loops

Each report is evidence about the program. A short post-filing review asks how the activity was detected, how long it ran before detection, and which control could have caught it earlier or prevented it. The answers feed several loops:

• Detection: new or tuned scenarios, and below-the-line testing of thresholds that missed the case (see the lesson Tuning, metrics and model governance);
• Onboarding and risk scoring: new risk factors, such as a device pattern or a counterparty type;
• Risk assessment: updated typology exposure in the enterprise-wide risk assessment;
• Training: anonymized cases used in role-specific training;
• Typology library: a maintained internal set of patterns, each with examples, indicators and the scenarios that cover it.

Closing the loop means each change is tracked to completion and its effect measured, for example whether a new scenario produces reports that authorities follow up. Independent testing then checks that the whole cycle, from report to account decision to program change, works as described.

Exam focus: a report does not require an exit, and the options of continuing, restricting, exiting or keeping open at an authority's request; repeated reports as an exit-review trigger; post-report monitoring and follow-up reports that cite earlier references; R.34 feedback and its forms, and indirect signals of usefulness; aggregated, confidential MI and the key metrics (conversion, timeliness, backlog, quality, follow-ups); why volume is not a target and the risk of defensive filing; feeding lessons into detection, onboarding, risk assessment, training and a typology library.