Case management

Filing

Same customer, same file.

If every flagged decision were its own task, one customer's ten transactions would become ten separate investigations. Krino groups decisions on a shared axis — usually the customer number, but any field you nominate.

If a file is open

The new decision joins it. The analyst keeps the context and no new row appears in the queue.

If not, one opens

The first flagged decision starts the file; the rest accumulate on top of it.

Closed stays closed

A closed case is not reopened — a concluded investigation does not blur into the past.

The queue

Who looks at what?

Load-balanced assignment

A new case goes to whoever has the fewest open items in that queue. Manual distribution, the race to grab work first, and files that sit because the queue is long all disappear.

Snooze, but don't forget

Some cases cannot be concluded today — a document is expected from the customer. You snooze the case to a date and it leaves the queue; when the day comes it returns on its own. There is no such thing as a forgotten file.

Ordered workflow rules

Which decision goes to which queue, at what priority and to which team is set by ordered rules. High-value transactions to the senior team, sanctions matches to compliance — your arrangement, not a fixed mapping.

Status and audit trail

A case's status, who changed it and when, and what was added are all on record. The answer to "what happened to this file" is always inside the file.

Case queue with status, outcome, date and assigned analyst — **Case queue** · status, outcome and assignment at a glance

Investigation

Everything the analyst needs, on one screen.

The decision's reasoning

Which rules fired, what they scored, where the total sat against the threshold — and the field values at the moment of the decision. No second system to open.

Customer notes

Notes attach to the customer, not only to the case. When the same person returns six months later, last time's assessment comes with them.

Entity annotations

A tag or note attached to a device, IP or card surfaces in the investigation every time that entity appears. The team's knowledge stays in the system, not in people's heads.

Regulator

The suspicious activity report is part of the file.

When a case reaches the point of being reported, that fact lives in the file itself: the reporting status, when and by whom it was filed, the reference number. When the audit comes, "which cases did you report" is not a question you answer from a spreadsheet.

Detection is half the work. Investigation is the other half.