Skip to main content
Transaction Monitoring has four separate status machines: the transaction, each alert, each case, and (where applicable) the travel-rule check. This page is the reference.

​
Transaction status

Set on creation and updated through the lifecycle.
StatusMeaning
APPROVEDTransaction passed all rules below the review threshold.
IN_REVIEWScore crossed the review threshold, or a rule explicitly required review. Analyst attention needed.
DECLINEDScore crossed the decline threshold, or a rule explicitly declined. Transaction rejected.
AWAITING_USERA rule action required additional user verification. A remediation session has been created.

​
Transitions

Note: there is no direct transition from APPROVED or DECLINED back to other states. Use status patches via the console for corrections; those are logged to the audit trail.

​
Alert status

See Alerts for full detail.
StatusMeaning
OPENJust generated; unassigned.
INVESTIGATINGAnalyst is actively working it.
AWAITING_USERPending user action (remediation).
PENDING_SARSAR filing in progress.
SAR_FILEDSAR filed with regulator; case closed.
RESOLVEDClosed with an action taken.
DISMISSEDClosed as false positive.

​
Case status

See Cases for full detail.
StatusMeaning
OPENCase created, not yet worked.
UNDER_REVIEWAnalyst actively investigating.
AWAITING_USERWaiting on user-side input.
ON_HOLDPaused pending external event.
RESOLVEDClosed.
Cases carry a separate priority (LOW, NORMAL, URGENT) and severity (UNKNOWN, LOW, MEDIUM, HIGH, CRITICAL).

​
Travel-rule check status

For virtual-asset transfers under the FATF Travel Rule:
StatusMeaning
UNKNOWNNot yet evaluated.
COMPLIANTOriginator and beneficiary data exchanged successfully.
PENDING_ACTIONWaiting on our side to send data.
PENDING_COUNTERPARTYWaiting on the other VASP to respond.
FAILEDData exchange failed (e.g. counterparty VASP unreachable, bad payload).
EXEMPTBelow regulatory thresholds or out of scope.
See Travel Rule.

​
Provider result status

Every external provider result (wallet screening, fiat monitoring, sanctions screening) is stored with its own status. Surfaced under provider_results[] in the transaction response.
StatusMeaning
PENDINGProvider query in flight.
COMPLETEDResult returned successfully.
FAILEDProvider errored or timed out.
SKIPPEDProvider deliberately skipped (e.g. transaction below threshold).

​
Rule-run outcomes

Every TransactionRuleRun has:
  • matched (boolean) — did the rule fire?
  • is_test (boolean) — was the rule in TEST mode?
  • mode — ACTIVE, DISABLED, TEST at evaluation time.
  • score_delta — contribution to the score (if matched and active).
  • status_target — the status the rule asked for (if change_status action).
See Rules for the rule anatomy.

​
Decision reason codes

Common reason values on status transitions:
ReasonMeaning
rule_score_thresholdScore crossed review/decline threshold.
rule_change_statusA rule’s change_status action forced a status.
analyst_approved / analyst_declined / analyst_clearedManual analyst action.
remediation_completed / remediation_failedOutcome of a linked remediation session.
provider_updateExternal provider updated the result.
aml_confirmed_sanctionAML screen confirmed a sanctions match.
blocklist_applicant / blocklist_counterpartyBlocklist enforcement on a party.

​
Next steps

Risk scoring

How scores map to statuses.

Alerts

Alert lifecycle.

Cases

Case lifecycle.