It depends on governance, not on the fact that it is an agent. AML rules are written about outcomes and accountability, not tools. Supervisors can accept an agent that prepares evidence, works within tested limits and leaves a full record, while a named person decides on suspicion and reporting. They will not accept one the firm cannot explain.
What do AML rules actually require of firms?
The FATF Recommendations, which national AML regimes follow, require firms to take a risk-based approach, carry out customer due diligence, monitor relationships, and report suspicious transactions. They describe what firms must achieve. They do not say how many people must do it or what tools they may use.
That gives firms room to use technology, and it puts the burden of proof on them. A supervisor reviewing a firm's AML controls will ask whether the controls work and how the firm knows. If an agent is part of a control, the firm must be able to show that the agent's part works too. How the standard maps to agent use is set out in FATF Recommendations and AI agents in AML.
What will a supervisor want to see?
From what supervisors ask about any automated AML control, you can predict the questions about an agent:
- Scope: exactly what the agent does, and what it does not do.
- Accountability: who owns the agent's work, and who makes each decision it supports.
- Testing: evidence the agent performs well on the firm's own cases, before and during use, including on missed suspicious activity, not only on efficiency.
- Explainability: for any case, what the agent saw, what it concluded and why.
- Records: a complete, retained record of the agent's actions and the human decisions that followed.
- Oversight: how people check the agent's work, how often, and what happens when it errs.
- Change control: how changes to the agent's brief, sources or model are tested and approved.
A firm that can answer these clearly will find agents treated like any other control. A firm that cannot will find them treated as a weakness.
Which AML decisions should stay with people?
| AML task | What the agent prepares | Decision a person keeps |
|---|---|---|
| Alert review | The case file and a recommended disposition | Closing or escalating, unless a narrow pattern is certified; see can an AI agent close AML alerts? |
| Investigation | Chronology, funds flow, findings and options | Whether there is suspicion |
| Reporting | The draft report | Filing |
| Due diligence | Evidence and risk rating | Accepting high-risk customers |
| Screening | Match evidence and recommendations | Confirming matches and freezing |
| Tuning | Analysis and tested proposals | Approving changes |
Keeping these decisions with people is what supervisors are most likely to look for. An agent that recommends and a person who decides is a structure they recognise. The working method for investigations is in how to prepare AML case investigations with an AI agent.
What does an acceptable deployment look like?
Take a mid-sized bank that introduces an agent to prepare transaction monitoring alert files. Before going live it replays the agent against a year of past alerts, including every case that led to a report, and checks the agent would have escalated each one. It documents the agent's scope, owner and controls in its AML policy, and tells its supervisor in the normal course of supervisory contact.
In use, analysts make every closure and escalation decision. A sample of the agent's recommended closures is re-reviewed each month. When the bank's supervisor asks, at its next review, how a particular case was handled, the bank produces the agent's file, the analyst's decision and the evidence of testing. The supervisor's questions focus on the testing method and sample sizes, which the bank can answer.
What about the EU AI Act?
Firms in the EU should also consider the EU AI Act. Agents used in AML may or may not fall into its high-risk categories depending on what they do, and deployers have obligations including human oversight and record-keeping. The analysis is in EU AI Act and AI agents in compliance and AML teams. This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
The general principle is in our guide to AI compliance agents.
Questions people ask
Do we need regulator approval to use an AI agent in AML?
That depends on your regime. Check whether any notification duties for material outsourcing or significant system changes apply, and confirm with counsel before go-live.
What do supervisors worry about most?
Missed suspicious activity, unclear accountability and firms that cannot explain their own controls. Agents raise all three if they are poorly governed.
Will staff trust the agent's work?
Trust follows evidence. Showing analysts the testing results, and letting them see what the agent checked, helps; see how do you get staff to accept AI agents?