FATF Recommendations and AI agents in AML

The FATF Recommendations do not mention AI agents, but every part of them applies when agents take part in AML work. A firm must assess the risks of a new technology before using it, keep records that reconstruct each decision, maintain internal controls and independent audit over the agents, and keep the judgements the standard assigns to people with people.

What do the FATF Recommendations require, in plain words?

The FATF Recommendations are the international standard against money laundering and terrorist financing. Countries implement them in national law, and supervisors enforce them. For a firm, the main obligations are:

• A risk-based approach. Identify, assess and understand your money laundering and terrorist financing risks, and apply measures in proportion.
• Customer due diligence, at onboarding and on an ongoing basis.
• Record keeping, sufficient to reconstruct individual transactions and to show what due diligence was done.
• Suspicious transaction reporting to the national financial intelligence unit, with a prohibition on tipping off the customer.
• Targeted financial sanctions, applied without delay.
• New technologies. Assess the risks of new products, practices and technologies before launching or using them, and manage those risks.
• Internal controls, including a compliance officer at management level, staff training and an independent audit function to test the system.

Our short answer on how FATF standards apply to agents in AML gives the summary; this piece goes through the parts that change when agents act.

Who does it apply to?

Financial institutions and designated non-financial businesses and professions in the many jurisdictions that implement the standard. That covers banks, payment and e-money firms, money service businesses, crypto-asset service providers, insurers for relevant products, and professions such as lawyers, accountants and estate agents in many places. FATF also evaluates countries, so supervisors are themselves assessed on whether firms apply the standard effectively.

What changes when agents take part in AML work?

Four parts of the standard bite harder once agents are involved.

New technology risk assessment comes first. Deploying an agent in AML is a new practice and technology. Before it goes live, the firm should assess what could go wrong: missed suspicion, inconsistent treatment, leaked information, reliance on wrong sources, and staff over-trusting summaries. That assessment should be documented and revisited when the agent changes.

Records must include the agent's part. If an agent summarised an alert and an analyst closed it, the record must show what the agent saw, what it said and what the analyst decided. Otherwise you cannot reconstruct why a transaction was not reported.

Internal controls must reach the agents. The compliance officer needs oversight of what agents do. Training must cover how to rely on them. And independent audit must test them, which our piece on how to audit a compliance agent's recommendations explains.

Tipping off is a new risk. An agent that talks to customers, for instance to request documents, must never reveal that a report has been made or is being considered. Customer-facing agents should have no access to reporting status.

What stays with people?

The standard places certain judgements on the firm and its responsible staff. Agents prepare; people decide:

• Whether activity is suspicious, and whether to file a report.
• The firm's risk assessment and risk appetite.
• Whether to accept, keep or exit a higher-risk customer.
• Whether a possible sanctions match is a true match.
• Final customer risk ratings and the depth of due diligence.

The work around those decisions, however, is a good fit for agents. False positives in alerting consume most analyst time, and our explainer on false positives in AML explains why. An agent that prepares a clear, sourced summary for each alert can cut the time per alert without removing the analyst's judgement. Our pieces on FATF customer due diligence with agents and FATF ongoing monitoring with agents set out the split in each area.

How do you meet the standard with agents involved?

What will a supervisor or evaluator ask?

• Did you assess the risks of this agent before using it? Show us.
• Can you reconstruct an alert decision, including the agent's part?
• Who decides on suspicion and reporting?
• How do you prevent agents from tipping off customers?
• How does your compliance officer oversee the agents?
• What has independent audit found?

What does the standard not cover?

FATF does not regulate the AI as such. The models, data handling and oversight of agents fall under other rules: data protection law, model risk expectations in banking, and in the EU the AI Act. FATF also leaves the detail to national law, so documents, thresholds and timings differ by country. For the second-line principle that runs through all of this, see our guide to AI compliance agents.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.