---
title: "Manual 05: Forensic Investigations, Case Management & Statutory Reporting — Financial Integrity"
description: "Technical implementation manual for Forensic Investigations, Case Management & Statutory Reporting in the Financial Integrity Canon."
image: "https://tinycto.tv/assets/financial-integrity/financial_integrity_og.jpg"
canonicalUrl: "https://tinycto.tv/financial-integrity/manuals/05-investigations-str-sar"
locale: "en"
---

# Chapter 5: Forensic Investigations, Case Management & Statutory Reporting

## 5.1 The 360-Degree Forensic Investigation Dossier
When an alert escalates from automated monitoring, compliance analysts must conduct an objective, holistic investigation. Evaluating a single suspicious payment in isolation is ineffective; investigators must assemble a complete 360-degree timeline of the customer relationship.

### Core Dossier Components
- Complete KYC/CDD baseline documentation and initial risk ratings.
- Historical transaction volume graphs spanning 12-24 months.
- Counterparty network link graphs showing direct and indirect linkages.
- Historical fraud tickets, chargebacks, and prior alert dispositions.
- External adverse media findings, litigation dockets, and corporate registry filings.

## 5.2 Objective STR/SAR Narrative Drafting
A Suspicious Transaction Report (STR) or Suspicious Activity Report (SAR) is an official intelligence document submitted to law enforcement. It must be written objectively, chronologically, and without emotional or accusatory language.

### The 5W+H Narrative Standard
- **Who:** Complete legal identification of all involved individuals, entities, and beneficial owners.
- **What:** Specific financial instruments, currencies, and account numbers utilized in the suspicious flow.
- **When:** Exact timestamps, duration, and cadence of the observed activity.
- **Where:** Geographic branches, IP addresses, ATM locations, and recipient jurisdictions.
- **Why:** Objective explanation of why the activity lacks apparent economic rationale or deviates from the customer's known business profile.
- **How:** The specific operational mechanics (e.g. layering via shell companies, cash structuring, synthetic invoices).

## 5.3 Air-Gapped Anti-Tipping-Off Safeguards
Under FATF Recommendation 21 and national statutes (e.g. MASAK Kanunu Madde 4, UK POCA Section 333A), disclosing that an STR/SAR has been submitted, or that an investigation is underway, is a criminal offense punishable by imprisonment and heavy regulatory fines.

### Architecture Vault Invariants
- All STR/SAR dossiers and MLRO review notes must be stored in an air-gapped, zero-knowledge encrypted database vault.
- Core banking CRM, call center portals, and branch teller terminals must be cryptographically prevented from accessing compliance case files.
- Front-line staff viewing an account under active investigation see only standard operational statuses with zero compliance indicators.