It could be something like that, yes.
We may receive a complaint, and then that complaint would have to be triaged. A department has to receive it, review it and establish its priority based on what could be the modus operandi, the amount of money that was defrauded or anything like that. Then it has to be assigned to an individual or a team of investigators. Then that investigator has to have the time to begin the file. There could be a considerable amount of time before work actually begins on the file itself.
Depending on what the alleged event was, it's possible that the police may try to obtain certain information from the bank. For example, they might want to obtain IP logs, or logs of the account that had been accessed. If they are able to write a production order to the bank to obtain this information, it could take 30 days, or it could take whatever time it actually takes to for the bank to reply. In that reply, it could be that there are several IP addresses that had accessed the account.
In order to continue with next steps, police would likely try to figure out who would be behind the IP addresses that had accessed the account. Part of the challenge that police face now is establishing exactly which company is in control of the subscriber information associated with those IP addresses.