An Examiner-Ready, Tamper-Evident SAR Decision Ledger

Objective

When the examiner arrives, the ask is always the same: show the alert history, the screening rationale, and the decision audit — and prove nobody changed it. Pulling that into PDFs three weeks before the visit is the old way. This recipe keeps it live: a hash-chained, encrypted-at-rest immutable ledger of every disposition, with a one-query integrity proof.

Step 1: Create the encrypted immutable ledger

IMMUTABLE makes the table append-only and hash-chains every row; WITH (ENCRYPTION = 'AES256GCM') encrypts it at rest.

CREATE IMMUTABLE TABLE sar_ledger (
    alert_id    TEXT,
    customer    TEXT,
    typology    TEXT,       -- structuring / layering / ...
    disposition TEXT,       -- cleared / escalated / SAR-filed
    rationale   TEXT,       -- why
    analyst     TEXT,
    filing_ref  TEXT        -- BSA e-filing confirmation, if filed
) WITH (ENCRYPTION = 'AES256GCM');

The engine refuses ENCRYPTION unless AIDB_IMMUTABLE_MASTER_KEY is set (64+ hex chars) — there is no random per-process fallback, which would make the table undecryptable after a restart. Drop the WITH (...) clause for a plain immutable table (still append-only, still hash-chained).

Step 2: Record a disposition

INSERT INTO sar_ledger VALUES (
    'ALRT-20260728-014',
    'Flagged Co',
    'structuring',
    'SAR-filed',
    'Four sub-$10k deposits totaling $37,700 over three days; funds traced to an offshore cashout.',
    'A. Rivera, BSA analyst',
    'BSA-2026-0007731'
);

Step 3: Prove the trail was never altered

VERIFY TABLE sar_ledger;

Result:

is_valid | message
---------+-----------------------------------------------------------------------
true     | chain verified: 1 record(s) across 1 block(s) (1 open), checksum
         | SHA3_256; per-record lineage anchored (tamper-evident); ...

Why it matters

VERIFY TABLE returns a cryptographic yes/no on integrity — defensible chain-of-custody, not a policy promise. Every alert disposition, the analyst who made it, and the rationale are anchored in an append-only chain and encrypted at rest. When the examiner asks "prove this decision log wasn't edited," it is one query. This is the audit layer beneath structuring detection, fund-flow tracing, and SAR-narrative retrieval.