The EU AI Act does not list AML work at a firm among its high-risk uses as such, but it shapes how compliance agents are built. Its ban on predicting crime from profiling alone draws a line AML agents must stay behind, and its oversight logic matches AML law: the agent prepares findings, a person assesses the facts and decides.
What does the Act require of compliance and AML agents?
The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024, with prohibitions applying from 2 February 2025. For a compliance team, four parts matter. If you need the background, see what the EU AI Act is.
A prohibited practice close to AML. The Act prohibits AI systems that assess or predict the risk of a natural person committing a criminal offence based solely on profiling or on personality traits and characteristics. It does not prohibit systems that support a human assessment of a person's involvement in criminal activity where that assessment rests on objective and verifiable facts directly linked to the activity. That distinction is the design brief for every AML agent.
High-risk listings. Annex III does not list transaction monitoring or customer due diligence at a private firm as such. It does list creditworthiness assessment of individuals, and some compliance teams' agents touch credit or employment decisions. Check each agent's uses against the list.
Transparency. Under Article 50, an agent that contacts customers, for instance to refresh due diligence information, must make clear it is an AI system.
Literacy. Article 4 requires staff working with AI systems to have sufficient AI literacy. For analysts relying on an agent's alert summaries, that includes knowing how it can be wrong.
Our EU AI Act compliance checklist for agents covers the general duties.
Who does it apply to?
Banks, payment and e-money institutions, crypto-asset service providers and other obliged entities under EU AML law that use AI in their compliance work, and the vendors that provide those systems. The EU AML Authority (AMLA), being established in Frankfurt, will add an EU-level supervisor to the national ones, so expect AI use in AML to draw attention from both.
What does the prohibition mean for an agent that acts?
AML agents read transactions, customer records, adverse media and screening results, then summarise, score and recommend. That work sits on the right side of the line when it stays tied to facts.
Compare two agents. The first reviews an alert, lists the transactions that triggered it, links them to the customer's stated business, notes three cash deposits just under the reporting threshold the firm uses internally, and recommends escalation, citing each fact. A person reviews and decides. That supports a human assessment based on objective, verifiable facts.
The second scores customers' likelihood of laundering from demographic features, social connections and behavioural traits, and the firm acts on the score. That drifts towards predicting criminality from profiling, which is exactly what the Act forbids.
The control that keeps agents on the right side is the same one AML law already demands: a person decides. FATF standards place suspicious transaction reporting and risk decisions on the regulated entity and its responsible officers. An agent may not close AML alerts on its own, because closing an alert is a judgement that the facts do not warrant suspicion. Our guide to AI compliance agents sets the principle: second line, never the last word.
How do you meet the Act in an AML team?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Stay clear of the profiling prohibition | Agent findings must cite specific transactions, documents or records; no scores from traits alone | Findings with linked source facts |
| Human assessment of every case | Agent recommends at depth 2; analyst decides to close, escalate or report | Decision records with analyst identity |
| Check high-risk exposure | Each compliance agent classified against Annex III | Classification register |
| Transparency to customers | Customer outreach by agents discloses AI involvement | Message templates and sent records |
| AI literacy | Analysts trained on how the agent works and fails | Training records |
| Logs | Every agent retrieval, summary and recommendation recorded | Append-only record per alert |
| Data protection | Processing recorded and assessed; no solely automated decisions with significant effects | Processing record and DPIA |
What will a supervisor ask?
- What do your AML agents do, and at what depth?
- Show us an alert the agent reviewed. Which facts did it cite, and who decided?
- Do any agents score customers on characteristics rather than conduct?
- Can an agent close an alert, or file a report, without a person?
- How have you classified your compliance agents under the Act?
- How do analysts learn when the agent's summary is wrong?
What does the Act not cover in AML?
It does not set AML obligations; those come from EU AML law and national rules built on FATF standards. It does not decide what counts as suspicious or when to report. It does not replace GDPR, which governs the personal data agents read and limits solely automated decisions such as account closures. And firms outside the EU face their own rules; our briefs on payments compliance in Australia and India show how different markets frame the same work.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Is an AML transaction monitoring agent high-risk under the EU AI Act?
AML monitoring at a private firm is not listed in Annex III as such. Check each agent against the list, and design it to stay clear of the profiling prohibition, which applies regardless of risk class.
Can an agent rank customers by money laundering risk?
It can help produce a customer risk rating from documented factors such as products, geography and conduct, for a person to review. Ranking from personality traits or profiling alone risks the prohibition.
Does the Act require a person to review every alert?
The Act does not set that rule for AML. AML law and supervisors' expectations put the decision on the firm's people, and keeping a person on every disposition is the safest way to meet both.