AI Agents Against Financial Crime: What They Change for a Compliance Team

Short Answer

An AI agent in AML does the work that sits between an alert and a decision. It pulls the customer's profile and history, checks account changes and devices, looks for other customers linked to the same account or counterparty, compares the pattern with known typologies, and writes a finding with the evidence. Your compliance officer reads the finding and decides. The gains are speed, fewer false positives closed without a reason, and coverage across the whole customer base instead of one account at a time.

Key Takeaways

• Rule engines stay. They check each payment in microseconds. Agents work on what the rules flag.
• Most alert time goes to gathering context. Agents gather it in the same pass and attach it to the case.
• A finding has to show its evidence. If you can't trace a recommendation to the records behind it, you can't defend it.
• Agents can see patterns across customers: one payout account shared by unrelated people, one device behind several sign-ups.
• A person makes every decision. The agent recommends, and the log shows who decided what.

Where the hours go today

Ask an AML analyst what fills the day and the answer is rarely the decision. It's the lookup. An alert says a customer sent $48,000 to a new beneficiary. Before anyone can judge it, someone has to open the KYC file, read the expected activity, scroll twelve months of transactions, check whether the bank details changed recently, and search for the beneficiary elsewhere in the book. That takes twenty minutes on a good day. Then the analyst writes it up so a reviewer can follow the reasoning.

Most of those alerts close as explained activity. The customer bought a car, paid a tax bill, moved house. The analyst still spent the twenty minutes, and the reason for closing often lives in a free-text box nobody can audit later.

Volume makes it worse. A payment institution adding 10,000 customers a month adds alerts faster than it can hire. Backlogs build, and a backlog is where regulators look first. When the UK's FCA fined Starling Bank £29 million in 2024 and Monzo £21 million in 2025, both cases described controls that did not keep pace with customer growth. NYDFS cited an alert backlog that built up during rapid growth when it fined Block $40 million over Cash App in 2025.

What an agent does with an alert

Think of the work as four jobs, each with its own agent:

1. Detect. The rule engine checks every transaction against your scenarios before the money moves.
2. Gather. Task agents pull the customer profile, expected activity, transaction history, account and profile changes, devices and logins, and every other customer connected to the same account, device or counterparty.
3. Reason. A reasoning agent works through each factor the way an analyst would and writes it up: what happened, why it matters, which records support it.
4. Recommend. The case reaches your officer with a recommendation: clear, hold and call back, or escalate.

Take a real-world pattern. A customer who sends one or two transfers a year asks to move their full balance to a new account. An analyst working only from the alert sees a large transfer. The agent sees that the bank details changed 41 hours earlier from a device and country the customer has never used, that nobody confirmed the change by phone, and that two unrelated customers changed their details to the same receiving account that week. That's bank-detail fraud feeding a mule account, and the recommendation is to hold the payment and call the customer.

Advantages you can measure

Faster reviews. The agent attaches the context to the case before an analyst opens it. Your team spends its time on the judgement call.

Fewer silent false positives. When the agent closes explained activity, it records why. An examiner reading the file six months later sees the reasoning behind each closure.

Coverage across customers. Rules evaluate one account. Fraud rings and laundering networks spread across many. An agent that queries the account and device graph finds the shared payout account, the cluster of new sign-ups on one IP address, and the spike in bank-detail changes against last month's baseline.

A defensible record. Each rule carries its source (FATF, FinCEN, FFIEC, Wolfsberg, the EU AMLR). Each change to a threshold gets a back-test, a version and a written justification. Each decision lands in an append-only, hash-chained log. Your audit trail answers the question regulators ask most: how did you decide?

Consistent quality at volume. An analyst at 6pm on a Friday works differently from the same analyst at 9am. The agent runs the same checks on alert 400 as on alert 1.

What agents should not do

Agents should not file SARs, release payments or set your risk appetite. They should not clear a sanctions hit on their own. Supervisors expect a named person to own those decisions, and so does your board.

Explainability is the other line. If a vendor shows you a score without the evidence behind it, you can't defend the score to an examiner. Ask to see a finding, then ask which records support each sentence.

How to start

Pick one scenario with high volume and a high false-positive rate, such as first payments to new beneficiaries. Run the agents on 90 days of history alongside your current process. Compare three numbers: time to decision, false positives closed with a recorded reason, and cases your team missed. Expand when the numbers hold.

For the platform view, see AI agents for transaction monitoring. For screening inside the same file, see LSEG Risk Intelligence in Verifica.

Sources: FCA, Starling Bank final notice press release · FCA, Monzo press release · NYDFS, Block Inc. press release