The question at hand
In 2025, the US lost $658.43 billion to money laundering, equivalent to 2.14% of GDP, according to Napier AI. This isn't a minor issue; it's a systemic failure that forces every AML compliance officer to ask: what's actually working?
The debate isn't whether to modernize your AML program. It's how. One side argues that artificial intelligence and machine learning are the only scalable paths forward. The other insists that experienced human analysts are irreplaceable and that automation creates as many problems as it solves. Both sides have practitioners who can point to real results.
This isn't an academic question. Your executive team wants to know why you're requesting budget for either headcount or technology. Your regulators want effective transaction monitoring regardless of the method. And your institution's risk exposure grows while you're deciding.
The case for AI-driven AML
The numbers make the AI argument compelling. Traditional rule-based systems generate false positive rates between 95% and 99%, meaning your analysts spend their days clearing alerts that were never suspicious. Machine learning models can reduce that noise by identifying patterns that static rules miss.
AI proponents highlight specific capabilities that humans can't match at scale. Unsupervised learning algorithms detect anomalies in transaction behavior without predefined rules. Network analysis maps relationships across millions of entities to surface structuring schemes. Natural language processing reads unstructured data in SARs and adverse media that would take analysts weeks to review manually.
The regulatory environment supports this view. FinCEN encourages financial institutions to implement innovative approaches, including AI, to improve their AML programs. The FFIEC BSA/AML Examination Manual acknowledges that technology-driven risk assessment can enhance compliance effectiveness.
Speed matters too. When you're monitoring real-time payment flows, a model that scores transactions in milliseconds lets you block suspicious activity before funds move. Human review happens after the fact, when recovery becomes exponentially harder.
The case for human-centered AML
Experienced AML analysts argue that context requires judgment that algorithms don't have. A wire transfer pattern might look suspicious in isolation but makes sense when you know the customer operates a seasonal business. Machine learning models trained on historical data will flag activity that deviates from the norm, but "unusual" isn't the same as "criminal."
The false negative problem worries this camp more than false positives. AI systems fail in predictable ways. They struggle with novel typologies they weren't trained to recognize. They can't read between the lines of a customer explanation or notice that a business owner seems evasive during account opening. They don't pick up on the investigator's instinct that something's wrong even when the data points look clean.
Regulatory risk cuts both ways. Yes, FinCEN encourages innovation, but examiners still expect you to document your model's logic and validate its effectiveness. When your AI blocks a legitimate customer transaction, can you explain why? When it misses a structuring scheme, can you demonstrate that your governance framework was sound? The Bank Secrecy Act doesn't provide a safe harbor for algorithmic mistakes.
Human analysts also adapt faster than models. When a new money laundering technique emerges, your team can adjust their investigation approach immediately. Retraining and validating an AI system takes months. During that window, you're exposed.
Where practitioners actually land
Most institutions aren't choosing one approach over the other. They're trying to figure out the right division of labor.
The pattern that's emerging: use AI to handle volume and surface risk, then route findings to human analysts for investigation and SAR filing decisions. Machine learning models score transactions and generate alerts. Network analysis identifies suspicious relationship patterns. But humans make the final call on whether to file, what to include in the narrative, and whether to exit the customer relationship.
This hybrid model addresses the practical reality that you can't hire enough analysts to manually review every transaction, but you also can't defend a fully automated system that files SARs without human judgment. The question becomes: where do you draw the line between automated screening and human review?
Your answer depends on your institution's risk profile, transaction volume, and regulatory expectations. A regional bank processing 50,000 monthly transactions has different needs than a fintech handling 50 million. But both need to demonstrate effective monitoring under the Bank Secrecy Act.
Our take
The AI versus human framing misses the actual problem. Your AML program's effectiveness isn't determined by which technology you deploy. It's determined by whether you can demonstrate to examiners that you're detecting and reporting suspicious activity consistent with your risk assessment.
Start there. What money laundering typologies is your institution actually exposed to? Trade-based money laundering requires different detection capabilities than structuring. If you're primarily concerned with Politically Exposed Persons moving funds through shell companies, your screening approach looks different than if you're worried about synthetic identity fraud.
Then ask: what's your current detection rate? Not your alert volume. Not your SAR filing count. How many of the suspicious patterns you're designed to catch are you actually catching? If you don't know, your choice between AI and human analysts is premature.
AI makes sense when you have clear patterns to detect at scale. Human expertise matters when you need contextual judgment and adaptability. Most programs need both, but the ratio depends on your specific risk exposure and operational constraints.
The $658.43 billion lost to money laundering in 2025 didn't happen because institutions chose the wrong monitoring technology. It happened because detection programs, regardless of their approach, failed to identify criminal activity that regulatory frameworks require them to catch. Fix that problem first. The implementation method follows from the answer.
