An AML investigator should learn exactly where the agent’s work ends and their own judgement begins. That means understanding depth at each stage of a case, how to read the provenance of every fact the agent gathers, which decisions are always held for a person, and how to review a drafted narrative as critically as a junior colleague’s.
How does an agent fit into the life of a case?
Stage by stage, at different depths.
| Stage | What the agent does | Depth | The investigator’s part |
|---|---|---|---|
| Alert triage | Gathers transactions, customer profile, prior alerts | 1, read | Decides priority |
| Case building | Assembles timeline, counterparties, links between accounts | 2, draft | Tests the picture, asks for more |
| Narrative | Drafts the case summary and reasons | 2, draft | Rewrites, owns conclusions |
| Routine closure | Closes alerts matching pre-agreed benign patterns, where policy allows | 3, within bounds | Samples closures |
| Reporting decision | Drafts the suspicious activity report | Held | Investigator or reporting officer decides |
Depth is earned, not configured. An agent reaches depth 3 on routine closures only after certification on the firm’s own past alerts, and loses it if a run falls short of depth 3: a run that clears no depth drops the agent to depth 1 the same day, and certificates lapse after 90 days anyway. Investigators should know which stages are automated today and which come back to them if certification drops.
Why does provenance matter so much in AML?
Because investigations turn on how far each fact can be trusted. Every fact reaching a governed agent carries one of four classes:
- Sealed: from the system of record, such as the core ledger or payment rail. Transaction data is usually sealed.
- Signed: a named party answers for it, such as a verified registry extract.
- Declared: stated by the customer, such as the source of funds explanation on an onboarding form.
- External: from outside, such as adverse media or an emailed invoice supplied as justification.
An agent’s draft may say “funds explained as proceeds of property sale”. The investigator needs to see that this rests on a declared statement and an external document, not on anything sealed. That is the difference between an explanation and evidence.
What decisions are always held for a person?
Whether to report. Whether to exit a customer relationship. Whether to restrict or release funds. What, if anything, to say to the customer. These carry legal weight under AML rules, which follow the FATF risk-based approach and require suspicious transaction reporting, and they involve judgement about intent that no agent should hold.
The agent can prepare each decision well. It cannot make it.
How should an investigator review a drafted narrative?
As a sceptic. Agents write fluent summaries, and fluency can hide gaps. Four checks help:
- Trace each claim to a fact. Every sentence should rest on a fact the investigator can open, with its source class visible.
- Look for what is missing. Did the agent check related accounts, prior alerts, other products?
- Test the alternative. What innocent explanation fits the same facts? What criminal one?
- Rewrite the conclusion yourself. The narrative’s reasoning is the investigator’s, in their own words.
Corrections should be noted. If the agent repeatedly misses linked accounts, its sources or brief need fixing before its next certification.
What does a working week look like after go-live?
Take an investigator at a mid-sized payments firm. Triage that used to take the first morning of the week is done when they log in: alerts are ranked, each with a gathered profile. They spend Monday on three complex cases with draft timelines already built, rewriting two narratives and sending one back to the agent with requests for more counterparties. On Wednesday they sample twenty routine closures from the record and find one that should have been escalated, which goes to the agent owner.
How do other roles compare, and where do market rules come in?
Credit-facing roles face similar questions about declared facts; see what underwriters should learn first and what collections agents should learn first. Local regulators shape the detail: compare AML investigator training in Australian payments and in Canada. Why the investigator is the safeguard is argued in why AML investigators are the real control. The overview is in AI agent skills by role.
Where the Academy fits
AML investigators who review agent work daily fit the Operator track of Pryme Intelligence Academy, with module tests set in their own industry and role. Lessons can be read or listened to, with highlights and notes, and every lab runs in a free Build workspace. Certified Pryme Operator requires a written exam and a two-week practicum assessed by Pryme.
Questions people ask
Can the agent decide that an alert is a false positive?
Only for patterns the firm has pre-agreed as benign, within limits, and only once certified. Everything else is held.
Will agents see data investigators cannot?
They should see the same sources, scoped to the case. Investigators should be able to open every fact the agent used.
Should investigators trust adverse media the agent finds?
Treat it as external: a lead to check, not a finding.