The gathering shrinks and the judging grows. An AML investigator used to spend most of a case pulling transaction histories, customer files and open-source searches into one place. With an agent assembling the file and drafting the narrative, the investigator's day is spent testing that evidence, deciding whether activity is suspicious, and owning the reasons. Suspicion remains a human call.
What did an investigator's day look like before?
For each alert or referral, an investigator would typically:
- export the customer's transactions for the review period and sort them;
- read the customer due diligence file and any previous alerts;
- search for adverse media and connected parties;
- map counterparties and flows;
- write a narrative and a recommendation;
- for suspicious cases, prepare a report for the nominated officer.
A large share of the time went on the first four steps, before any judgement was made.
What does the agent take on?
| Task | Who | Depth |
|---|---|---|
| Assembling transactions, customer file and previous alerts | Agent | 1 |
| Adverse media and connected-party searches | Agent | 1 |
| Drafting a case narrative and flow summary | Agent | 2 |
| Closing alerts that meet the firm's documented false-positive criteria | Agent, where the firm's limits allow | 3 |
| Deciding whether activity is suspicious | Investigator | stays with a person |
| Deciding to submit a suspicious activity report | Nominated officer | stays with a person |
Every fact in the file carries its provenance. Transactions from the firm's own ledger are sealed. Customer due diligence documents verified through an identity service are signed. A customer's stated source of funds is declared. A news article is external. The investigator's job starts by knowing which is which.
What fills the investigator's day now?
Testing the file. Is the review period right? Are all accounts included, including ones held by connected parties? Did the agent miss a counterparty?
Testing the narrative. The agent's draft reads well, which is a risk. Check that every claim in it traces to evidence in the file, and that the explanation the customer gave has been tested against the transactions.
Deciding. Is there a reasonable basis for suspicion? That judgement, and the reasons for it, belong to the investigator.
Reviewing closures. If the agent closes clear false positives at depth 3, the investigator or a team lead reviews a sample, because a wrongly closed alert is invisible otherwise.
Watching for tipping off. Any customer contact the agent drafts during an investigation must be checked for anything that could alert the customer. In most firms, the agent's role scope excludes contacting a customer under investigation at all.
A day in practice
Take a payments firm's investigations team. An investigator opens a case on a small business account receiving many small transfers from unrelated individuals, then sending larger amounts abroad. The agent has assembled six months of transactions, the onboarding file and two previous alerts, and drafted a narrative suggesting the pattern is consistent with the customer's declared business of selling goods online.
The investigator checks the onboarding file. The declared turnover is a fraction of what is passing through. The website named at onboarding, found by the agent and stamped external, has not been updated since the account opened. She rejects the agent's conclusion, records her reasons, and recommends a report to the nominated officer. She also records a correction: the agent's brief should compare actual flows against declared turnover before drafting any conclusion. Later that day, she samples ten alerts the agent closed and finds them sound.
What new skills does an investigator need?
Reading provenance and weighting evidence by it. Spotting a fluent narrative that outruns the evidence. Writing reasons for suspicion that a nominated officer and, later, a regulator can follow. Recognising when repeated corrections mean the agent's brief needs changing. And knowing which decisions the firm's limits keep with people, under a risk-based approach built on the FATF Recommendations.
The same shift from preparing to judging is happening in neighbouring roles; compare what changes in a collections agent's day. Getting a new investigator ready is covered in how to onboard a new AML investigator to an agent workspace. Market rules shape the detail, as AML investigator training in payments in Japan shows. For every role, see AI agent skills by role.
Where the Academy fits
Pryme Intelligence Academy's Operator track covers how a governed agent decides, human review and when something goes wrong, with module tests set in the learner's own industry and role, so investigators work through financial crime cases. The Certified Pryme Operator practicum is two weeks of real review decisions with no missed red line, signed off by a Pryme assessor.
Questions people ask
Can an agent decide a case is suspicious?
It can draft a view. The decision that there is suspicion, and the decision to report, stay with named people.
Should investigators read the agent's narrative first?
On complex cases, review the evidence before the narrative to avoid anchoring on a confident draft.
What happens if the agent closes an alert wrongly?
Reopen it, record the correction and the reason, and review the closure criteria with the process owner.