Nothing closes, restricts or gets reported without a named person. A financial crime team's approver authority matrix sets who approves each decision an AI agent prepares: closing an alert, escalating, restricting an account, releasing a sanctions hold, exiting a customer and deciding whether to report suspicion, which stays with the reporting officer.
Why are financial crime approvals so tightly held?
Because the cost of a wrong decision runs both ways. Close an alert that should have been escalated and the firm may miss money laundering. Restrict an account wrongly and an innocent customer cannot pay their rent. The FATF Recommendations expect a risk-based approach, customer due diligence and suspicious transaction reporting; each of those rests on human judgement about suspicion that agents can support but not replace.
In practice, a triage agent reads alerts and the customer's history at depth 1 and drafts a disposition and narrative at depth 2. Nothing closes, restricts or reports without a named person. The matrix records who that person is for each decision, what they may approve, and when two people must agree. The skills behind each approval are in the AI agent competency matrix for the financial crime team.
How do you fill it in?
- Decision: one row per decision type.
- Agent's part: what the agent prepares, and at which depth.
- Approver: the role that decides.
- Scope: the alert types, risk levels or values within which the approver may act.
- Second approver: when required.
- Certificate: what the approver must hold, if approval rights depend on certification.
- Tipping-off check: whether any customer-facing message is involved, and who reviews it.
The template
| Decision | Agent's part and depth | Approver | Scope | Second approver when | Certificate | Tipping-off check |
|---|---|---|---|---|---|---|
| Close alert as no concern | ||||||
| Escalate to investigation | ||||||
| Request information from customer | ||||||
| Restrict account activity | ||||||
| Release sanctions screening hold | ||||||
| Confirm a sanctions true match | ||||||
| Exit customer relationship | ||||||
| Decide whether to report suspicion |
A worked example
A hypothetical digital bank's team: ten analysts, four investigators, a team lead and the reporting officer.
| Decision | Agent's part | Approver | Scope | Second approver when | Certificate | Tipping-off check |
|---|---|---|---|---|---|---|
| Close alert | Drafts disposition (2) | Analyst | Low and medium risk | High risk, investigator | Operator | n/a |
| Escalate | Drafts referral (2) | Analyst | All | None | Operator | n/a |
| Request information | Drafts message (2) | Investigator | All | Open case, team lead | Operator | Team lead reads every message during an open case |
| Restrict account | Drafts recommendation (2) | Investigator | Up to 30 days | Longer, team lead | Operator | Customer message reviewed |
| Release sanctions hold | Drafts disposition (2) | Investigator | Clear false positives | Any doubt, team lead | Operator | n/a |
| Confirm true match | Summarises (1) | Team lead | All | Always, reporting officer | Operator | Reviewed by reporting officer |
| Exit customer | Drafts recommendation (2) | Team lead | All | Always, reporting officer | Operator | Exit letter reviewed |
| Report suspicion | Drafts narrative (2) | Reporting officer | All | None | Operator | n/a |
Analysts may close low and medium-risk alerts, but only after checking each claim in the agent's narrative against its source. If the agent writes that a customer's explanation is "consistent with their declared income", the analyst confirms what that declared income is and whether anything sealed or signed supports it.
Confirming a sanctions true match sits at depth 1. The agent summarises the evidence but does not draft the confirmation, because the consequences are immediate and legal.
The tipping-off column is the row-by-row reminder that agent-drafted customer messages during a case can do harm. A request for documents should read like routine due diligence, not like an investigation. The team lead reads every such message while a case is open.
Fraud decisions sometimes overlap; the approver authority matrix for the fraud team covers card blocks and fraud refunds. Detailed scopes belong in the approver rule for the financial crime team, and cover in the reviewer rota for the financial crime team. Approvers can evidence their review skill with Pryme Intelligence Academy's Operator certificate. The role-by-role picture is in AI agent skills by role.
Questions people ask
Can the agent decide whether to report suspicion?
No. It can draft a narrative for the reporting officer. Forming suspicion and deciding to report are human judgements, and the reporting officer answers for them.
Why do analysts need a certificate to close alerts?
Closing an alert is a decision that suspicion is not present. A firm that ties that right to a current certificate can show that every closure was made by someone tested on exactly that judgement.
What if the agent's certificate lapses?
Drafts stop arriving and analysts work alerts from scratch until it is recertified. Approvals do not change, but throughput falls, so plan cover around lapse dates.