“Please review this customer urgently” gives a specialist team very little to work with. They still need to know what happened, where the evidence sits and which decision is required.
Crypto compliance escalation works better when support records the relevant facts, explains the concern and identifies the next owner. A clear handoff can reduce repeat questions and help reviewers understand the case promptly.
This guide explains when to escalate, how to write useful notes and how to track a case after it leaves the support queue. It includes a reusable template and an illustrative example for customer support and operations teams.
When Should a Crypto Case Be Escalated?
A case should follow the relevant escalation process when the issue requires expertise or authority beyond the agent's role. The firm's policy should define triggers, receiving teams and urgency.
Common examples include reports of account compromise, possible scam instructions, unexplained verification discrepancies and potential sanctions matches. Technical processing issues may instead require an operations or engineering review.
FATF's virtual asset red flag report discusses unusual patterns, customer profiles and source-of-funds concerns. Such indicators need context and assessment. Therefore, describe the observation clearly rather than labelling the customer as a criminal.
Choose the Right Owner and Priority
An escalation label should help the receiving team understand both the issue and the urgency. The following categories are illustrative; each firm should align them with its own procedure.
| Situation | Possible receiving function | Priority consideration |
|---|---|---|
| Customer reports current unauthorised account access | Security and fraud | Whether active harm may be occurring |
| Verification task repeatedly fails | KYC operations or technical support | Whether the issue blocks onboarding and needs a technical fix |
| Potential sanctions match | Sanctions compliance | Applicable restrictions and the firm's urgent review process |
| Missing information for a transfer | Transfer operations or compliance | Current transfer status and the required decision |
| Customer complains about handling or delay | Complaints team | Applicable complaints process and communication ownership |
More than one function may need to act. In that situation, identify who coordinates the case and who owns customer updates. Assigning several teams without a lead owner can leave each waiting for another to respond.
Separate Facts, Reports and Concerns
Use three distinct elements in your note. First, state facts confirmed through authorised records. Second, summarise what the customer reported. Third, explain why the case needs review.
For example, a platform record may confirm a pending transfer. The customer may report that another person supplied the address. The resulting concern may be possible third-party influence or fraud. Ownership of the address may still be unknown.
This structure helps the reviewer assess the available evidence. Also, record missing information explicitly. A clear gap is more useful than an assumption disguised as a fact.
If the case involves verification delays, withdrawal holds or scam reports, use the relevant guide to confirm which initial details belong in the handoff.
A Practical Escalation Template
Adapt the following template to the firm's approved case system. It is an editorial example, not a statutory reporting form. 
| Field | What to record |
|---|---|
| Case reference | Unique ticket or internal case identifier |
| Contact time | Date, time and time zone |
| Authentication status | Whether the approved contact check was completed |
| Customer request | What the customer wants help with |
| Confirmed facts | Relevant authorised records and their timestamps |
| Customer report | Relevant statements, clearly labelled as reported information |
| Concern requiring review | Specific observation and why it meets the internal escalation criteria |
| Account or transfer references | Relevant platform identifiers, asset and network where needed |
| Evidence location | References to approved records or secure attachments |
| Actions taken | Permitted steps already completed, with time and owner |
| Information gaps | What remains unknown or unverified |
| Decision requested | The assessment or action needed from the receiving team |
| Priority and basis | Relevant policy category and factual reason for urgency |
| Receiving owner | Named function or authorised owner |
| Next checkpoint | Acceptance check or approved customer update commitment |
Keep the summary readable. The reviewer should see the core issue before opening supporting evidence. However, retain the underlying records according to the firm's evidence and retention process.
Example of a Useful Handoff
The following scenario is fictional and uses no real account or wallet information.
Case: TRAINING-EXAMPLE-01. Customer authenticated through the approved process. Customer asks for release of a pending withdrawal and reports that an online adviser supplied the destination address. Customer says a further payment is required to unlock investment profits. Authorised platform records confirm a pending withdrawal to the address referenced in the support conversation. Destination ownership has not been verified. Relevant messages are linked in the restricted case record. Routed through the urgent fraud process because the customer reports pressure to make a further payment. Requested decision: fraud assessment and approved next steps for customer communication. Receiving team acceptance remains to be confirmed.
The note identifies the concern, records the uncertainty and states the next decision. It also gives the receiving team enough context to begin its assessment.
As further information arrives, add dated updates rather than rewriting the history without a record. Corrections should make clear which earlier detail changed and why.
Protect Evidence and Sensitive Information
Use approved systems and access permissions for the evidence. Avoid moving sensitive customer records into personal accounts, informal chat groups or unapproved tools.
ICO guidance on data protection principles addresses relevance, accuracy and security. A practical handoff should therefore include the information necessary for review and reference securely stored evidence where possible.
Financial crime reporting information may need additional restrictions. In the UK, the National Crime Agency's SAR guidance highlights tipping-off and investigation-related offences. Support should use approved disclosure guidance and keep restricted reporting information out of customer-facing messages.
An internal handoff and an external SAR are different records. The designated reporting function should handle the firm's reporting process. Employees should also follow any reporting obligations applicable to their role and jurisdiction.
Track Acceptance and Updates
Sending a ticket is only one part of the handoff. Confirm that the receiving team has accepted ownership, especially where the case meets an urgent escalation criterion.
If acceptance is delayed, use the firm's fallback route. Meanwhile, record who will update the customer and when. A transfer between queues should not erase an existing communication commitment.
After the specialist decision, document the approved outcome and any further action. Keep related cases connected so later agents can understand the sequence without requesting the same information again.
Managers can review returned escalations, missing evidence references and missed ownership checks. These findings can guide coaching and improvements to the template.
For training on escalation awareness, clear case notes and collaboration with specialist teams, explore our frontline compliance course.
Frequently Asked Questions
How much detail should an escalation include?
Enough to explain the issue, relevant evidence and decision required. Keep the summary focused and reference supporting records instead of copying unnecessary personal information.
Should every difficult customer be escalated to AML?
Difficulty or frustration alone does not establish a financial crime concern. Use the case facts and internal criteria to choose the appropriate function.
What if urgent evidence is incomplete?
Use the urgent route when the policy criteria are met, record the missing details and supplement the case afterwards. Avoid waiting for a perfect record while active harm may continue.
Who owns the customer after escalation?
The firm's process should identify the communication owner. Specialist decision-making and customer updates may sit with different people, but both responsibilities need clear ownership.
