Do AML investigators need a certificate to approve AI agent actions?

Yes. Closing an alert is a decision not to report, and when an AI agent drafted the narrative, the investigator must be able to judge what that draft rests on. A current certificate tested on real alert decisions is the best evidence a firm can hold that its investigators can do this. Attendance at a course is not.

Why does alert closure deserve a credential?

AML investigators already need professional knowledge of typologies and the firm's risk-based approach, which the FATF Recommendations put at the centre of the system. Agents add a new skill on top: reviewing someone else's reasoning quickly and spotting where it is thin.

An agent's narrative can read well and still rest on a customer's declared explanation, a missing document, or a counterparty check that did not run. An investigator who cannot see that will close alerts that should have been escalated. The credential should prove they can.

What should an AML investigator's certificate prove?

• Reading provenance in a case. The ledger is sealed; a sale contract from a solicitor is signed; the customer's story is declared. The investigator knows which can carry a closure.
• Recognising when the agent should have escalated. If the agent recommends closing a case with structuring signs, the investigator catches it.
• Respecting the tipping-off line. No customer contact that could reveal an investigation, and refusing any draft that does.
• Judgement under volume. The practicum is done on a real queue, so the investigator shows quality at a realistic pace.
• Currency. Typologies and the agent's bounds both move, so the credential must expire and be renewed.

What may the agent do, and what stays with the investigator?

• The agent may: gather transaction and counterparty history, compare activity with the declared profile, summarise past alerts, and draft a narrative with a recommended disposition.
• The agent holds: every closure and every escalation recommendation.
• The agent refuses: contacting the customer about the alert.
• The investigator keeps: the disposition, escalation to the reporting officer, and judgement about credibility.

An example: the new investigator's first fortnight

Take a mid-sized bank's financial crime unit. A new investigator joins with good typology knowledge from a previous role. For two weeks, they work real alerts in a practicum: every closure they propose is checked by a certified colleague before it takes effect. In the first week, they accept three agent closures resting only on declared explanations. Each is caught, and the reviewer explains why.

By the end of the second fortnight, their proposed dispositions match the reviewer's in all but a handful of cases, with no missed red line. The firm grants them approval rights. The record shows every practice decision, the reviewer's view and the sign-off. That is what the certificate stands for.

How do firms set this up?

1. Map approval rights to credentials, depth by depth, so only certified investigators may close alerts. This is a practice a firm can adopt, and the workspace can check the credential at the moment of approval.
2. Run a practicum on live alerts through a two-week practicum for AML investigators, recorded in a practicum log template for AML investigators.
3. Refresh at each agent renewal. Agent certificates lapse after 90 days; see how to prepare AML investigators for 90-day recertification.

Other risk roles face the same question; compare whether underwriters need a certificate and whether collections agents need one. The full topic is in AI literacy and certification for people who work with agents.

Where the Academy fits

Pryme Intelligence Academy's Operator track sets module tests in the learner's own industry and role, so an AML investigator is tested on alerts, not generic cases. Certified Pryme Operator requires a written exam and two weeks of real review decisions, at least 95 in every 100 correct with no missed red line, signed off by a Pryme assessor.