Spanish retail banks should train AML investigators to verify the evidence an agent compiles on property purchases and cash-intensive businesses, review its draft reports, and decide every restriction and report themselves. The EU AI Act requires deployers to make such staff AI-literate, and Article 14's idea of competent human oversight is a good model for investigations.
What does an AML investigator at a Spanish retail bank handle?
Property and cash define much of the caseload. Non-resident buyers fund homes on the coast with money from abroad, sometimes through structures that hide who really pays. Hospitality and retail businesses in tourist areas deposit large amounts of cash in season, which is normal, and some use that normality as cover. Remittances to Latin America and North Africa are mostly family support, with a minority linked to organised crime or unlicensed money transfer.
Investigators review alerts, examine source of funds for property purchases and large incoming transfers, decide whether to report to Spain's financial intelligence unit, and prepare the systematic reports Spanish law requires on certain categories of operation regardless of suspicion. They answer the bank's internal control body, which oversees the AML framework, and they respond to court and police requests.
Where can an agent help, and at what depth?
Property source of funds files (depth 2). For a property purchase, the agent assembles the incoming transfers, the sending institutions and countries, the buyer's declared source of funds and supporting documents, and labels each by provenance. It drafts the assessment for the investigator.
Seasonal cash analysis (depth 1). The agent compares a business's cash deposits with its own history and with similar businesses, adjusting for season, and flags deposits that break the pattern.
Remittance profiling (depth 1). The agent compares a customer's remittances with declared income and typical corridor patterns and flags outliers.
Systematic report preparation (depth 2). The agent prepares the periodic systematic reports from sealed transaction data for an investigator to check and submit.
Suspicious transaction report drafting (depth 2). After the investigator decides to report, the agent drafts the narrative. Restrictions on accounts are depth 4 and held for a named person.
How do investigators review the agent's work?
Follow the routine in how AML investigators review an agent's decisions: verdict, the bound that decided it, sources, then the narrative. In property cases, provenance is decisive. A notarised sale deed is signed; the buyer's letter about an inheritance is declared; an online company profile is external. An assessment that rests on the inheritance letter without verifying it is incomplete.
When investigators keep correcting the agent on the same point, such as treating holiday-let income as unexplained, the correction should become part of its brief. Banking corrections that improve the agent shows how to do it so the fix persists.
What must the agent never do, and what stays with people?
The agent must never reveal to a customer or a branch that a report has been made or considered, never restrict or release an account, never accept a declared source of funds as verified, and never decide to report. What AML investigators should never let an AI agent do sets out the full list. These are limits the bank sets, so the agent refuses or holds them. Separately, the platform withholds some actions from every agent at every depth, regardless of what any bank configures.
Suspicion, reporting, restrictions, exits and answers to authorities stay with investigators and the internal control body. That accountability, and the local knowledge behind it, is why AML investigators are the real control.
Which Spanish and EU rules shape oversight and literacy?
The EU AI Act (Regulation (EU) 2024/1689) applies directly. Article 4 requires deployers to take measures to ensure staff operating AI systems have sufficient AI literacy, considering their knowledge and the context of use. Article 14 sets human oversight requirements for high-risk systems, including that overseers understand the system's capacities and limits and can decide not to use or to override its output. Whether an investigation agent is high-risk depends on its use, but Article 14 describes what competent oversight looks like either way. Article 26 sets deployer obligations for high-risk systems.
GDPR applies to the personal data the agent processes. Article 22 restricts decisions based solely on automated processing that significantly affect people, which supports keeping restrictions and exits with people. The AEPD is the Spanish data protection authority.
Banco de España supervises banks, with the ECB directly supervising significant ones, and DORA sets ICT risk management requirements that cover the systems the agent uses. Spanish AML law requires banks to have an internal control body, report suspicious and systematic operations to the financial intelligence unit, avoid tipping off, and train staff. The EU AML Authority (AMLA) is being established in Frankfurt. The FATF Recommendations set the international baseline.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
A 90-day plan
| Period | Investigators | Agent |
|---|---|---|
| Days 1 to 30 | Foundation learning with the bank's own closed property and cash cases; Article 4 literacy recorded | Depth 1: cash and remittance analysis |
| Days 31 to 60 | Review every draft; weekly calibration on property cases; corrections banked | Depth 2: property files, systematic reports, narratives |
| Days 61 to 90 | Investigators who approve held items complete certification and supervised practice; internal control body briefed | Restrictions stay held; any new depth tested in Attest first |
The AI agent training plan template for AML investigators gives owners and dates. For the internal control body, analysts and branch staff, see AI agent skills by role.
Where the Academy fits
Article 4 asks for literacy measures; Pryme Intelligence Academy provides a recorded route. Foundations, about four hours and free, covers why agents must be governed and the decision chain. The Operator track adds human review, teaching the agent and incident handling, with a practicum signed off by a Pryme assessor and a certificate valid for 12 months.
Questions people ask
Does Article 4 require certification?
No. It requires measures to ensure sufficient literacy. Certification is one way to evidence them alongside training records and supervision.
Can the agent prepare systematic reports at depth 3?
Possibly, after a sustained record and certification, since the data is sealed and the criteria are defined. Anomalies should still be held.
Who decides on a non-resident property buyer with unclear funds?
The investigator, with the internal control body for higher-risk cases. The agent's file is evidence for that decision, not the decision.