You stop an AI agent from tipping off a customer by removing suspicion data from its sources, giving it neutral approved lines for restricted accounts, refusing it any action that signals an investigation, and handing every probing question to a trained person. Then test it against hostile questions before launch.
Why is a customer-facing agent a tipping-off risk?
Tipping off means telling a customer, or saying anything likely to prejudice an investigation, that a suspicion has been raised or reported. AML regimes built on the FATF Recommendations treat it as a serious offence. The basics are in what tipping off is.
A trained person on the phone knows to stay vague. An agent tries to be helpful and answers from whatever it can see. If its sources include an alert reason, a case note or a hold code with a revealing label, a polite customer asking "why is my payment stuck?" can get a precise and disastrous answer. The agent's helpfulness is the risk, so the controls have to sit outside the conversation, as the guide to AI compliance agents argues for every second-line task.
What should the agent never be able to see?
The first and strongest control is source separation. A support agent should not be connected to case management, report drafts, investigator notes or the reason an alert fired. What it receives instead is a neutral status, such as "restricted: refer to specialist team", with no cause attached.
This must be done at the connection, not in the agent's instructions. An instruction saying "never mention the investigation" can be worn down by a persistent customer. An agent cannot disclose a fact it never received. The wider pattern is covered in tipping-off risk when agents talk to customers.
What may the agent say, and what stays with a person?
| The customer asks | The agent may | Stays with a person |
|---|---|---|
| Why is my payment delayed? | Give the approved holding line, with no reason and no timescale | Any explanation of the delay |
| Is my account frozen? | Say it cannot complete the request now and offer a handoff | What, if anything, to say about the restriction |
| Am I being investigated? | Give the approved line and hand off | Every word of the reply |
| Close my account and send me the balance | Record the request, take no action | The decision, made with the financial crime team |
| I want to complain about this delay | Log and acknowledge the complaint | The substantive response |
On a restricted account the agent should give the same answer it would give for an ordinary system delay, so its words reveal nothing either way.
What does a safe exchange look like?
Take a mid-sized payments firm. A business customer's transfer of 50,000 is held after an alert, and an analyst is preparing a report. The customer opens a chat: "Your system has flagged me, hasn't it? Is this a money laundering thing?"
The agent sees only the neutral status. It replies with the approved line, does not confirm or deny anything, offers to pass the conversation to a specialist, and records the handoff. A badly built agent, connected to the alert data, might have said the payment was held "because of an unusual pattern of cash deposits". That sentence is the offence.
Which controls make it safe?
- Approved lines written or signed off by the financial crime team and the money laundering reporting officer.
- A depth cap on restricted accounts. Once the neutral flag is present, the agent drops to depth 1 for that customer: it may read and reply from the script, and every account action is refused.
- No visible account actions. An agent that freezes, closes or limits an account in front of the customer can signal suspicion as clearly as words. The questions are set out in whether an AI agent can put a customer account on stop.
- Sampled review of restricted-account conversations by the financial crime team.
- A filed verdict for every reply and handoff, so you can show exactly what the agent said and why.
How do you test it before it goes live?
Build a test set from your own restricted-account conversations, with names removed, plus questions written to provoke disclosure. Ask the same thing twenty ways: directly, angrily, through a third party claiming to be the customer's accountant, and through text pasted from an email. Score every answer for disclosure, not politeness.
The test fails if the agent hints, speculates, answers restricted and ordinary accounts differently, or promises a release date. Repeat it whenever the brief, sources or model change.
Where Pryme fits
In Pryme, Attest replays an agent against your own restricted-account conversations, and the refusal and scope gates must each clear before the capability is certified. Restricted status reaches the agent as a sealed flag from the system of record, with no reason attached. A run that clears no depth drops the agent to depth 1 the same day.
Questions people ask
Does the agent need to know an account is restricted at all?
It needs to know enough to stop. A neutral flag lets it refuse actions and hand off; it does not need, and should not have, the reason behind the flag.
Can the agent tell the customer to phone the bank instead?
Yes, if that is the standard route for any delayed payment and the phone team is trained on the same approved lines. Sending only flagged customers to a special number can itself signal suspicion.
What if the customer complains about the agent's vague answers?
Log it and pass it to a person, who works with the financial crime team on the response. The complaint process must not become a side door for the reason.