Compliance officers frequently encounter questions about integrating advanced technologies into their Anti-Money Laundering (AML) programs. These questions arise during vendor demos, model validation meetings, and exam prep sessions. Teams recognize the need for better tools but are unsure how to integrate them without disrupting their existing programs. The $1.3 billion fine imposed on Westpac in 2020 serves as a stark reminder of the high costs associated with gaps in monitoring, governance, and oversight.
Here are six common questions and their answers.
Q1: We have five program pillars. Where does AI actually fit, or does it just bolt onto transaction monitoring?
AI touches all five pillars, but its impact varies. The pillars include a designated compliance officer, internal policies and procedures, employee training, risk assessment and management, and independent audits.
AI is most transformative in risk assessment and policies, where transaction monitoring, identity verification, and Watchlist Screening are key. AI analyzes large data volumes, identifying patterns and anomalies that rules-based systems might miss.
Other pillars change too. Your compliance officer now oversees model governance. Policies must outline how automated decisions are reviewed. Training needs to cover how analysts interpret and challenge model outputs. Independent audits should test the model, not just the alerts it generates.
If AI is only seen as a monitoring upgrade, accountability for the model may be overlooked.
Q2: Will AI really cut our false positives, or is that vendor marketing?
AI can reduce false positives, but treat it as a hypothesis to test, not a guarantee. Models can evaluate more variables than static thresholds, flagging fewer benign transactions and identifying more unusual behavior.
To prove this, run the new model alongside existing scenarios using historical data. Compare flagged transactions, and have senior investigators review differences. Check for alerts the model drops that are needed and alerts it raises that rules missed.
Document your findings. Examiners using the FFIEC BSA/AML Examination Manual will expect evidence that tuning decisions were reasoned and validated, not just that alert volume decreased. Unexplained coverage gaps are a concern, not a success.
Q3: The model flags something and nobody can say why. Can we still file a Suspicious Activity Report (SAR)?
You can file, but there's an upstream issue. A Suspicious Activity Report (SAR) narrative must explain what was suspicious and why, in terms understandable to investigators and regulators. "The model scored it high" isn't sufficient.
Implement these controls:
- Require explainable outputs. Ask vendors which factors influenced each score, and ensure they align with known typologies like Structuring (Smurfing) or rapid fund movement through new accounts.
- Keep the analyst involved. The model prioritizes and enriches, but a human investigator establishes suspicion and writes the narrative.
If a vendor can't provide per-alert reasoning, consider it a validation blocker. Under the Bank Secrecy Act, the obligation to file and support the filing remains with you, regardless of the tool's contents.
Q4: How does identity verification tooling fit with our customer due diligence obligations?
Automated identity verification strengthens your program's front door but doesn't replace it. It quickly confirms customer identities, reducing exposure to identity theft and synthetic identities, supporting your Customer Identification Program obligations under the USA PATRIOT Act.
Your risk-based Customer Due Diligence (CDD) approach must still assess customer risk, apply greater oversight to higher-risk relationships, and monitor continuously. Where beneficial ownership applies, the Corporate Transparency Act framework adds reporting expectations.
For digital identity assurance, align your design with NIST SP 800-63B. If the tool collects biometrics or documents from EU customers, involve privacy early, as the General Data Protection Regulation affects data retention and cross-border processing.
Q5: Our Watchlist Screening is automated already. What's left to improve?
Automation ensures screening runs, but not its quality. Consider these:
- List coverage and refresh. Verify which lists you screen against and how quickly updates reach your system.
- Matching logic. Test name matching across transliterations and aliases with known-positive samples to prevent misses.
- Politically Exposed Person (PEP) handling. Screening hits for a PEP should lead to enhanced due diligence, not just a yes/no decision.
- Disposition records. Document the reasoning for every cleared match.
Test your tuning against applicable standards. The FATF Recommendations set the international baseline, with regional directives like the EU's AML Directives adding requirements. If operating across jurisdictions, ensure your screening configuration reflects the strictest standard or document a risk-based justification for variations.
Q6: What will an independent auditor actually want to see for an AI-driven AML tool?
Auditors will treat the model as a critical control, focusing on governance. Prepare these:
- Model documentation: purpose, inputs, logic at an explainable level, known limitations.
- Validation evidence: parallel run results, sampling methodology, and review details.
- Change control: who can alter thresholds or retrain, who approves changes, and how they're logged. Apply Least Privilege and Role-Based Access Control (RBAC) to model configuration, not just data.
- Ongoing performance monitoring: how you detect drift as customer behavior and typologies change.
- Independence: the auditor shouldn't have helped build the program. This applies to technology reviews as it does to policy reviews.
Also, confirm your vendor's security posture. If the platform handles payment data, your PCI DSS scope may extend to it. If cloud-hosted, review data segregation and protection using the NIST Cybersecurity Framework (CSF) as a reference.
Where to Go for More
Start with the FATF Recommendations for the international baseline, then review regional rules applicable to your footprint, such as the AML Directives in the EU. For US institutions, the FFIEC BSA/AML Examination Manual provides insights into program effectiveness, and the FFIEC IT Examination Handbook covers technology risk and vendor management. If message formats matter to your monitoring data pipeline, review ISO 20022 and ISO 8583 field mappings for clean inputs.
Create an internal checklist from these six questions and evaluate your current stack. Identifying gaps will guide your next budget cycle.
