Requests from a financial intelligence unit carry legal deadlines and tipping-off risk, so the agent works in a closed lane. It confirms the request is genuine, gathers the records asked for, links them to earlier reports, and drafts the response. The nominated officer reviews, decides what is disclosed and sends it. Nobody outside the lane learns the request exists.
What is an FIU request, and who owns the response?
A financial intelligence unit receives suspicious activity reports and analyses them for law enforcement. FATF Recommendations expect FIUs to be able to obtain additional information from reporting firms, and national laws give them powers to request it, often following a report the firm made, sometimes about a customer the firm has never reported. Requests usually specify the subjects, the period, the information wanted and a deadline.
The MLRO or nominated officer owns the response, supported by a small financial crime intelligence team. Access to these requests is tightly restricted because disclosing them, even internally, can amount to tipping off or prejudice an investigation. The process overlaps with, but differs from, responses to police and other authorities, covered in responding to law enforcement information requests.
What does the agent prepare at each step, and at what depth?
- Person, intelligence team: receives and logs the request in the restricted case area. The agent is given access to that case only.
- Agent, depth 1: checks authenticity. That the request arrived through the FIU's known channel, from a known sender format, with a valid reference. Anything unusual goes back to a person to verify by a separate route.
- Agent, depth 1: identifies the subjects. Matches names and identifiers in the request to customers, accounts and linked parties, listing exact matches and possible matches separately.
- Agent, depth 1: links to earlier reports. Any suspicious activity reports, investigations or prior FIU requests concerning the same subjects.
- Agent, depth 1: gathers the requested records. Statements, KYC documents, transaction details and correspondence, for the period and scope asked. Nothing beyond it.
- Agent, depth 2: drafts the response. A covering letter in the format the FIU expects, an index of records, and notes on anything requested but not held.
- Person, nominated officer: reviews. Confirms the subject matches, decides what is disclosed, and considers whether the request reveals activity that needs a new report or an internal review.
- Person, nominated officer: sends through the secure channel and records the submission.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Log | Nothing | None | Logging in the restricted area |
| Authenticity | Checks channel, format, reference | 1 | Verifying anything unusual |
| Subjects | Matches identifiers to customers | 1 | Confirming matches |
| Links | Finds prior reports and cases | 1 | None |
| Records | Gathers within scope | 1 | None |
| Draft | Letter and index | 2 | Disclosure decisions |
| Send | Nothing | None | Nominated officer |
Which controls apply, and what evidence does each leave?
Restricted lane. The agent working on FIU requests is separate from any agent that talks to customers or front-line staff, and its access is limited to the restricted case area. Evidence: role separation in the agent inventory and the access configuration.
Scope matched to the request. Records gathered match the subjects, period and types requested. Evidence: an index that maps every record to an item in the request.
Possible matches handled carefully. A possible match is not disclosed as a match. Evidence: the officer's decision on each.
Deadline tracked. Evidence: received date, deadline and submission date.
No freeze on routine processes without a decision. Receiving a request does not by itself mean an account should be restricted. If the officer decides on any action, it is recorded separately. Evidence: the decision record.
Retention respected. Records disclosed and the request itself are kept under the restricted retention rules. Where a customer later asks for their data to be erased, the request and related records must not be destroyed; handling erasure requests relies on a hold check that should include FIU matters.
What should you measure?
- Responses sent by the deadline.
- Subject-matching errors found by the officer.
- Records requested but not held, which may show gaps in record-keeping.
- Requests that led to an internal review or a new report.
- Time from receipt to draft, which frees the officer's time for the judgement.
- Possible matches the officer rejected, which shows whether the agent's matching is too loose for this kind of request.
Where does it usually go wrong?
Internal tipping-off. Asking the relationship manager for documents tells them the customer is of interest. The agent gathers from systems directly, so fewer people need to know.
Treating the request as a conclusion. An FIU request is a request for information, not a finding. The officer should consider it as intelligence, not proof.
Over-disclosure. Sending everything held about a customer, including unrelated accounts or family members, beyond what was asked. Scope discipline protects customers and the firm. Where the officer judges more should be shared, that is a separate, recorded decision.
Fake requests. Fraudsters impersonate authorities to obtain customer data. Authenticity checks through known channels are essential; the agent should never treat an email address alone as proof.
No feedback loop. A request about a customer the firm never reported may show a gap in monitoring. Feed it back to the monitoring team in general terms, without revealing the request.
The boundary for agents dealing with authorities generally is in whether an AI agent can respond to a law enforcement request. The overall stance on compliance agents is in AI compliance agents.
Questions people ask
Can the agent respond to the FIU directly?
No. Responses to authorities are formal disclosures with legal consequences. The nominated officer sends them.
Should the request trigger a new suspicious activity report?
Not automatically. The officer should consider whether the request, together with what the firm knows, gives grounds for suspicion, and record the decision either way.
What if the request is unclear or very broad?
The agent drafts a note of the ambiguities. The officer decides whether to clarify scope with the FIU, which is a conversation a person should have.