Description

A focused course, tailored for you

The Retail Bank Loss Prevention Casework Playbook

From branch-incident report to closed loss event with a defensible audit trail, written for AVPs running fraud and physical-loss casework inside a large retail bank.

Branch incident reports stack up faster than the casework that closes them, and a file that gets bounced by second-line review costs an extra week per case.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

A Risk & Loss Prevention AVP at a large retail bank runs a queue that mixes teller cash variance, card-present fraud clusters, ATM skim hits, robbery and burglary reports, ACH return spikes, internal-employee anomalies, and the regional manager asking why the Q close looks soft. The work is not the detection. The work is assembling a case file that a second-line reviewer signs off the first time, that survives audit and examiner sampling, and that produces a loss-memo and SAR narrative that hold up against the bank's policy and the regulator's expectations. Every bounced file is a week lost. Every missed escalation threshold is a finding waiting to happen. The skill that separates an AVP who closes 40 cases a month cleanly from one who closes 25 with rework is the ability to standardise the casework artefacts and the decision rules around them.

What you walk away with

A standardised intake-to-close case file template that second-line review signs the first time.
Loss-memo and SAR narrative patterns aligned to FinCEN, FDIC, and OCC examiner expectations.
A camera-and-transaction evidence chain that holds up in a recovery action and an internal-fraud termination.
Decision rules for when a branch-level variance escalates to corporate investigations.
A monthly reporting pack the regional risk committee uses without rework.

The 12 modules

Module 1. Intake triage: what makes a branch incident a case

The first hour of any branch incident report decides whether the file closes in a day or runs three weeks. This module walks the AVP through the intake checklist that separates a teller training issue from a casework event, the dollar and pattern thresholds that pull a file into the corporate investigations queue, and the early-evidence preservation steps that a defence attorney will ask about a year later.

Module 2. Teller cash-drawer variance casework

Drawer variance is the highest-volume case type and the easiest to mis-handle. The module covers the cash-recon pull, the dual-control camera review window, the void and override transaction analysis, the prior-pattern check against the same teller, and the two HR-aligned outcome paths (training memo or termination-with-recovery). Includes the variance-loss memo template the second-line reviewer expects.

Module 3. Card-present fraud cluster analysis

When chargebacks cluster on a single ZIP or a single merchant, the casework asks whether it is a skim event, a card-mill ring, or an internal merchant scheme. This module covers the BIN-and-merchant-pivot analysis, the ATM-pull request to a card network, the customer-statement-affidavit kit, and the threshold at which the file becomes a multi-branch corporate matter rather than a single-branch loss event.

Module 4. ATM and ITM skim and jackpotting casework

Physical-attack casework on ATMs and ITMs combines a camera evidence chain, a vendor-incident report, a fleet-wide pattern check, and a regulatory-notification decision. The module walks the AVP through the on-site evidence preservation script, the fleet-wide indicator query, the OCC and FDIC notification thresholds, and the recovery filing against insurance and against the card network.

Module 5. Branch robbery and burglary case file

Robbery cases mix law-enforcement liaison, victim and employee statements, camera chain-of-custody, recovery filing, and a board-of-directors notification template. The module covers the first-24-hour FBI notification, the witness-statement kit that a US Attorney prosecutor will use, the burglary-tool evidence preservation, and the post-event branch-physical-security review the regional director will ask for.

Module 6. Internal fraud and dishonest-employee casework

The hardest cases. The module walks the AVP through the dual-investigator protocol, the legal-and-HR coordination memo, the surveillance-and-system-log preservation, the interview script that produces an admissible statement, the bond-claim filing for a financial-institution bond, and the SAR narrative that names the employee. Includes the chain-of-custody log every examiner sampling internal-fraud files expects to find.

Module 7. ACH and check fraud case workflow

ACH return spikes and check-kiting cases live in the same queue but have different evidence patterns. The module covers the return-reason-code analysis, the NACHA dispute window, the Reg E and Reg CC obligations, the check-image and endorsement analysis, and the loss-allocation memo that decides whether the bank or the customer eats the loss.

Module 8. SAR narrative writing for loss-prevention cases

The SAR narrative is read by FinCEN and by examiners and by federal investigators, and it has to read the same way to all three. The module covers the five-section narrative structure FinCEN documents in its FAQs, the language that avoids triggering an MSB-style follow-up, the dollar-amount and date-range conventions, and the cross-reference pattern when a case spans multiple SARs filed by the same institution.

Module 9. Loss memo and accounting entry pattern

Every closed case produces a loss memo that drives a GL entry, a regulatory loss-event classification, and an internal scorecard. The module walks the AVP through the operational-loss-event categories the bank uses for Basel reporting, the GL-coding pattern that survives internal audit, the recovery-receivable entry, and the loss-event-database write-up that feeds the bank's annual operational-risk capital calculation.

Module 10. Recovery actions, restitution, and insurance claims

Closing a loss event includes filing for recovery. The module covers the financial-institution bond claim, the cyber-and-electronic-crime insurance rider, the small-claims and civil-court restitution path, the criminal-restitution order pattern in federal sentencing, and the recovery-tracker that keeps the file open against the receivable until cash hits the GL.

Module 11. Examiner sampling, audit, and second-line review

An FDIC or OCC examiner sampling loss-prevention files looks at the intake date, the close date, the SAR-filing timestamp, the loss-memo classification, and the second-line review signoff. The module covers the case-file structure that survives sampling, the redaction pattern for examiner workpaper requests, the response template for examiner findings, and the second-line review checklist the AVP runs against the file before submission.

Module 12. Monthly reporting pack and regional risk committee

The AVP owns the monthly pack that goes to the regional risk committee and feeds the corporate-security quarterly board report. The module covers the case-type-by-volume chart, the loss-amount-by-class trend, the open-case aging report, the recovery-rate scorecard, and the narrative summary that a regional director can read in two minutes and a board member can read in thirty seconds.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Modules 1 through 5 cover the high-volume branch case types every AVP runs weekly.

Modules 6 and 7 cover the highest-stakes internal and payments cases.

Modules 8 through 10 cover the narrative, accounting, and recovery work that closes the file.

Modules 11 and 12 cover the audit, examiner, and reporting layer that protects the AVP and the function.

What you get with this course

12 written modules with worked examples from real branch case archetypes.
A loss-memo template aligned to the operational-loss-event categories used in Basel reporting.
A SAR narrative template with the five-section FinCEN structure.
An intake-to-close case-file folder structure used by the bank's internal audit team during sampling.
A monthly reporting pack template ready to drop into the regional risk committee deck.
The hand-built implementation playbook produced for the buyer's specific portfolio mix and branch footprint.

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours of purchase, account provisioning in the learning environment and delivery of the hand-built implementation playbook tailored to the buyer's portfolio mix.

Self-paced through the 12 written modules; most AVPs work through one module per evening across two weeks.

Templates and worked examples downloadable from each module page.

Before and after

Before

Bounced case files, rework cycles, second-line review delays, regional manager calls asking why the Q close looks soft, examiner samples that surface inconsistent loss classification.

After

A standardised case file that closes the first time, a SAR narrative that survives FinCEN and examiner review, a loss memo that maps cleanly to operational-risk reporting, and a monthly pack the regional risk committee uses without rework.

What happens if you do not address this

Without a standardised casework approach, every bounced file is a week of rework, every inconsistent loss classification is a finding waiting for an examiner to surface, and every gap in the case file is a recovery action that fails or a SAR that gets follow-up scrutiny. The cost is invisible until the regional director asks why the AVP's close rate is half of a peer region.

Who it is for

AVP-level Risk and Loss Prevention staff inside a large retail bank, accountable for branch incident triage, fraud casework, SAR filing recommendations, loss-event close-out, and reporting up to a regional director of corporate security or financial crimes. Owns the work-product, not the tooling. Reports into a corporate security or fraud operations function. Frequently the same person who briefs the branch manager and the regional risk committee on what closed and why.

Who this is NOT for. Not for AML transaction monitoring analysts running rule-tuning on a Verafin or Actimize console. Not for cyber incident responders. Not for branch tellers or branch managers. Not for first-line compliance officers writing policy. This is for the person who owns the loss-event file from intake to close.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Plan for 8 to 12 hours total. Most AVPs work through one module per evening across two weeks.

Why $199 is the right number

Industry training catalogues from ACAMS and ACFE cover the certification syllabus but not the case-file artefacts. Bank internal training covers policy but not the loss-memo or SAR-narrative patterns examiners look for. This course covers the artefacts.

FAQ

Is this an AML or BSA certification course?

No. This is a casework playbook for the loss-prevention work that follows a branch incident. It complements ACAMS or CAFP certifications but is not a substitute.

Does this cover credit card portfolio fraud strategy?

Card-present fraud cluster casework is module 3. Portfolio-level chargeback strategy is not the focus.

Will the templates pass our internal audit?

The templates are built around the artefacts FDIC and OCC examiners sample and second-line reviewers check. Buyers typically adapt the templates to their bank's specific policy language before adoption.

What is the delivery format?

Written modules plus downloadable templates plus the hand-built implementation playbook. No live sessions, no audio narration.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.