{
  "question_text": "When you finish reviewing an escalated monitoring alert, you must choose one of three outcomes. Which outcome means you confirmed suspicious activity?",
  "options": [
    "SAR filed",
    "Cleared",
    "Continued monitoring",
    "Escalated for further review"
  ],
  "correct_answer": "SAR filed",
  "correct_response": "Correct. 'SAR filed' means you confirmed suspicious activity and initiated the SAR filing process. 'Cleared' means no problem was found. 'Continued monitoring' means you are not sure yet and will check again in 30 days.",
  "incorrect_response": "The three outcomes are: Cleared (no problem found), SAR filed (suspicious activity confirmed), and Continued monitoring (not sure — check again in 30 days). 'SAR filed' is the outcome that confirms suspicious activity and requires you to initiate the SAR filing process.",
  "unsure_response": null,
  "question_bank": [
    {
      "question_text": "How long must you keep all monitoring records, including your alert log and investigation files?",
      "options": [
        "Five years",
        "Three years",
        "Seven years",
        "As long as the customer account is active"
      ],
      "correct_answer": "Five years",
      "correct_response": "Correct. All monitoring records must be kept for five years. Records that are not kept for five years cannot be produced during an examination.",
      "incorrect_response": "All monitoring records — including the alert log, investigation files, SAR referral log, and threshold review log — must be kept for five years. Records that are missing during an examination are a serious compliance problem.",
      "unsure_response": null
    },
    {
      "question_text": "When a supervisor sends you a monitoring alert to review, what should you do first?",
      "options": [
        "Look at the customer's transaction history and ID records",
        "File a SAR immediately as a precaution",
        "Contact the customer directly to ask about the transaction",
        "Close the alert if the customer has no prior alerts on record"
      ],
      "correct_answer": "Look at the customer's transaction history and ID records",
      "correct_response": "Correct. When you receive an escalated alert, you start by reviewing the customer's transaction history and ID records. You may also do additional research if needed before choosing an outcome.",
      "incorrect_response": "When a supervisor sends you an alert to review, start by looking at the customer's transaction history and ID records. Do additional research if needed. Only then choose one of the three outcomes: Cleared, SAR filed, or Continued monitoring — and write down your decision.",
      "unsure_response": null
    }
  ],
  "enrichment_content": "<p><strong>Every alert needs a written decision.</strong> After reviewing a monitoring alert, choose one of three outcomes:</p><ul><li><strong>Cleared</strong> — no problem found</li><li><strong>SAR filed</strong> — suspicious activity confirmed</li><li><strong>Continued monitoring</strong> — not sure yet; check again in 30 days</li></ul><p>No matter which outcome you choose, write it down. An alert with no written decision is the same as an alert that was never reviewed. Keep all records for <strong>five years</strong>.</p>"
}