FATF suspicious transaction reporting: the agent drafts, a person files

A suspicious transaction report rests on suspicion, and suspicion is something a person forms. An AI agent may gather the facts, build the timeline and draft the narrative, which saves analysts hours. A named person must decide that the facts amount to suspicion, check every statement in the draft, and file it with the financial intelligence unit.

What does FATF require for suspicious transaction reporting?

The FATF Recommendations require that if a financial institution suspects, or has reasonable grounds to suspect, that funds are the proceeds of crime or are related to terrorist financing, it must report promptly to the national financial intelligence unit. Countries build this into law, often with a designated officer responsible for reporting.

Three companion rules travel with the duty:

• Protection. Firms and their staff who report in good faith are protected from liability for breaching confidentiality.
• No tipping off. Firms and staff must not disclose that a report has been made or is being considered.
• Records. The firm must keep records of what it knew and did, including why it decided to report or not.

Our explainer on what a suspicious activity report is covers the basics and the different names used in different countries.

Who does it apply to?

Every obliged entity under national AML law built on FATF standards: banks, payment and e-money firms, money service businesses, crypto-asset service providers, and many non-financial businesses and professions. Most jurisdictions require a named officer, often called a money laundering reporting officer or nominated officer, to receive internal reports and decide on external ones.

Why must a person decide and file?

Four reasons, each specific to reporting.

Suspicion is a human state of mind. The legal test asks whether the firm, through its people, suspects or has reasonable grounds to suspect. An agent can surface facts that would make a reasonable person suspicious; it cannot itself suspect, and the law does not treat its output as the firm's suspicion.

Accountability attaches to named people. The reporting officer is responsible for the decision to report or not. Our answer to whether an agent can act as an MLRO is no, for this reason.

A report goes to the authorities. A report containing an invented fact, a wrong date or a misattributed transaction can mislead an investigation and harm an innocent person. Every statement must be checked by someone who will stand behind it.

The decision not to report matters too. Many investigations end with a decision that the facts do not warrant a report. That decision, and its reasoning, must also be a person's, recorded so that it can be defended later.

What should the agent draft?

Drafting is where agents earn their place. A good report answers who, what, when, where, why and how, with supporting data. An agent can prepare:

• a timeline of relevant transactions with amounts, dates, counterparties and channels;
• a summary of the customer's profile, expected activity and how the activity departs from it;
• links to prior alerts, previous reports and due diligence records, with citations;
• a draft narrative in the financial intelligence unit's expected structure;
• a completeness check against the required fields.

The agent should mark every factual statement with its source, so the reviewer can verify it quickly. It should state plainly what it does not know. And it should explain why the case was flagged; our answer on whether an agent can explain why it flagged a transaction covers how.

How do you build the drafting and filing controls?

The investigations that lead to reports usually start in monitoring. Our pieces on FATF ongoing monitoring with agents and FATF customer due diligence with agents cover the work upstream.

What will a supervisor or FIU ask?

• Who decides whether to report, and who files?
• Can the agent submit a report? Show us the permissions.
• Pick a filed report. Which statements came from the agent, and how were they checked?
• How do you record decisions not to report?
• How do you stop agents tipping off customers?
• Has the quality of your reports changed since agents began drafting them?

What does the reporting rule not cover?

It does not tell firms how to monitor; that is ongoing due diligence. It does not set a threshold of evidence beyond suspicion or reasonable grounds. It does not govern the AI that drafts, which falls under data protection law, model risk expectations and, in the EU, the AI Act. And details such as report formats, deadlines and officer roles differ by country. For the second-line principle behind this, see our guide to AI compliance agents.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

Where Pryme fits

In Pryme, filing a suspicious transaction report can be set as withheld, refused for every agent at every depth. The agent drafts at depth 2, every statement arrives stamped with its source through Pryme Context Protocol, and the decision and filing stay with the named officer. The record shows the draft, the edits and who decided.