AML investigators at Australian payment companies need training to check the evidence an agent assembles on an alert, judge its draft narratives, control what it may say to customers, and keep the suspicion decision and the report firmly their own. A short, structured programme gets them there in 90 days without loosening any control.
What does an AML investigator at a payments company do all day?
The queue is alerts. Transaction monitoring at a remittance provider, payment facilitator or e-money issuer throws up structuring patterns, rapid in-and-out flows, payments to high-risk corridors and accounts that look like money mules. For each alert, the investigator gathers the customer's identity records, transaction history, device and login data, and prior alerts, then decides whether the activity is explained or suspicious.
Payments make the timing harsh. Funds move in seconds, scam victims' money passes through mule accounts quickly, and a payments investigator often has to decide on a restriction before the picture is complete. The other half of the work is writing: case notes a reviewer can follow, requests for information to customers, and suspicious matter reports that must be accurate, timely and clear to the authority receiving them.
Where do agents change the work, and at what depth?
Alert enrichment (depth 1). The agent pulls identity records, transactions, devices and prior alerts into one view, with each fact stamped by its source. The investigator starts from a complete file rather than six screens.
Network mapping (depth 1). The agent traces shared devices, beneficiaries and funding sources between accounts, which is how mule networks show up. It shows links; it does not conclude.
Case narratives and report drafts (depth 2). The agent drafts the case note and, where the investigator has decided to report, a first draft of the report. The investigator edits and files.
Requests for information (depth 2). The agent drafts questions to the customer. Every draft must pass a tipping-off check that the investigator owns.
Account restrictions (depth 4, held). Blocking an account or holding funds affects the customer and is hard to undo cleanly. The agent can propose it; a named person decides.
Some payments firms will also certify an agent at depth 3 to close a narrow class of alerts, such as those fully explained by a verified payroll pattern, with closures sampled. That depth has to be earned on the firm's own cases.
How should investigators review the agent's work?
Start from the record, not the narrative. Every verdict is filed with the bound that decided it and the sources used: sealed facts from the ledger or the payment rail, signed facts from a verified party, declared facts from the customer, and external material such as a news article. A narrative that rests on a declared explanation the agent never checked against sealed transaction data is weak, however fluent it reads. How AML investigators review an agent's decisions gives the step-by-step method.
When the investigator corrects the agent, for example on how it reads a known remittance pattern within a community, that correction should go into the agent's brief and sources so the next similar alert is handled right. Banking corrections that improve the agent explains the routine.
What stays with the investigator?
Forming suspicion, deciding to report, deciding to exit a customer, and anything said to the customer about why their account is restricted. Australian law prohibits disclosing that a suspicious matter report has been or may be made, so the agent's customer-facing drafts should never be sent without a person reading them. Liaison with law enforcement also stays with people.
This is not a reluctance to automate. Suspicion is a judgement for which a named person answers, and the report is a statement made to the authority by the reporting entity. The argument is set out in why AML investigators are the real control and, from the career angle, in will AI agents replace AML investigators?.
Which Australian rules shape oversight and competence?
Australia's AML/CTF law requires reporting entities to run a risk-based programme, monitor customers and report suspicious matters to the national AML/CTF regulator, which is also the financial intelligence unit. That regulator expects staff in AML roles to be trained for what they do. An agent that changes how investigations run changes what that training must cover.
APRA supervises authorised deposit-taking institutions and other prudentially regulated entities; where a payments business is one, or serves one, APRA's CPS 230 on operational risk management expects critical operations and material service providers to be managed, and agent-assisted investigations fall within that. ASIC regulates conduct and licensing for financial services. The Privacy Act 1988, overseen by the OAIC, applies to the personal information the agent handles.
The government's voluntary AI safety standard asks for accountability, testing, human oversight and trained staff. Internationally, the FATF Recommendations set the risk-based approach and suspicious transaction reporting that Australian law reflects.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
A 90-day plan
Days 1 to 30. Investigators learn depth, verdicts and provenance using closed cases from the firm's own files. The agent runs at depth 1, enriching alerts and mapping networks, while investigators work as before and compare.
Days 31 to 60. The agent drafts case notes and requests for information at depth 2. Every draft is reviewed, and every request passes a tipping-off check. Weekly sessions agree on disputed cases, and corrections go into the brief.
Days 61 to 90. Investigators who will approve held restrictions or sign off agent-drafted work complete certification, such as the Certified Pryme Operator credential from Pryme Intelligence Academy, and a supervised practicum. Any depth 3 closure class is tested in Attest before it runs. The AML/CTF compliance officer signs off the change to the programme.
The AI agent training plan template for AML investigators helps set owners and dates. For the skills of analysts, QA reviewers and the compliance officer, see AI agent skills by role.
Questions people ask
Can an agent file a suspicious matter report?
It can draft one for the investigator to review and file. The decision to report and the content of the report stay with people.
What if the agent's certificate lapses mid-investigation?
Its depth falls and its drafts become flags. The investigator carries on with the file as it stands; nothing the agent prepared disappears from the record.
How do we stop agent drafts tipping off customers?
Restrict the agent from describing reasons for any restriction, hold every customer message for review, and test that refusal in Attest before go-live.