Source of funds investigation: documenting where the money comes from
Source of funds investigation aims to determine where the money used in a transaction comes from and whether it aligns with the customer's known profile. TruvaLI consolidates declarations, documents, and transaction behavior within the same case.
A source of funds investigation examines the origin of the money used in a specific transaction. Source of wealth, on the other hand, looks at where a person's total assets originate. The two are often confused but are distinct: a customer may be able to explain their wealth and yet fail to explain the source of funds for a single transaction.
When is an investigation triggered?
| Trigger | Reason |
|---|---|
| Amount inconsistent with profile | Transaction disproportionate to declared income and activity |
| Sudden change in behavior | High activity suddenly appearing in a long-term low-volume account |
| High-risk counterparty or country | The routing of the funds itself raises questions |
| PEP relationship | Mandatory enhanced due diligence for politically exposed persons and their close associates |
| Adverse media finding | News of crime or investigation related to the individual |
Most triggers originate from monitoring; how a transaction is positioned relative to the customer's own history is explained on the ongoing monitoring page.
What is being analyzed?
The investigation evaluates three pillars together. The declaration is what the customer states. The document is the supporting evidence: a sales contract, payslip, inheritance certificate, partnership dividend resolution, or loan agreement. Transaction behavior is where the declaration is tested against reality.
The text of uploaded documents is read, converting the parties, amounts, and dates within them into structured data. This ensures the document is not just a file attached to a case, but becomes fully comparable with the declaration.
The path the funds travel is also part of the investigation: sending parties, intermediary accounts, and associated individuals. Connections established through a shared device, IP, or address can reveal a structure that remains invisible when viewed individually.
Source of funds in crypto assets
When crypto assets are involved, the inquiry shifts to the wallet: the history of the address where the funds originate, its contact with mixing services, and its proximity to sanctioned addresses. This aspect is explained on the crypto wallet screening page.
How is the outcome recorded?
The investigation is conducted within a case. The declaration, documents, screening results, transaction history, and the investigator's assessment all reside in the same place. The outcome leads to one of three paths: the explanation is deemed sufficient and the case is closed, additional documentation is requested and the case is deferred, or the explanation remains insufficient and proceeds to a report.
Why a conclusion was reached is recorded just as clearly as what that conclusion is. The question asked during an audit is usually "why did you close this" and the answer must reside within the case. The case workflow is detailed on the alert and case management page, and reporting is covered on the regulatory reporting page.
Segregation of duties applies here as well: the person investigating and the person making the closure decision do not have to be the same individual. Details can be found on the maker-checker, authorization, and audit trail page.
Common questions
- Are source of funds and source of wealth the same thing?
- No. Source of funds asks about the origin of the money in a specific transaction, while source of wealth asks where a person's total assets come from. A customer may be able to explain their wealth but fail to explain the funds in a single transaction.
- What triggers an investigation?
- An amount disproportionate to the declared profile, a sudden change in behavior, a high-risk counterparty or country, a PEP relationship, and adverse media findings.
- Which documents are accepted?
- Evidence supporting the declaration: such as a sales contract, payslip, inheritance certificate, dividend resolution, or loan agreement. The text of the document is read, converting the parties, amounts, and dates within it into structured data.
- Is a document sufficient on its own?
- No. The declaration, document, and transaction behavior are evaluated together; the document supports the declaration, while the transaction behavior tests it.
- Is the path of the funds investigated?
- Yes. Sending parties, intermediary accounts, and associated individuals are examined; connections established through a shared device, IP, or address can reveal structures that are invisible when viewed individually.
- How is the source of funds queried in crypto assets?
- The inquiry shifts to the wallet: the history of the address where the funds originate, its contact with mixing services, and its proximity to sanctioned addresses are analyzed.
- How does an investigation conclude?
- The explanation is deemed sufficient and the case is closed, additional documentation is requested and the case is deferred, or the explanation remains insufficient and proceeds to a report.
- How is a closure decision defended during an audit?
- The declaration, documents, screening results, transaction history, and the investigator's justification all reside within the same case. The question asked during an audit is usually why it was closed, and the answer is right inside the case.