AI agents for compliance teams in business banking in the United States

Beneficial ownership checks, commercial alert triage, higher-risk sector files and SAR narratives are where AI agents help US business banking compliance teams. The AML officer and analysts keep every onboarding, exit and filing decision. Federal banking agencies, SR 11-7 model risk guidance and state regulators such as NYDFS decide how far the agents may go.

How does a US business banking compliance team spend its time?

Commercial customers come in every legal form a state allows: corporations, LLCs, partnerships, trusts, nonprofits. For each legal entity customer, the bank identifies and verifies the individuals who own a significant share and one individual with significant control. LLC structures stacked across several states make that slower than it sounds.

Certain sectors carry heavy documentation. Money services businesses need their registration and state licences confirmed. Businesses legal under state law but not federal law, such as cannabis-related businesses in some states, carry specific federal reporting expectations that the bank must follow for as long as it serves them. Each needs ongoing review, not a one-time check.

Alert review on commercial accounts, currency transaction reporting for large cash, SAR investigations and continuing-activity reviews, and exam preparation for the OCC, the Federal Reserve, the FDIC or a state regulator fill the remaining time.

Which uses fit an AI agent?

• Beneficial ownership collection and checks (depth 2). The agent drafts the certification request, reads returned documents, and compares the owners and control person against state filings. An analyst approves. Our guide to running business customer due diligence with an AI agent covers the full process.
• Higher-risk sector files (depth 1). For a money services business, the agent confirms registration and licence status from sources the bank trusts and lists gaps. For other designated sectors, it assembles the evidence the bank's programme requires.
• Alert triage (depth 2). The agent drafts a disposition using account history, related accounts and prior SARs, with every source cited.
• SAR narrative drafting (depth 2). The agent drafts the who, what, when, where and why for the investigator to edit. Continuing-activity reviews benefit most, because the agent can pull together the period since the last filing.
• Risk assessment inputs (depth 2). The agent drafts sections of the AML risk assessment from portfolio data. See how to run the business-wide AML risk assessment with an AI agent.

None of these reaches depth 3. The agent never files, never closes an account and never releases a held payment.

What stays with people?

The bank's designated AML compliance officer is accountable for the programme, and filing decisions stay with that function: whether to file a SAR, whether to continue filing, and whether to exit a customer. The board approves the programme. A regulator reading a SAR decision expects a named investigator and a reasoned file.

SAR confidentiality is strict, so the agent cannot disclose a SAR or its existence to the customer or anyone outside permitted channels. Any outbound communication on an account under investigation is held for compliance; an attempt to send one directly is refused, and that refusal is filed.

Sector decisions also stay human. Whether the bank serves money services or cannabis-related businesses at all is a risk appetite decision for senior management and the board. This is why we describe AI compliance agents as second line, never the last word.

Which US rules apply?

There is no single federal AI law. The OCC supervises national banks, the Federal Reserve supervises state member banks and holding companies, and the FDIC supervises state non-member banks; all examine AML compliance. Federal anti-money-laundering rules require a programme with internal controls, independent testing, a designated officer and training, plus customer due diligence, beneficial ownership for legal entities, and suspicious activity and currency transaction reporting.

SR 11-7, the interagency model risk guidance, is the standard examiners use for models. An agent that recommends alert dispositions is a model in substance: it needs development documentation, independent validation, ongoing monitoring and governance. Interagency guidance on third-party risk also applies to the agent's supplier.

NYDFS requires banks it regulates to maintain transaction monitoring and filtering programmes and to certify compliance each year, so an agent in that chain falls within the certification. GLBA governs customer financial privacy. Our overview of how AI agents are regulated in the United States covers the rest. US banks with EU operations should also read the EU AI Act's implications for compliance and AML teams.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

How do you start in the first 90 days?

Month one: put the agent through model risk intake. Document purpose, data, limits, owner and the validation plan, and agree with the AML officer which outputs are in scope for independent testing.

Month two: run beneficial ownership checks at depth 1 on closed files across several states and entity types. Compare findings with the original analysts' conclusions.

Month three: trial SAR narrative drafting at depth 2 on closed investigations, scored by senior investigators. If you are NYDFS-regulated, document how the agent sits within the monitoring and filtering programme before live use.