Which sequence best describes handling suspicious activity in an insurer's AML program?

• A. Ignore red flags and continue with the policy.
• B. Delay action and wait for regulator guidance.
• C. Notify customers first before any action.
• D. Escalate to the AML officer, perform enhanced due diligence, file SAR if warranted, document rationale and actions, and monitor going forward.

Answer: (D)