Financial crime investigators who review an agent's alert work must be onboarded so they never treat the agent's narrative as the decision. The checklist covers access and tipping-off red lines, shadowing on held alert dispositions, reviewer training and exam, a practicum with true and false positives, a drill and sign-off with clear limits on closing alerts.
What does the reviewer decide in financial crime?
The agent in a financial crime team triages transaction monitoring and screening alerts. It gathers the customer's profile, recent activity and prior alerts, compares them with the alert rule, and drafts a disposition narrative recommending closure or escalation. That is depth 1 and 2 work. Some teams let it close a narrow class of clear false positives within bounds at depth 3, with sampling.
Every escalation, every decision on whether activity is suspicious, and every report to the authorities stays with a person. FATF's standard, which most markets follow, expects suspicious transactions to be reported and customers not to be tipped off. That second point shapes the agent's bounds: it must never contact the customer about an investigation, and a reviewer must never approve a customer message the agent drafts that hints at one.
The other risk is the narrative itself. A well-written disposition that recommends closure reads as a decision. New reviewers who approve it without reading the transactions have outsourced the judgement the role exists to provide.
How do you use the checklist?
The head of financial crime or the money laundering reporting officer owns it. Run the stages in order. A new reviewer may not close any alert until stage 5 is signed. The method behind the middle stages is covered in how to train the financial crime team to review AI agent decisions, and the place of this team in the overall training order in the guide to training teams for AI agents.
The checklist
Stage 1: before access 1. Read-only access to the alert queue and the record; no closure rights. 2. Agent capabilities read: profile gathering (1), narrative drafting (2), closure of a defined false-positive class (3, sampled), escalation (held), customer contact (refused during any investigation). 3. Red lines signed: never close an alert without reading the underlying transactions; never approve customer contact on an open case; never let the agent's narrative stand as the reason for a suspicion decision. 4. Confidentiality and tipping-off briefing completed.
Stage 2: shadowing (week 1) 5. Two days with a certified investigator on held dispositions. 6. Seen a recommended closure overturned after reading transactions. 7. Seen an escalation written up by the investigator, not the agent.
Stage 3: training (weeks 1 to 5) 8. Shared foundation complete, test passed. 9. Reviewer modules complete, written exam passed.
Stage 4: practicum (weeks 6 and 7) 10. Two weeks of real held alerts, each confirmed by a buddy. 11. Coverage: a clear false positive, a true positive, a screening near-match and a case relying on an external source such as an adverse media article. 12. Incident drill completed.
Stage 5: sign-off 13. Assessor sign-off; no missed red line. 14. Rights recorded: alert types the reviewer may close; escalation rights. 15. Renewal date set.
Worked example
An illustrative payments business takes on Sample Investigator S from a fraud background. The agent closes alerts for one rule, payments between a customer's own accounts, within bounds and holds everything else.
During shadowing, her buddy overturns a recommended closure on a cash-deposit alert: the narrative said the deposits matched the customer's stated business, but the stated turnover was declared at onboarding and never verified, and the deposits had tripled. The buddy escalates it, writing the reasons in their own words.
In her practicum she decides 75 held alerts. She escalates a screening near-match only after checking the date of birth and nationality, closes it correctly as a false positive, and catches an agent-drafted customer email asking for "source of funds for recent transfers" on a case already escalated. She refuses to send it. Her drill follows how to run an AI agent incident drill for the financial crime team.
How does this compare with credit and risk onboarding?
Credit reviewers decide whether to lend; financial crime reviewers decide whether activity is suspicious, often after the money has moved. Risk reviewers test controls across the business. Compare with the reviewer onboarding checklist for the credit team and the reviewer onboarding checklist for the risk team.
Questions people ask
Should new investigators close alerts during the practicum?
Their decisions are recorded, but a certified buddy confirms each one first. Closures carry regulatory weight, so nothing closes on an uncertified decision alone.
Can the agent ever decide whether to file a suspicious activity report?
No. It can prepare the facts. The decision and the report belong to named people with that responsibility.
How often should financial crime reviewers recalibrate?
Monthly, using recent closures and escalations, and after any change to monitoring rules or the agent's sources.