Indirectly but fully. The FATF Recommendations are the international AML/CFT standard, and countries turn them into national law that binds firms. Those laws require a risk-based approach, customer due diligence, ongoing monitoring and suspicious transaction reporting. An agent can do much of the work behind each duty; the firm stays responsible for every judgement.
How do FATF standards reach a firm's agents?
FATF writes standards for countries, not for firms. Each country's AML law and regulator then set the binding duties. That is why the same agent can face slightly different rules in each market. The core, however, is shared:
- A risk-based approach: understand your money laundering and terrorist financing risks and apply controls in proportion.
- Customer due diligence: identify and verify customers and beneficial owners, understand the purpose of the relationship, and apply enhanced measures where risk is higher.
- Ongoing monitoring: scrutinise transactions against what you know about the customer, and keep due diligence up to date.
- Record keeping of due diligence and transactions.
- Suspicious transaction reporting to the national financial intelligence unit, with a prohibition on disclosing to the customer that a report has been made or is being considered.
None of these says who, or what, does the work. A walk-through by recommendation is in FATF Recommendations and AI agents in AML.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where can an agent help, and where must it stop?
| AML task | Agent's part | Depth | Stays with a person |
|---|---|---|---|
| Collect and check onboarding documents | Extracts, compares, flags gaps | 1 to 2 | Accepting a high-risk customer |
| Identify beneficial owners | Traces ownership from registries and documents | 1 | Concluding on unclear structures |
| Screen against sanctions and PEP lists | Runs checks, clears obvious false matches by rule | 2 to 3 | Confirming a true match |
| Investigate transaction alerts | Gathers history, drafts a narrative | 2 | Deciding whether it is suspicious |
| File a suspicious transaction report | Drafts the report | 2 | Deciding to file and submitting |
| Exit a customer relationship | Prepares the case | 1 | The decision |
The line is consistent: the agent does evidence work; a person makes every judgement on suspicion and every decision with legal or customer consequences.
Why do agents need special care in AML?
Tipping off. An agent that talks to customers and also sees alert data can leak suspicion without meaning to: "your payment is under review by our financial crime team". Customer-facing agents should not have access to investigation status, and their scripts for held payments must be neutral.
Explainability to examiners. A risk-based approach must be justified. If an agent closes alerts, the firm must show why each was closed, on what evidence, using which rule.
Drift in monitoring. Monitoring that depends on an agent's judgement can shift when its model changes. FATF's expectation of effective ongoing monitoring is tested by outcomes, which you need to watch; FATF ongoing monitoring and AI agents covers how.
An illustrative example
Take a mid-sized money remittance firm with a backlog of transaction monitoring alerts. It deploys an agent to work them. For each alert, the agent pulls the customer's profile, past transfers, recipient history and any adverse media, then drafts a short narrative and a recommendation: close, or escalate.
Analysts review every escalation and a sample of closures. In the first month, they find the agent closing alerts where a customer's stated occupation did not match transfer volumes, because the occupation field was rarely filled in. The firm changes the agent's brief so a missing field is a reason to escalate, not to assume, and adds such cases to its test set. Every suspicious transaction report is still decided and filed by the firm's money laundering reporting officer.
Which controls make the agent defensible?
- Document the agent within your risk assessment: what it does, at what depth, and why that is proportionate.
- Hold all suspicion judgements for named analysts and the reporting officer.
- Record each closed alert with the evidence and rule used.
- Separate customer-facing agents from investigation data to prevent tipping off.
- Sample closures and track how often reviewers disagree.
- Re-test after changes to the model, sources or brief.
The cross-regulation picture is in AI agent regulation, mapped to controls.
Where Pryme fits
In Pryme, filing a suspicious transaction report can be set as held for every agent: an agent may draft the report but only a named person submits it. Each draft, hold and decision is filed in an append-only record, which is the evidence an examiner asks for.
Questions people ask
Does FATF allow AI in AML?
FATF's standards are technology-neutral. Firms may use any tools that make their AML controls effective, provided they can show how those tools work and that the firm remains accountable.
Can an agent onboard low-risk customers alone?
It can carry out the due diligence steps for customers your policy classes as low risk, within rules you set and monitor. Anything that raises the risk rating should go to a person.
Who is accountable if an agent misses suspicious activity?
The firm and its responsible officers, as with any control failure. That is why closures need sampling and why the agent's decisions must be recorded in a way you can review.