How to onboard a new AML investigator to an AI agent workspace

A new AML investigator should spend the first week reading how the agent triages alerts and drafts case narratives, and the second week deciding real alerts with a senior investigator checking each one. The suspicion decision and any report to the authorities never move to the agent. Sign-off comes only when the investigator closes and escalates alerts accurately.

What has changed about the investigator's job?

In a financial crime team where agents already work, the agent typically pulls the customer's profile and transaction history when an alert fires, groups related alerts, checks screening hits, and drafts a case narrative with the facts in order and their sources. It works at depth 1 and 2. It may recommend closing an alert as a false positive, but a person decides. Whether to treat activity as suspicious, and whether to file a report, stay with investigators and the money laundering reporting officer.

So a new investigator arrives into a queue where much of the gathering is done. Their value lies in judgement: does this pattern make sense for this customer, is the narrative complete, what is missing? The shift is described in what changes in an AML investigator's day when AI agents arrive. The financial crime team lead owns onboarding; a certified senior investigator coaches.

Week one: how do they learn to read the agent's work?

1. Day 1. Person (team lead): walks through the agent's bounds. What it gathers, which sources it may read, what it drafts, what it must never do.
2. Day 1 to 2. Person (new investigator): learns provenance in AML terms. Core banking transactions are sealed. A customer's explanation of a payment is declared. Adverse media found on the web is external. Narratives must say which is which.
3. Day 2 to 3. Agent, depth 2: drafts narratives on live alerts while the new investigator reads them beside a senior investigator, who explains each decision.
4. Day 4 to 5. Person (new investigator): practises on closed cases in a sandbox workspace, deciding alerts from the agent's drafts with the outcome hidden, then comparing.

Week two: how do they start deciding?

5. Person (new investigator): decides live alerts, each checked by the senior investigator before it takes effect.
6. Person (new investigator): records a reason for every disagreement with the agent's recommendation: missed link, weak source, narrative gap, wrong typology, or one-off.
7. Person (team lead): signs off the investigator to decide closures alone, if accuracy is high and no escalation was missed. Escalation rights may come later.

Which red lines must a new investigator hold?

The suspicion decision is theirs. An agent recommendation to close is an input, not a decision. A new investigator who closes because the agent said so has not investigated.

No tipping off. Investigators must never let the customer know a suspicion exists, and must not use agent-drafted customer contact that hints at it. The agent's bounds should refuse such drafts; investigators must know why.

Narratives must separate fact from claim. A customer's declared reason for a large transfer is not a fact. If the agent's narrative states it as one, the investigator corrects it.

The international standard behind this is the FATF Recommendations: a risk-based approach, customer due diligence and suspicious transaction reporting. New investigators who understand that the agent supports the risk-based approach, rather than replacing it, make better decisions.

How should they correct the agent?

With reasons that another person could act on. "Narrative missed second account held jointly with spouse" helps the agent owner check whether the agent reads joint accounts. "Wrong" helps nobody. Corrections recorded this way let the owner change the agent's brief or sources instead of the same gap recurring. The AI agent training plan template for AML investigators has a module on this.

Which controls and evidence should onboarding leave?

• Checked decisions in week two. Evidence: each decision shows both investigators.
• Sandbox results. Evidence: closed cases attempted, with outcomes compared.
• Rights granted in stages. Evidence: dated access changes for closure, then escalation.
• Reasons on every disagreement. Evidence: reason codes by investigator.

What should the team lead measure?

Accuracy of closures and escalations in week two. Missed escalations, which must be zero before sign-off. Narrative corrections that fixed fact-versus-claim errors. Time per alert, expected to fall over the first month. After sign-off, a regular quality sample of the investigator's closures.

Where does it usually go wrong?

Accepting the agent's recommendation under volume. Alert queues are long, and a new investigator learns quickly that most recommendations to close are right. The one that is not is the one that matters.

Training on the tool and not the typologies. An investigator who knows the screens but not how mule networks or trade-based laundering look will not spot what the agent missed.

Granting escalation rights too early. Closure rights and escalation rights are different authorities.

Other teams onboard into agent-heavy queues with similar staged rights, such as a new collections agent and a new customer support agent. The overall approach is in training teams for AI agents.

Where the Academy fits

Pryme Intelligence Academy's Operator track suits investigators who decide an agent's work daily: modules on how a governed agent decides, human review and when something goes wrong, with tests set in their own industry. Certified Pryme Operator needs a written exam of 40 questions in 60 minutes, passed with at least 32 correct, and a two-week practicum on real decisions signed off by a Pryme assessor.