Under the FATF risk-based approach, an AML team spends its effort where money laundering and terrorist financing risk is highest and applies lighter measures where risk is lower. AI agents can gather, screen and draft at scale, but the risk judgements stay with people. That makes AML careers alongside agents less about volume and more about judgement you can show.
What does the risk-based approach ask of people?
The FATF Recommendations are the international standard on anti-money laundering and counter-terrorist financing. Countries put them into national law, and supervisors enforce them on banks, payment firms, money service businesses and other obliged entities. The risk-based approach runs through all of it: identify and assess the risks, understand them, and apply measures in proportion.
For individuals, three duties stand out. Customer due diligence must be done to a depth that fits the customer's risk, with enhanced checks for higher-risk customers. Activity must be monitored on an ongoing basis. And suspicious transactions must be reported to the authorities, without tipping off the customer.
None of that can be fully handed to an agent. The standard assumes people who understand the risks and make proportionate decisions. An agent can do the gathering and the first draft; a person decides what the risk is and what to do about it. The firm-level view is in the FATF risk-based approach applied to AI agents.
Who does it apply to?
FATF standards bind countries, not firms directly. Firms meet them through national AML law, which covers banks, payment and e-money institutions, money service businesses, crypto service providers in many markets, and designated non-financial businesses such as certain lawyers, accountants and estate agents.
So almost every AML job sits under the risk-based approach, whatever the country. The vocabulary changes slightly between markets, but the logic is shared. That is why AML skills travel well across the markets job seekers in this series are targeting. A plain definition of the approach is in what is the risk-based approach.
How does the work change with agents, and which roles grow?
Agents are good at the parts of AML work that are high volume and rule-shaped. People remain essential where the standard asks for judgement. A typical split looks like this:
| Task | The agent can do | Depth | Stays with a person |
|---|---|---|---|
| Customer due diligence | Collect documents, check them against sources, draft the risk profile | 2, draft | Rating the customer's risk and approving onboarding |
| Screening | Run names against lists and summarise possible matches | 1 to 2 | Deciding whether a possible match is a true match |
| Transaction monitoring | Gather context on an alert and draft a disposition | 2, draft | Closing or escalating the alert |
| Enhanced due diligence | Assemble source-of-funds evidence | 2, draft | Judging whether the evidence is sufficient |
| Suspicious activity reporting | Prepare a draft narrative | 2, draft | Deciding whether to report, and filing |
An agent should never decide to report, and never contact a customer in a way that could tip them off. Those are judgement and conduct points the standard puts on people.
The roles that grow are the judgement roles: KYC reviewer, alert investigator, enhanced due diligence analyst, quality assurance analyst and, above them, the officer who decides on reports. Read the duties in adverts for risk rating, alert review, case escalation, quality checks and file sign-off.
What competence do employers want, and how do you show it?
Employers want people who understand risk, not just procedure. Many also hire on demonstrated skills rather than degrees, a pattern explained in what is a skills-based hire.
| Requirement | What employers will expect of you | How to show it |
|---|---|---|
| Identify and assess risk | Explain why a customer or transaction is higher or lower risk | Anonymised risk rationales you have written |
| Proportionate due diligence | Ask for more where risk is higher, less where it is lower | A case where you requested enhanced checks and why |
| Ongoing monitoring | Review agent-drafted alert dispositions critically | Review decisions to a standard, including overrides |
| Suspicious transaction reporting | Recognise reportable activity and escalate correctly | A description of an escalation and the record you left |
| No tipping off | Keep customer contact neutral during an investigation | An example of how you handled a customer query safely |
| Record-keeping | Leave a file a supervisor could follow | Your case notes and a credential an employer can check |
What will an interviewer ask?
AML interviews tend to be case-based. Expect:
- "The agent drafted a closure for an alert because the customer's income explains the transaction. What do you check?" Whether the income figure came from a verified source or only from the customer, and whether the pattern fits the profile.
- "The agent flags a possible sanctions match with a common name. What next?" Compare identifiers, decide on evidence, and record why it is or is not a match.
- "A relationship manager asks you to speed up a high-risk onboarding. What do you say?" That the checks fit the risk, and you will not skip them.
- "How do you avoid simply agreeing with the agent?" Read the evidence first, then its draft, and sample your own overrides.
A KYC analyst we will call Farid prepared by writing two short risk rationales from memory, one for a low-risk retail customer and one for a complex corporate structure. Being able to explain the difference in plain words is the core of the job.
What does the risk-based approach not cover?
It does not tell you the exact thresholds, lists or deadlines in your market; national law and supervisors set those. It does not certify individuals. It does not permit firms to skip due diligence for low-risk customers entirely; it allows measures proportionate to risk where national law permits. And it does not make an agent's draft a decision: responsibility for reports and onboarding remains with people and the firm.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where the Academy fits
Pryme Intelligence Academy's Operator track trains the review habits AML work needs: how a governed agent decides, human review, teaching the agent from your corrections and what to do when something goes wrong. Module tests are set in your own industry and role. Certified Pryme Operator includes a practicum with no missed red line allowed, and employers can check it through VerifyDoc.ai.
Questions people ask
Is AML a good field to enter if agents are doing the screening?
Yes, if you aim for judgement roles. The volume work shrinks; the need for people who can rate risk and decide on alerts does not. Employers' training side is covered in training AML staff who work with AI agents.
Do I need a specialist AML qualification?
Many employers value one, especially for senior roles, but entry roles often hire on judgement and attention to detail. A record of real review decisions helps either way.
How do teams learn to work with the agent day to day?
Through structured practice on real cases with feedback. The method is set out in how to train staff to work alongside an AI agent, and the wider career picture in the guide to AI agent jobs and careers.