How to prepare MLRO management information with an AI agent

MLRO management information should tell the MLRO, and through them the board, whether the firm's financial crime controls are working. The agent pulls the metrics from each system, reconciles them, explains every material movement and drafts the commentary. The MLRO decides what the numbers mean, adds their view of risk and signs the report.

What is MLRO MI, and who owns it?

The money laundering reporting officer, or the equivalent nominated officer in other markets, is accountable for the firm's anti-money laundering and counter-terrorist financing framework. They rely on regular management information: onboarding and KYC volumes and backlogs, periodic review completion, screening alert volumes and outcomes, transaction monitoring alerts and case ages, suspicious activity reports filed, exits, training completion, open audit findings and regulatory matters. The MLRO's annual report to the board is built on the same data.

The MLRO owns the MI and its message. Financial crime operations, technology and data teams own the underlying systems. The MI is often assembled by hand from exports, with definitions that shift between months. An agent can make it consistent. Its role is close to that of an agent preparing management accounts: accurate assembly and explanation, with the judgement left to the accountable person.

What are the steps?

1. Person, MLRO: approves the metric definitions. Each metric's source, calculation, threshold and owner, in a data dictionary.
2. Agent, depth 1: extracts the data from each system of record at the period end.
3. Agent, depth 1: calculates the metrics exactly as defined, and records the extract and calculation for each.
4. Agent, depth 1: reconciles. Totals that should agree across systems, such as alerts escalated against cases opened, and movements against the previous period.
5. Agent, depth 1: explains movements. For each metric that crossed a threshold or moved materially, the drivers visible in the data: a new rule, a backlog, a change in customer mix, a system outage.
6. Agent, depth 2: drafts the MI pack and commentary. Metrics, red-amber-green ratings against approved thresholds, explanations, and the questions the data raises.
7. Person, metric owners: confirm their explanations.
8. Person, MLRO: adds their assessment of the risk position and the actions needed, and signs the pack.
9. Agent, depth 1: tracks the actions the MLRO sets, and reports progress next period.

Which controls apply, and what evidence does each leave?

Definitions under change control. A metric whose definition changes must say so, with the old and new figures for the change period. Evidence: the data dictionary version on each pack.

Reproducible calculations. Every figure can be recalculated from its extract. Evidence: extracts and calculation records kept with the pack. These are also exactly what you need when assembling evidence for a regulator information request.

Reconciliation breaks reported, not smoothed. A break between two systems is a finding, not a rounding problem. Evidence: the reconciliation report.

Explanations confirmed by owners. The agent's explanation of a movement is a hypothesis from the data. Evidence: owner confirmation or correction.

MLRO's view distinct. The pack separates the data and its explanation from the MLRO's own assessment. Evidence: a signed assessment section.

What should you measure?

• Pack delivered within the agreed days after period end.
• Reconciliation breaks per period, and how many recur.
• Explanations corrected by owners.
• Questions from the board or committee that the pack should have answered.
• Restatements of previous periods.

Where does it usually go wrong?

Volume without outcome. Alert counts and cases opened say how busy teams are, not whether controls work. Include outcome measures: alerts that led to reports, reports the authorities followed up where you know, true matches found, backlogs by age.

Backlogs hidden in averages. An average case age looks fine while a few cases are very old. Show distributions or the oldest items.

Thresholds never revisited. Ratings stay green because thresholds were set generously. The MLRO should review thresholds against risk appetite at least once a year, and whenever the business changes materially, such as a new product or market. The agent can show how often each metric has sat near its threshold, which helps the review.

MI that cannot answer a regulator. If the supervisor asks for the same data, it should come from the same calculations. See whether an agent can answer regulator information requests.

Agent-produced work counted as human work. Where agents draft alert summaries or case files, a fall in analyst hours per alert can look like efficiency while quality slips. Report draft acceptance rates and QA results alongside productivity, so the MLRO sees both sides.

Explanations that become excuses. An agent that always finds a benign driver for a worsening metric, such as seasonal volume, teaches readers to ignore movements. Owners must confirm each explanation, and the MLRO should see unconfirmed ones marked as such.

Market differences flattened. Groups with entities in several countries need MI per entity, because obligations and regulators differ. Our briefs on wealth management compliance in Australia and in India show how expectations vary.

The overall stance on compliance agents is in AI compliance agents.