Preparation is everything an investigator does before they can start thinking. The agent takes that part: it pulls alerts, transactions, due diligence, linked parties and open-source findings into one file, builds a timeline and counterparty network, and drafts the investigation plan. The investigator judges the activity, and any restriction or report is approved by a named person.
What is an AML case investigation, and who owns it?
When an alert, a referral or an intelligence request suggests possible money laundering, the case is escalated from alert review to investigation. The investigator examines the customer's activity in depth, looks for explanations, gathers evidence and reaches a view on whether suspicion is established. The outcome may be no further action, enhanced monitoring, an exit, or a suspicious activity report. What AML is covers the wider framework, built on the FATF Recommendations.
Financial crime investigators own cases, reporting to the MLRO. Most investigators spend a large part of each case collecting rather than analysing. That collection is what the agent does. The question of whether it can go further is in whether an AI agent can investigate an AML case.
What does the agent prepare, and what does a person approve?
- Person, investigation lead: opens and assigns the case.
- Agent, depth 1: gathers the core file. All alerts on the customer and linked accounts, transactions for the investigation period, the KYC file, risk rating history, prior cases and reports, and account notes. The work happens inside the case system as described in letting an agent build case files.
- Agent, depth 1: builds the counterparty network. Who the customer pays and receives from, how often and how much, with links to other customers and to prior cases.
- Agent, depth 1: builds the timeline. Account opening, profile changes, alerts, unusual transactions and contacts, in order.
- Agent, depth 1: runs open-source and screening checks on the customer and key counterparties, marking all findings as external.
- Agent, depth 2: drafts the investigation plan. Questions the evidence raises, information still needed, and the typologies that might fit, each with the evidence that suggests it.
- Person, investigator: investigates. Tests explanations, requests information, reaches a view.
- Person, investigator: proposes outcome; the MLRO or delegate approves reports, exits and restrictions.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Open | Nothing | None | Assigning the case |
| Core file | Gathers alerts, transactions, KYC | 1 | None |
| Network | Maps counterparties and links | 1 | Judging significance |
| Timeline | Orders events with sources | 1 | Correcting it |
| Open source | Runs searches, marks as external | 1 | Weighing findings |
| Plan | Drafts questions and typologies | 2 | Directing the investigation |
| Outcome | Nothing | None | Investigator and MLRO |
Which controls apply, and what evidence does each leave?
No contact with the subject. The preparing agent has no capability to message the customer or counterparties. Evidence: its capability list. This is the main tipping-off control.
No restrictive actions. Freezing or restricting an account is a serious step with legal implications. Whether an agent can freeze an account on AML grounds explains why this remains a person's decision. Evidence: freeze capability absent from the agent's role.
Provenance on everything. Ledger data is a record; a news article is an external claim; a customer's explanation in a call note is declared. Evidence: each item in the file is labelled, and the investigator can weigh them accordingly.
Typologies as hypotheses. The plan lists possible typologies and the evidence for and against each. It does not conclude. Evidence: the plan beside the investigator's final reasoning.
Period and scope stated. The file states the investigation period and which accounts are in scope. Evidence: a clear boundary for what was examined.
What should you measure?
- Investigator hours per case, split between collection and analysis.
- Evidence investigators added that the agent missed.
- Cases where the network revealed links the investigator would not otherwise have found.
- Case age, the backlog measure the MLRO watches.
- QA findings on prepared cases.
Where does it usually go wrong?
Networks that are too big. A customer who pays a utility company is linked to millions of others. The network needs filters for common counterparties, or it shows everything and means nothing.
Open-source findings treated as facts. A news report naming someone with a similar name is not evidence about your customer. External findings need matching on more than a name, and the investigator must judge them.
Typology confirmation bias. If the plan suggests one typology strongly, the investigator may look only for evidence that fits it. List alternatives, including innocent ones.
Stale KYC. The customer file was last refreshed years ago, and the investigation judges activity against an old profile. The agent should state the profile's age and flag the case for a KYC refresh, so the investigator knows how much weight the profile can bear.
Case system access too broad. The preparing agent reads only what the case needs. The connection itself is set out in connecting an agent to your case management system.
The stance on compliance agents overall is in AI compliance agents.
Where Pryme fits
In Pryme, the preparing agent reads ledger data as sealed, registry and screening results as signed, customer statements as declared and news as external, and the file shows that grading on every item. Messaging the subject and restricting the account are outside its role scope; attempts are refused and filed. The agent is certified on the firm's own past cases before it runs.
Questions people ask
Can the agent recommend whether a case should be reported?
It can set out the indicators present and absent. The recommendation is the investigator's, and the decision the nominated officer's.
How far back should the agent look?
The investigation lead sets the period based on the trigger. The agent should flag anything just outside the period that looks relevant, without widening the scope on its own.
Should one agent prepare cases and another draft reports?
They can be the same agent if its capabilities are scoped to both and neither involves contacting the customer. Separating them makes it simpler to certify and review each.