Alert Disposition
Alert disposition is the documented decision that resolves a screening alert to one of three outcomes: a confirmed true match, a dismissed false positive, or an inconclusive result requiring escalation. The middle category gets far less attention in most compliance content than the other two, despite being where the most genuinely difficult judgement calls actually happen.
Key takeaways
- Every screening alert resolves to one of three dispositions: true match, false positive, or inconclusive requiring escalation.
- True matches require confirmation across multiple identifying factors, not a single data point, and trigger different responses depending on match category (sanctions block vs PEP escalation).
- False positives require the same evidentiary rigour as true matches, identifying the specific factor that rules out a genuine match.
- Inconclusive alerts, often under-discussed in compliance content, must be escalated rather than defaulted to false positive to clear a backlog.
- A defensible disposition record documents the factors compared, the source checked, the reviewer, and the reasoning, not just a bare “cleared” status.
- Risk-tiered matching thresholds concentrate disposition effort on higher-risk segments, a practice FATF and FinCEN both endorse.
- Automated dispositions increasingly require their own documented narrative, so growing AI involvement doesn’t create a corresponding audit trail gap.
On this page
What alert disposition actually meansThe three-way decision every alert requiresTrue match: what actually counts as conclusiveFalse positive: the documented dismissalInconclusive: the category most content skipsWhy disposition quality matters more than alert volumeWhat a defensible disposition record actually containsRisk-tiered thresholds and their effect on dispositionThe AI disposition trend, and its transparency requirementBuilding disposition governance that holds upFAQsRead more
What alert disposition actually means
Alert disposition is the process, and the documented outcome, of resolving a screening or monitoring alert once a human reviewer, or increasingly an automated system, examines it. Every alert a name screening or transaction monitoring system generates eventually needs a disposition; an alert sitting unresolved indefinitely isn’t a neutral state, it’s an unaddressed compliance gap.
The three-way decision every alert requires
Disposition resolves to one of three categories. A true match, sometimes called a confirmed hit, means the reviewer can conclusively determine the flagged individual or entity genuinely is the person on the reference list. A false positive, or false match, means the reviewer can conclusively determine it isn’t the same person, a coincidental name similarity with no real connection. Where neither conclusion can be reached with confidence, the alert becomes a potential match requiring escalation, rather than being forced into one of the other two categories on incomplete information.
True match: what actually counts as conclusive
A true match disposition typically follows confirmation across several identifying factors at once, not a single data point: name match combined with consistent date of birth, nationality, and, where available, a unique identifying number. A confirmed sanctions match generally triggers an immediate block and, depending on the jurisdiction and programme, a reporting obligation to the relevant authority. A confirmed PEP match instead triggers escalation to enhanced due diligence rather than an automatic block, since the required response genuinely differs by match category.
False positive: the documented dismissal
A false positive disposition requires the same evidentiary rigour as a true match, just pointing the other direction: identifying the specific factor, a mismatched date of birth, a different nationality, an inconsistent identifying number, that establishes the flagged person isn’t genuinely the listed individual. Industry estimates commonly put the share of screening alerts that ultimately resolve as false positives at somewhere around eight or nine out of every ten generated, which is exactly why disposition quality and consistency matter as much as the underlying false positive rate itself.
Inconclusive: the category most content skips
Most compliance content focuses heavily on true matches and false positives while giving comparatively little attention to genuinely inconclusive alerts, cases where available information simply doesn’t support a confident determination either way. These alerts require escalation for additional data collection, further identifying documentation, corroborating records, senior review, rather than being forced into a false positive disposition purely to clear a backlog. Treating an inconclusive alert as a de facto false positive, simply because the reviewer couldn’t confirm a match, inverts the actual burden the disposition process is supposed to apply.
Why disposition quality matters more than alert volume
A firm can have a well-tuned screening system generating a reasonable alert volume and still carry real regulatory risk if its disposition process is inconsistent, poorly documented, or applied differently by different reviewers facing similar facts. Regulators reviewing a compliance programme examine disposition quality directly: whether similar alerts received similar treatment, whether the stated rationale actually supports the conclusion reached, and whether genuinely inconclusive cases were escalated rather than quietly cleared.
What a defensible disposition record actually contains
A disposition record that holds up under review documents the specific identifying factors compared, which source was checked to confirm or rule out a match, the reviewer’s name and the date of the decision, and, for anything beyond the most straightforward false positives, a clear statement of the reasoning connecting the evidence reviewed to the conclusion reached. A record that just states “cleared” or “false positive” without that supporting detail is functionally undocumented, regardless of whether the underlying decision was actually correct.
Risk-tiered thresholds and their effect on disposition
Matching thresholds calibrated by customer risk directly shape how much disposition work a screening programme actually generates: a lower matching threshold applied to higher-risk customers produces more alerts and more disposition volume for that segment specifically, while a higher threshold for genuinely low-risk customers limits alerts to higher-confidence matches only. This risk-based calibration, a practice regulators including FATF and FinCEN have specifically endorsed, concentrates disposition effort where it’s actually likely to matter rather than spreading it evenly regardless of underlying risk.
The AI disposition trend, and its transparency requirement
Automated systems increasingly handle a portion of disposition directly, particularly for clear-cut false positives, but the same documentation standard applies regardless of whether a human or an automated system made the call. Emerging practice specifically emphasises disposition narratives, a written explanation for every automated clearance or escalation, timestamped and traceable to the specific system or model version responsible, precisely so an automated disposition can be reviewed and audited with the same rigour as a human one, not treated as a black-box decision exempt from scrutiny.
Building disposition governance that holds up
A disposition process that holds up under regulatory review generally combines a consistent, documented decision framework applied the same way across reviewers, mandatory escalation for genuinely inconclusive cases rather than forced false positive clearance, periodic quality review sampling closed alerts to check that documented reasoning actually supports the conclusion reached, and equal documentation rigour for automated dispositions as for human ones, so the growing share of alerts resolved without direct human review doesn’t become a corresponding gap in audit trail quality.
Build a documented alert disposition process
Generate a policy draft that records how alerts get cleared, escalated, and reviewed.
Frequently asked questions
What is alert disposition?
Alert disposition is the documented decision resolving a screening alert to one of three outcomes: a confirmed true match, a dismissed false positive, or an inconclusive result requiring escalation.
What are the three possible alert dispositions?
True match (conclusively confirmed to be the listed individual), false positive (conclusively confirmed not to be), and inconclusive or potential match, where available information doesn’t support a confident determination either way.
What happens when a screening alert is confirmed as a true match?
A confirmed sanctions match generally triggers an immediate block and a reporting obligation. A confirmed PEP match instead triggers enhanced due diligence escalation, since the required response differs by match category.
How common are false positives in screening alerts?
Industry estimates commonly put the share of alerts resolving as false positives at roughly eight or nine out of every ten generated, which is why consistent, well-documented disposition matters as much as the underlying false positive rate.
What should happen with an inconclusive alert?
It should be escalated for additional data collection and senior review, not forced into a false positive disposition simply because a confident match couldn’t be confirmed.
What does a defensible alert disposition record actually need to include?
The specific identifying factors compared, the source used to confirm or rule out a match, the reviewer’s name and decision date, and a clear statement connecting the evidence to the conclusion reached.
How does risk-based screening affect alert disposition?
Lower matching thresholds for higher-risk customers generate more alerts and disposition work for that segment, while higher thresholds for low-risk customers limit alerts to higher-confidence matches, concentrating effort where risk actually warrants it.
Do automated alert dispositions need the same documentation as human ones?
Yes. Emerging practice requires a disposition narrative for every automated clearance or escalation, timestamped and traceable, so automated decisions can be audited with the same rigour as human ones.
Read more: our ultimate guides, whitepapers and templates
Related guides and resources to help you act on what you just read.
Last reviewed July 19, 2026 · 11 min read · Written for compliance and risk professionals · By the WhoWiki editorial team
Key takeaway: Alert disposition is the documented decision that resolves a screening alert to one of three outcomes: a confirmed true match, a dismissed false positive, or an inconclusive result requiring escalation. The middle category gets far less attention in most compliance content than the other two, despite being where the most genuinely difficult judgement calls actually happen.