CC-101 · Lesson 6 · Escalate, do not decide

Notice and escalate. Do not decide.

The single most useful instruction in AML/CTF training is also the one that takes the most weight off the person receiving it.

23 September 2026 · Amanda Dunn · 4 min read

People come out of AML/CTF training worried they will have to make a call they are not qualified to make. Is this suspicious? Is it suspicious enough? What if I am wrong?

You are not being asked to answer any of that. That is the point of the instruction.

The split

Your job is to notice and to pass it on. Somebody else’s job is to assess it and decide what happens next. That person is your compliance officer, and it is deliberately not you.

It is not your job to decide whether something is suspicious enough to report. It is your job to notice and escalate.

This is not a chain of command for its own sake. The compliance officer sees every flag across the business, not just the one in front of you. They know what has come up before, what your business’s risk assessment says, and what has already been reported. You are looking at one file; they are looking at the pattern.

Why it protects you

Once you have escalated properly, you have done the thing that was asked of you. If the compliance officer assesses it and concludes it is nothing, that is a documented decision made by the person whose role it is.

The exposure runs the other way. Deciding privately that something was probably fine, and not raising it, leaves you carrying a judgement you were never meant to make.

What escalating actually looks like

Write down what you observed — facts, dates, what was said. Not your conclusion.
Raise it through your business’s own process, on the customer record, so it is attached to the file.
Carry on with the interaction professionally and normally.
Say nothing to the customer about having raised it.

Then it is out of your hands, which is the intended outcome.

The failure worth guarding against

Not over-reporting. Silence. A staff member who notices something, hesitates, tells themselves it is probably nothing and that raising it would look foolish — and the observation is gone.

The businesses that handle this well make escalation completely unremarkable. No eyebrow raised, no implication anyone has accused a customer of anything. Just a thing you do, like noting a maintenance issue.

What your compliance officer actually needs from you →The difference between a useful escalation and one nobody can act on.

Where Curlew fits

Escalation only works if it is easier than not bothering. In Curlew you flag unusual activity on the customer record itself and the enhanced due diligence workflow follows from there — no separate form to find, no wondering who to email.

The compliance officer sees flagged matters in one place, and the audit trail records that it was raised, when, and by whom. Which is also the evidence that your escalation process is a real thing rather than a paragraph in a policy.