negative-news-triage
Negative news triage
A negative-news triage memo is what second-line produces so a CDD reviewer, an EDD analyst, a SAR investigator, or a sanctions-QA reviewer can see which adverse-media hits on a customer are actually about that customer, which carry weight, which point to a financial-crime typology, and which route to which downstream artifact. The work is judgement-led: most bulk re-scan output is common-name noise; a small subset is material; a smaller subset changes downstream posture. The skill stops at the routing recommendation. The reviewer does not change the customer's risk rating, file a SAR, escalate to EDD as a closed decision, or exit the relationship.
The artifact is a Word memo and a structured triage record that the named downstream skills consume. Onboarding, periodic-refresh, event-driven, and bulk-rescan triage use the same workflow with different evidence-asks and different volume profiles.
Ask first
Before drafting, get plain answers to a few things. Most triage runs answer them quickly; if not, default and flag.
- What kind of triage is this and what is the volume. Onboarding triage is one customer with a small named hit set; periodic refresh is one customer with the cycle-bounded re-scan output; event-driven is one or two hits surfaced by a named trigger; bulk re-scan is many customers with vendor output dominated by common-name matches. Volume drives whether the memo carries per-hit detail across the whole set or rolls up the noise and details only the material subset.
- What identity evidence is on file for the subject. Identity confidence is the first cut against false matches. The CDD record's name variants, date of birth or formation, jurisdiction, occupation or business activity, beneficial-ownership chain, and known counterparties are the matchable attributes. Without them, identity confidence stays low and the memo carries that as a finding rather than asserting confidence the file does not support.
- Who reads the memo and what decision are they about to make. A CDD reviewer reads to decide whether to refresh the file or the rating. An EDD analyst reads to decide whether to open or update an EDD pack. A SAR investigator reads as an evidence input on an in-flight or recent alert. A sanctions QA reviewer reads when the hit overlaps a screening alert. Audience and pending decision drive depth and tone.
- What is the date of the underlying events versus the date of publication. Adverse media is perishable on both axes: an old event re-published yesterday is still an old event, and a recent publication of a recent event sits differently in the materiality read than a vintage finding. The memo separates
event_datefrompublication_daterather than collapsing them into one timestamp.
When the scope record is supplied, the skill consumes it for institution type, primary regulator, sector overlay, persona, and source posture. Otherwise it asks the practitioner the few facts it needs, and source posture sets what the memo can assert at high confidence and what carries [evidence needed].