FIU (Financial Intelligence Unit)

When to Use

• Run FIU operations: alert queues, case assignment, triage, and investigation lifecycle
• Perform financial analysis on suspicious activity—flows, networks, counterparties, products, corridors
• Document case files with facts, chronology, hypotheses tested, and disposition rationale
• Prepare MLRO escalation packs—fact summaries, open questions, recommendation options (not filing decisions)
• Apply typology-driven analysis (structuring, layering, mule, trade-based ML, VASP/crypto patterns)
• Coordinate with transaction monitoring, second-line compliance, and investigations (fraud, security)
• Support internal FIU reporting—backlog, SLA, quality metrics, management information (not regulator filing advice)
• Run quality assurance, peer review, and case reconstruction for audits or lessons learned
• Design handover, training, and playbook updates from closed cases and tuning feedback
• Integrate adverse media context at a high level (route deep NLP/sentiment pipelines elsewhere)

When NOT to Use

• Design or mature the full AML/CFT program, policies, KYC tiers, or enterprise risk assessment → aml-compliance
• CFT/PF-only typologies, TFS/asset-freeze programs, or NPO sector controls without general FIU case work → aml-cft
• Draft or finalize STR/SAR narratives for filing templates as the primary deliverable → str-report
• Execute internal/IT audit workpapers, SOC 2 testing, or control effectiveness sampling → auditor
• Implement technical controls, evidence automation, or screening/TM engineering → compliance-engineer
• Legal advice, filing duty, regulatory interpretation, or entity structuring → commercial-counsel
• Per-text sentiment labeling or aggregate sentiment forecasting → sentiment-analysis-engineer, sentiment-forecasting-engineer
• Law enforcement blockchain forensics as primary output → blockint / on-chain-investigator-agent skills

Related skills

Core Workflows

1. Intake and triage

1. Classify source (TM alert, referral, law-enforcement request, ad hoc)
2. Assign priority using risk, amount, SLA, and repeat-subject rules
3. Confirm minimum data before investigation (KYC, alert details, lookback window)
4. Route duplicates, false-positive candidates, and out-of-scope items with coded dispositions

See references/caseintakeand_triage.md.

2. Financial analysis and typologies

1. Reconstruct flows (accounts, instruments, corridors, counterparties)
2. Map networks and related parties; separate verified facts from inference
3. Test typology hypotheses against observable indicators; document innocent explanations considered
4. Request blockchain or external intelligence with confidence labels when needed

See references/financialanalysisand_typologies.md.

3. Documentation, QA, and escalation

1. Maintain case chronology, exhibit index, and decision log
2. Run peer review or QA sampling before MLRO handoff
3. Package MLRO escalation: summary facts, suspicion elements, gaps, and options—not legal conclusions
4. Hand off to str-report when narrative drafting for filing is the next step

See references/escalationandmlrohandoff.md and references/qualityassuranceanddocumentation.md.

4. Reporting, coordination, and metrics

1. Produce internal MI (volumes, aging, typologies, outcomes)—not filing advice
2. Coordinate with TM on tuning feedback and scenario performance
3. Track backlog, SLA, rework, and quality defect rates
4. Capture training topics and playbook updates from closed cases

See references/reportingcoordinationand_metrics.md.

When to load references

Operating principles

• Facts first — chronology and amounts before suspicion narrative
• Typology-led, evidence-bound — hypotheses tied to observable indicators
• Segregation of duties — investigators vs QA vs MLRO; log overrides
• Need-to-know — restrict sensitive case materials; access audited
• No legal filing advice — internal packs and MI only; MLRO/counsel decide filings
• Close the loop — feed TM tuning and training from dispositions and QA findings