Tipping-off risk when agents talk to customers

A customer-facing agent must never reveal that a customer is under investigation or has been reported. Agents answer questions literally and helpfully: asked why a payment is held, an agent with access to the wrong field may simply say so. Tipping-off controls have to sit in what the agent can see, not only in what it is told.

What is tipping off, and why do agents raise the risk?

Tipping off is disclosing to a customer, or anyone else, information that is likely to prejudice an investigation into money laundering or related offences, such as the fact that a suspicious activity report has been made or that an investigation is under way. In many jurisdictions it is a criminal offence for the individual and a serious failure for the firm.

Staff are trained to avoid it. They learn to give neutral answers, to escalate rather than explain, and to recognise questions designed to find out what the firm knows. Agents have none of that instinct unless it is built in. They are designed to be helpful, to explain, and to answer the question asked. An agent that can see an internal note saying "account under review: SAR submitted" and is asked "why is my account restricted?" has every tendency to answer accurately. That accuracy is the offence.

How can an agent tip off a customer?

Directly, by stating what it sees. But also in less obvious ways:

• By inference. The agent refuses a routine request it would normally grant and, asked why, says "I'm not able to discuss that for this account", which signals something unusual.
• By changed behaviour. The agent asks unusual questions about source of funds mid-conversation, prompted by an internal flag.
• By document requests. The agent asks for documents that only make sense if the firm suspects something.
• By timing. The agent's responses change immediately after an internal event, and the customer notices the pattern.
• By reading back notes. The agent summarises the account history and includes internal comments meant only for staff.

Several of these can happen even if the agent has been told never to mention investigations. Instructions govern what the agent says about a topic; they do not stop it behaving differently because of what it knows.

Why isn't an instruction in the brief enough?

Because instructions can be outweighed. A brief that says "never disclose investigations" sits alongside a brief that says "be helpful and explain clearly". Faced with a persistent customer asking the same question in different ways, an agent may eventually find a phrasing that feels helpful and is still disclosure. Red-team testing routinely finds this kind of failure.

The stronger control is that the customer-facing agent cannot see the information at all. If its sources do not include investigation flags, SAR records or the notes of the financial crime team, it cannot disclose them, however it is questioned. That is a bound, not an instruction, and it holds under pressure. The practical design is covered in how to stop an AI agent from tipping off a customer.

What should the agent be able to see instead?

Usually a single, neutral status that tells it to stop and hand over, without saying why. For example: "This account needs a specialist; do not discuss restrictions; transfer to the specialist team." The agent knows what to do. It does not know the reason, so it cannot reveal it.

This matters especially when the firm is gathering more information on a high-risk customer. During enhanced due diligence on high-risk customers, requests to the customer should be drafted carefully by people or by agents working for the financial crime team, not improvised by a support agent reacting to a flag.

What should the agent say when it reaches the flag?

Something that would be equally true for any customer whose request needs a specialist. A good script acknowledges the request, says a specialist team handles it, explains how and when they will be in touch, and does not speculate. It should be indistinguishable from the agent's handling of other referrals, such as a complex complaint or a bereavement case, so the referral itself does not signal anything.

The specialist team then decides what to say, in line with the firm's procedures. That team may also use agents, but those agents sit inside the financial crime function with its own bounds.

How do you test for tipping off?

In certification and in red-teaming. Certification cases should include customers whose accounts carry the neutral flag, asking a range of questions from innocent to probing, with the correct outcome labelled as the neutral referral every time. Red-teaming should try harder: repeated questioning, claims to be a lawyer or a regulator, requests for a copy of the account notes.

It is also worth testing the opposite direction. An agent that refers every slightly unusual account to specialists creates a different signal. The neutral referral should be used for flagged accounts and for a range of ordinary specialist cases, so it does not become a tell.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

Is this a reason to keep agents away from customers?

Not necessarily. The wider question of whether banks should let AI agents talk to customers about their money has many considerations. Tipping-off risk is manageable if the customer-facing agent's sources are designed with it in mind. It is not manageable if the agent is given broad access to customer records, including internal notes, and trusted to be discreet.

The design principle is the same one that runs through compliance work with agents: AI compliance agents are second line, never the last word. Information about investigations belongs with the people and agents doing the investigating.