Overview#
In financial crime work, the most dangerous criminal networks rarely announce themselves in a single case. A structuring investigation in Dublin, a trade-based money laundering referral in Cork, and a KYC alert in Belfast might each look routine in isolation. Link them through shared entities and overlapping transaction patterns, and the picture changes entirely. The Case Linking module makes those connections visible, connecting investigations that share subjects, funds, methods, or timing into a coherent operational picture.
Built for compliance teams, fraud investigation units, and financial intelligence analysts, the module applies ML-based comparison algorithms to surface case relationships automatically, while also giving analysts full control to document and manage complex investigation hierarchies by hand.
Key Features#
- Automated Case Relationship Discovery: ML algorithms compare investigation attributes, entity overlaps, transaction patterns, and temporal proximity to automatically suggest case links with high accuracy.
- Case Family Tree Visualisation: Interactive hierarchical views display parent-child and sibling case relationships, enabling investigators to understand complex investigation structures at a glance.
- Relationship Strength Scoring: Quantified confidence scores for each case connection help analysts prioritize high-value linkages while filtering low-confidence suggestions.
- Case Merging and Splitting: Strategic consolidation of related cases into unified investigations, or separation of complex cases into focused sub-investigations, with full audit trail preservation throughout.
- Cross-Case Pattern Detection: Identifies entities and transaction patterns appearing across multiple investigations, revealing organised networks and repeat offenders.
- Bidirectional Case Linking: Supports parent-child, sibling, related, and superseded relationship types with configurable link metadata and annotations.
- Case Hierarchy Management: Manages multi-level investigation hierarchies with inheritance of evidence, entities, and metadata across linked cases.
- Duplicate Case Prevention: Real-time duplicate detection during case creation prevents redundant investigations and ensures efficient resource allocation.
- Link Impact Analysis: Assesses the investigative value of proposed case links before creation, helping teams focus on connections that advance case objectives.
Use Cases#
- Criminal Network Mapping: Case linking reveals previously hidden organisational structures by connecting seemingly unrelated investigations through shared entities, transaction patterns, and behavioural indicators.
- SAR Filing Consolidation: Related suspicious activity reports are linked and consolidated to give regulators comprehensive views of coordinated suspicious behaviour across multiple accounts or entities.
- Multi-Jurisdictional Coordination: Cross-border investigations are linked to enable coordinated response across jurisdictions while maintaining separate case management for local regulatory requirements.
- Serial Fraud Detection: Pattern-based case linking identifies serial offenders operating across multiple cases, enabling investigators to build comprehensive profiles of repeat criminal activity.
- Resource Optimisation: Duplicate detection and case consolidation prevent multiple teams from investigating the same activity, freeing analyst capacity for new cases.
- Historical Case Intelligence: New investigations are automatically linked to relevant historical cases, giving investigators immediate context from prior related work.
Integration#
The Case Linking module integrates with the investigation platform's case management, entity resolution, and evidence management systems. Linked cases share relevant entities, evidence, and timeline data while maintaining independent workflow states. The module supports automated linking triggers from transaction monitoring alerts and entity resolution matches, with results feeding into investigation dashboards and reporting tools.
Open Standards#
- OASIS STIX 2.1: Linked and merged cases can be exported as STIX 2.1 bundles, with Relationship and Report SDOs used to represent cross-case entity connections and investigation hierarchies.
- OASIS TAXII 2.1: Case intelligence bundles are published to and consumed from TAXII 2.1 collections, enabling sharing of linked-case findings with external threat-intelligence platforms.
- RFC 3161 (Internet X.509 PKI Time-Stamp Protocol): RFC 3161 timestamp tokens are embedded in case exports to provide cryptographic proof of document existence at a specific time, preserving the audit trail across linked investigations.
- EDRM (Electronic Discovery Reference Model v1.2): Case exports support EDRM 1.2 XML format, ensuring linked-case packages are compatible with legal e-discovery workflows and external counsel systems.
- ISO 19005 / PDF/A-3 (ISO 32000): Case dossiers and linked-case exports are produced in PDF/A-3 archival format, guaranteeing long-term accessibility and self-contained attachment of supporting evidence.
- GraphQL (June 2018 specification): All case relationship queries, link creation mutations, and hierarchy traversal operations are exposed through a GraphQL API, enabling flexible, typed querying of investigation networks.
- ISO 8601: All timestamps associated with case links, audit events, and relationship metadata are serialised in ISO 8601 format, ensuring consistent chronological ordering across multi-jurisdictional investigations.
Last Reviewed: 2026-02-05 Last Updated: 2026-04-14