Only the review half of it. Your monitoring system's rules and models raise the alerts; an AI agent assembles the account history, customer profile, counterparties and prior alerts behind each one and drafts a disposition. Whether activity is suspicious, and what happens next, stays with an analyst or the money laundering reporting officer.
Which part of monitoring should an agent take?
Transaction monitoring has three layers. Detection: rules and models that score activity and raise alerts. Review: an analyst takes each alert and decides whether it is explained or needs investigation. Governance: someone checks whether the rules catch what they should.
Detection belongs in the monitoring system, where scenarios are documented and validated. Swapping a validated rule for an agent's judgement throws away the evidence that the rule works. Review is where the agent helps most, because each alert needs five or six data sources gathered before anyone can think about it. Governance is a second, quieter use: the agent can analyse which rules produce useful alerts and which produce noise.
What evidence does the agent assemble?
For each alert, the agent builds the same file:
- The trigger: which rule fired, the threshold and the values that crossed it.
- The customer: risk rating, stated occupation or business, expected activity recorded at onboarding, and when that was last refreshed.
- The activity: transactions over a look-back period, with the alerted ones in context, totals by counterparty and channel.
- Counterparties: who sent and received funds, whether they are customers, prior links to other alerts.
- History: previous alerts on this customer and how each was closed.
- The gap: the difference between what the customer said they would do and what they are doing.
It then drafts a disposition: close, with the explanation; or escalate, with the specific concern. Every statement in the draft points back to a record. How the agent reaches those records is covered in how to connect an AI agent to your transaction monitoring system.
What decision does a person keep?
| Decision | Who |
|---|---|
| Close an alert as explained | Analyst, unless your policy allows certified auto-closure for a narrow, tested pattern |
| Escalate to an investigation | Analyst |
| Form a suspicion and report | Money laundering reporting officer or nominated officer |
| Restrict or exit the customer | Compliance and the business, under policy |
| Change a rule or threshold | Rule owner, through model governance |
The analyst's decision matters because closure is where risk leaks. An alert closed with a plausible but wrong explanation leaves laundering unreported, and nobody looks at it again.
What does a review look like?
Take a retail bank. A rule fires on a personal current account: twelve cash deposits in a month, each just under the branch reporting threshold.
The agent's file shows the customer is recorded as a self-employed plumber, onboarded three years ago with expected monthly credits of around 3,000. This month's credits are 11,000, all cash, at four branches. Previous months show card payments from customers and a steady pattern. There are no prior alerts. Two of the branches are over an hour from the customer's address.
The agent does not decide. It recommends escalation, citing the change in channel, the branch spread and the deposit sizes clustering under the threshold. It also notes what would explain the activity innocently, such as a large cash job. The analyst escalates, the investigator asks the customer for invoices through the relationship team, and the record shows each step.
What controls make agent review safe?
- Rules stay governed. The agent cannot create, suppress or retune scenarios.
- Closure is sampled. A person re-reviews a sample of alerts the agent recommended closing, including the confident ones.
- Expected activity is checked for age. The agent flags when the customer's profile is stale, because a stale profile makes every comparison weaker.
- Rule performance is reviewed. Analysis of which scenarios produce useful alerts feeds tuning decisions; see how to review transaction monitoring rule performance with an AI agent.
- The agent itself is monitored. Its recommendations and the analysts' decisions feed the second line's work, alongside the compliance monitoring of everything else.
The general rule is in AI compliance agents: second line, never the last word.
Where Pryme fits
In Pryme, reading alerts, building the case file and drafting a disposition are separate capabilities, each certified on your own past alerts before use. Closing an alert is held for a named analyst unless that exact pattern has been certified and your own limits allow it. The rule that fired, the evidence and the analyst's decision are filed together.
Questions people ask
Can the agent replace the monitoring rules altogether?
No. Rules and models used for detection need documentation, validation and tuning evidence. An agent's reasoning does not provide that, and supervisors will expect it.
How long should the look-back period be?
Long enough to show the customer's normal pattern, usually several months. The agent should note when the account is too new to have one.
Can the agent talk to the customer about the alert?
Not about the alert. Requests for information should come through normal channels and wording so the customer is not alerted to the suspicion.