AI agent training plan template for AML investigators

An AML investigator's training plan for working with an AI agent covers five steps: the shared vocabulary, how the agent gathers evidence and drafts dispositions, shadow review on live alerts, a certified practicum, and renewal. The plan names the decisions that never leave the investigator, above all whether to file a suspicious activity report, and tests them.

What is this plan for?

In transaction monitoring, agents do the slow parts well: pulling the customer's profile and history, assembling linked accounts, summarising transactions, and drafting a disposition with its reasons. They run at depth 1 or 2 here. Closing an alert as a false positive may move to depth 3 for narrow, well-evidenced alert types once the agent has proven it on the firm's own cases. The decision to report suspicion stays with a person at every depth.

That shifts the investigator's work from gathering to judging. The FATF Recommendations expect a risk-based approach and the reporting of suspicious transactions; supervisors expect the person who closes an alert to be able to explain why. The plan makes sure investigators can do that when the narrative in front of them was drafted by an agent. Timing for the whole plan is discussed in how long it takes to train AML investigators to supervise AI agents.

How do you fill it in?

Complete one copy per investigator. Fields 6 and 7 carry the most weight: they define what the person must never get wrong and how the practicum tests it.

The template

1. Investigator: name, team, alert types they work.
2. Agent capabilities in scope: each with its depth, for example "evidence gathering, depth 1; disposition drafting, depth 2; false-positive closure for alert type X, depth 3".
3. Foundation learning: course, hours, completion date.
4. Reviewer learning: course, hours, completion date.
5. Shadow period: dates, the certified colleague who decides alongside, the sample size and match rate required.
6. Red lines: the decisions this investigator must never get wrong.
7. Practicum: dates, alert types covered, assessor, result.
8. Internal sign-off: MLRO or head of financial crime, date.
9. Certificate: number and expiry date.
10. Rights granted: which alert types they may close, and whether they may approve closures the agent prepares at depth 3.
11. Renewal: date booked, at least a month before expiry.
12. Coaching notes: links to calibration outcomes.

A worked example

A hypothetical payments firm's investigator, Investigator A, works card and transfer alerts. Values are samples.

1. Investigator A, financial crime operations, card and transfer monitoring alerts.
2. Evidence gathering, depth 1; disposition drafting, depth 2; false-positive closure for low-value card velocity alerts, depth 3 within bounds.
3. Foundations, about 4 hours, completed in week 1.
4. Operator track, about 14 hours over weeks 2 to 4.
5. Shadow in weeks 3 and 4 with Investigator B; 40 alerts sampled; decisions must match in at least 36, with no missed red line.
6. Red lines: - Never close an alert where the narrative relies on the customer's own explanation (declared) without checking it against a sealed or signed source. - Never treat the agent's draft as the decision on whether to report; the investigator forms and records their own view. - Never tell the customer, or allow the agent to draft anything for the customer, that hints at a report. - Never close a held alert because the queue is long.
7. Practicum in weeks 5 and 6 on real alerts, assessed by a Pryme assessor: at least 95 in every 100 decisions correct and no missed red line.
8. Signed off by the MLRO after the practicum.
9. Certified Pryme Operator, valid 12 months.
10. May close card and transfer alerts; may approve depth 3 closures the agent prepares for card velocity alerts.
11. Renewal booked 11 months after issue: update module and short quiz.
12. Calibration outcomes filed monthly.

Red line one is where agents and investigators most often go wrong together. An agent summarising a case will quote the customer's explanation, for example that a large inbound transfer was a property sale. That statement is declared, not verified. A trained investigator asks for the sealed or signed evidence before relying on it. Pressure testing belongs in the plan too, because suspicious customers sometimes send documents designed to steer whoever reads them; see how to train AML investigators to spot prompt injection and pressure. Keep decisions consistent with calibration sessions for AML investigators, and see the day-to-day method in how AML investigators review an AI agent's decisions. A market view is in AI agent training for AML investigators in payments in Australia, and team-wide sequencing in training teams for AI agents.

Where the Academy fits

Pryme Intelligence Academy covers fields 3, 4, 7, 9 and 11. Foundations is free; the Operator track ends in a written exam of 40 questions in 60 minutes, with a pass mark of 32, and a practicum signed off by a Pryme assessor. The certificate is issued through VerifyDoc.ai and can be checked at source, which helps when a supervisor asks who closed an alert.