FATF ongoing monitoring asks firms to keep scrutinising a customer's transactions and keep their information current throughout the relationship. AI agents can carry much of that load: triaging alerts, gathering context, spotting trigger events and preparing periodic reviews. They must not close an alert or clear a customer on their own; that judgement stays with an analyst.
What does ongoing monitoring require?
Customer due diligence under the FATF Recommendations does not end at onboarding. Firms must conduct ongoing due diligence on each business relationship, which has two parts:
- Scrutiny of transactions throughout the relationship, to make sure they are consistent with what the firm knows about the customer, their business and risk profile, including the source of funds where necessary.
- Keeping information up to date, by reviewing CDD records, especially for higher-risk customers.
The intensity follows risk. Higher-risk customers get more frequent reviews and closer scrutiny. Unusual activity must be examined, and where suspicion arises, reported. Our explainer on compliance monitoring covers how firms usually organise this work.
Who does it apply to?
Every obliged entity under national AML laws built on FATF standards, including banks, payment and e-money firms, crypto-asset service providers, money service businesses and many non-financial businesses and professions. Supervisors in each country set the detail, but the expectation of ongoing scrutiny is universal.
Where can agents help without closing alerts?
Ongoing monitoring produces volume. Transaction monitoring systems generate alerts, most of which turn out to be explainable, and periodic reviews pile up. That volume is where agents earn their place, as long as each output is a draft for an analyst.
Alert triage. The agent gathers the customer's profile, recent activity, prior alerts and stated business, and writes a summary: what triggered the alert, what is consistent with the profile and what is not. It recommends close or escalate, citing facts. The analyst decides.
Context gathering. For a flagged payment, the agent pulls counterparty history, any screening hits and related accounts, saving the analyst the search.
Trigger events. The agent watches for changes that should prompt a review: new adverse media, ownership changes in registry filings, a sharp shift in activity, a new high-risk jurisdiction among counterparties. It opens a review task with the evidence.
Periodic review preparation. The agent assembles the refreshed CDD file, highlights what changed and drafts the outreach for missing information.
Our short answer to whether an agent can do transaction monitoring is that it can prepare every part of it except the decision.
Why should an agent never close an alert on its own?
Closing an alert is a statement that the facts do not justify suspicion. FATF standards place that judgement, and the duty to report, on the firm and its responsible people. Three practical reasons reinforce the principle.
Closure is where launderers win. Activity designed to look ordinary is designed to be closed. An agent that learns to close what looks ordinary will close exactly that.
Automated closure hides drift. If an agent's closure rate creeps up after a model change, nobody may notice until a supervisor does. With an analyst deciding, a change in the agent's recommendations shows up as disagreement.
Rubber-stamping is the real risk. Even with a person deciding, an analyst facing a queue may agree with every recommendation. Measure agreement rates and time per alert, and sample closed alerts for quality assurance.
Tuning the monitoring rules themselves is a separate decision, owned by the people who govern the system, and an agent can at most draft analysis for it.
How do you meet ongoing monitoring duties with agents?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Transactions scrutinised | Every alert reviewed by an analyst; agent prepares the summary | Alert record with agent draft and analyst decision |
| Decisions grounded in facts | Agent recommendations cite specific transactions and records | Linked sources in each summary |
| Information kept current | Agent tracks review due dates and trigger events, opening tasks | Review task logs with triggers |
| Depth follows risk | Review frequency set by risk rating; agent cannot change ratings | Rating history with deciders |
| Human judgement is real | Agreement rates and time per alert monitored by analyst | Quality assurance reports |
| Quality assured | Sample of closed alerts re-reviewed by a second person | QA results and findings |
| Agent performance monitored | Agent's recommendations tested against known outcomes over time | Monitoring reports on the agent |
The last row is about monitoring the agent, not the customer. Our piece on SR 11-7 ongoing monitoring of AI agents covers how banks apply model risk practice to it. A compliance monitoring plan template can hold both kinds of monitoring in one place.
What will a supervisor ask?
- What does the agent do in your monitoring process, and who decides on each alert?
- Show us alerts the agent recommended closing. Who closed them, and how long did they take?
- How often do analysts disagree with the agent?
- How do trigger events reach a reviewer?
- How do you know the agent's recommendations are still reliable?
- Show us your QA results on closed alerts.
What does FATF not specify?
FATF does not set alert thresholds, review frequencies or staffing; national rules and the firm's own risk assessment do. It does not govern the AI itself; model risk expectations and, in the EU, the AI Act do that. And it does not cover the reporting decision in detail, which we treat in FATF Recommendations and AI agents in AML. For the principle behind all of this, see our guide to AI compliance agents.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
In Pryme, closing an alert is a capability that can be held for a named analyst at every depth, while gathering context and drafting summaries run at depth 2. Every recommendation and decision is filed, so agreement rates and drift appear in the record. A certification run that clears no depth drops the agent to depth 1 the same day.
Questions people ask
Can an agent auto-close alerts below a low risk score?
Not on its own authority. If a firm decides some alerts need no review, that is a rule set by people and documented, not a closure decision delegated to an agent.
Can an agent refresh low-risk customer files without a person?
It can gather and update factual data from reliable sources. Any change to risk rating, or any gap it cannot fill, should go to a person.
How do you stop analysts simply agreeing with the agent?
Track agreement rates and time per alert, rotate quality assurance reviews, and include planted test cases where the right answer differs from the agent's draft.