Lab C1

The AML Escalation Desk

~5h · groups · today's capstone

Eighteen flagged alerts. One Monday-morning deadline. Build the process, not just the notes.

C1 Sunday night — drafting Monday's escalation note

The AML Escalation Desk

You're covering the AML desk this week. It's Sunday night. Eighteen alerts have piled up since Thursday, and every one of them needs a triage decision plus a drafted escalation note before the committee meets Monday morning.

You're covering the AML desk this week. It's Sunday night, and eighteen flagged-transaction alerts have piled up since Thursday — some are routine, some genuinely need to escalate, and right now they're just a flat list with no order to them.

Reading all eighteen line by line and drafting each note from scratch would take most of tonight. That's not the job you're being asked to do — the job is building a process that gets you through all eighteen, correctly, in a fraction of that time, with a human still making every call that matters.

Your group's deliverable today is that process: a triage of the alert types you're seeing, a safety pass on what belongs in a prompt and what doesn't, a small library of reusable prompts, an agent that can draft first-pass escalation notes across the batch, and a validation step that catches the one alert where the numbers don't actually agree with each other before it reaches committee.

By the end of the day your group presents the whole desk — process, agent, and the one thing your validation step caught — to the room.

Team name ⬇ Download dataset — 18 fictional flagged-transaction alerts (aml-escalation.csv)

Time budget (guide, not a clock): Triage 25m · Safety pass 20m · Prompt library 30m · Agent design 30m · Wave 2 (lunch) 40m · Validation log 40m · Agent Card 20m · Present 45m — roughly 4.2h of real work, including the Wave 2 curveball that lands at lunch. The model answers in seconds — almost none of this time is spent waiting on AI. It's spent deciding, checking, and building.

👥 How to split this: Work this as a full group. The judgment calls are the point — don't split it up and merge answers, argue them out together.

Triage this scenario's work

For each task below, pick the task shape and the risk level, then write the reusable reason — the part your future self (or a teammate covering this desk) actually re-reads.

Task	Shape	Risk	Why (one line)
Read all 18 alerts and group them by flag reason (structuring, rapid movement, PEP-linked, geographic mismatch, etc.) This is extract — pulling a category out of unstructured notes.
Decide which alerts need escalation to the AML committee vs. which can close as reviewed-no-action This is reason — a judgment call, not a lookup.
Draft the actual escalation note text for each alert that escalates Draft — but only after the reason-call above is made by a human.
Summarise the batch into a one-paragraph desk handover for your manager Summarize — condensing 18 rows into the three things that matter.
Pull prior_alerts_count and flag_reason into a simple repeat-offender list Extract — structured field, no judgment needed.
Decide whether an alert with 5+ prior alerts but no single large transaction is still low-risk Reason — frequency vs. size is a genuine judgment tension.
Rewrite one escalation note in a tone appropriate for an external regulator report Draft — same facts, different audience.
Extract the counterparty countries across all 18 alerts into a simple country-exposure count Extract — a rollup, not a judgment.
Decide which alert, if any, needs same-night escalation rather than waiting for Monday Reason — the highest-stakes call in the whole batch.
Draft a two-line summary of the batch for the committee agenda Summarize — the shortest possible version, for people who will not read the full 18.