Anti-money laundering (AML) software: a buyer's guide to AI for AML and KYC

What does AML software cover, end to end?

Anti-money laundering software is not one product. An AML program runs on a chain of tools, and most institutions buy several of them from different vendors. Knowing the whole chain makes it easier to see where AI adds value and where your existing systems should stay in place.

• Customer identification (CIP): collecting identifying information before an account is opened and verifying it within a reasonable time before or after, under rules such as 31 CFR 1020.220 for banks.
• Customer due diligence (CDD) and beneficial ownership: understanding the customer's business and identifying each individual who owns 25 percent or more of a legal entity customer, plus one person with significant control (31 CFR 1010.230).
• Screening: checking customers, counterparties and payments against sanctions lists, politically exposed person data and adverse media.
• Transaction monitoring: scenarios and models that flag unusual activity as alerts.
• Alert review and case management: the investigation that turns an alert into a closed case or a suspicious activity report.
• SAR decision, narrative and filing: the institution's report to FinCEN, with its own deadlines and confidentiality rules.
• Periodic and event-driven review: refreshing customer risk when ownership, activity or news changes.

Where do AML teams lose the most time?

The detection systems are rarely the bottleneck. The time goes into what happens after a flag: an analyst clearing name matches on common names one by one, a KYC team chasing registry extracts and trust deeds across jurisdictions to reach the beneficial owners, an investigator pulling statements, prior alerts and the KYC file into one place, and then writing the narrative from scratch.

Supervisors have signaled that they want resources on the work that matters most. In October 2025, FinCEN, the federal banking agencies and the NCUA published answers to frequently asked questions on SARs, clarifying, for example, that a transaction near the $10,000 currency reporting threshold is not on its own a reason to file, that a separate continuing activity review after every SAR is not required, and that there is no requirement to document a decision not to file. Each of those answers frees investigator time only if the rest of the workflow is efficient too.

How do AI agents help with KYC, CDD and beneficial ownership?

KYC automation software built on AI agents does the reading that stalls onboarding. Agents request missing documents, read IDs, registry extracts, trust deeds, subscription booklets and tax forms in their original languages, unfold the ownership chain through holding companies and trusts to the natural persons above your threshold, run first-pass screening on each party and assemble a risk rating with every input linked to its evidence.

For private banking and wealth, the hardest question is often where the money came from. Source-of-wealth work means reconciling a client's declaration with sale agreements, probate records, tax returns and statements, and showing which part of the wealth is corroborated and which is not. Agents rebuild that history and mark the gaps; the analyst decides whether the explanation is sufficient.

The analyst still approves the file and the risk rating. What changes is that the file arrives complete, every node of the ownership chart carries its source, and periodic reviews can be triggered by a change in ownership or adverse news instead of waiting for a calendar date.

• Investor KYC/AML OnboardingA crew collects, reads, screens and risk-rates investor KYC files and keeps them current
• Source of Wealth VerificationReads source-of-wealth and source-of-funds evidence in any language for private-bank KYC
• Wealth Client OnboardingReads new-account packets, IDs and transfer forms and stops not-in-good-order before submit
• Institutional Client OnboardingRuns a won mandate from IMA, KYC and tax forms to a funded account, for onboarding teams
• LP OnboardingChecks each LP's subscription booklet, KYC papers and tax forms for gaps before the fund closes
• Counterparty OnboardingOpens fund accounts at brokers, FCMs and FX banks with KYC packs and tax forms for onboarding

KYC Compliance Accelerator →Investor services and transfer agency →

How should sanctions screening handle ownership and false positives?

List matching is the easy part of sanctions screening. The harder part is ownership. Under OFAC's 50 Percent Rule, an entity owned 50 percent or more, in the aggregate and directly or indirectly, by one or more blocked persons is itself blocked, whether or not it appears on a list. OFAC's guidance also notes that the rule speaks to ownership, not control, while advising caution with entities in which blocked persons hold significant interests below 50 percent or exercise control. A March 31, 2026 OFAC advisory adds that sham transactions do not end a blocked interest in property: a transfer that only appears to end a blocked person's interest, for example to a family member or close associate, on terms that are not commercially reasonable, or while the blocked person stays involved in managing the property, can leave it blocked, so ownership checks should look at the facts behind a structure, not only its paperwork.

AI helps in two ways. It resolves potential matches using secondary identifiers such as date of birth, nationality, address and registration numbers, and records the reason each hit was discounted. And it reads ownership documents to aggregate interests across owners, which a name-matching engine cannot do. A person confirms every true or possible match and every decision to block or reject.

• Supplier Sanctions ScreeningScreens suppliers and their owners against OFAC, BIS and EU lists with 50% ownership rules
• Marine Sanctions ScreeningA marine solution that screens each vessel, owner, route and cargo for sanctions and war risk.

Third-party risk management →

What can AI do for transaction monitoring alerts and investigations?

Keep your detection scenarios and models where they are; they are tuned to your risk assessment and validated. The opportunity is the investigation that follows each alert. An AI agent can gather the customer's KYC file, expected activity, prior alerts and cases, counterparties and the transactions in question, lay out a timeline, compare the activity with the customer's profile and known typologies, and draft a summary with every statement linked to its record.

The same pattern applies to neighboring surveillance work: reviewing market abuse alerts, reviewing flagged communications in any language, and linking loan and card applications that share phones, devices and addresses to expose synthetic identities. In each case the agent prepares the case and the analyst closes it, escalates it or recommends a SAR, with reasons on the record.

Criminals are using AI as well. FinCEN's November 2024 alert describes fraud schemes that use deepfake images and documents made with generative AI to defeat identity verification, and asks institutions to reference the alert in related SARs. Identity checks and alert reviews should look for those red flags.

• Synthetic Identity Fraud DetectionA fraud solution for card and loan issuers that links applications to expose fake identities.
• Trade SurveillanceReviews market abuse alerts and builds each case from orders, news and chats for compliance
• Electronic Communications SurveillanceReviews flagged emails, chats and calls in any language and closes each alert with reasons
• Vendor Payment Fraud PreventionChecks vendor bank-detail changes and payment requests to stop BEC and impersonation fraud

Can AI write SAR narratives?

AI can draft them well, provided a person owns the result. FinCEN's guidance on SAR narratives asks for a concise, chronological account that answers who, what, when, where and why, and how the activity was conducted. Those answers are already in the case file, which is why a drafted narrative that cites each fact saves an investigator time and lets them check every statement against the case file before anything is filed.

The clock is set by regulation. A bank must generally file a SAR no later than 30 calendar days after it first detects facts that may be a basis for filing; if no suspect was identified on that date, it may take up to 30 more days to identify one, but no more than 60 days in total (31 CFR 1020.320). Drafting faster helps keep cases inside that window.

SAR confidentiality applies to drafts and to the tools that hold them. Access to case data and narratives should be limited to the people who need it, and every view and edit logged. A September 2026 joint statement from FinCEN and the banking agencies also clarifies that a bank may talk to a customer about suspicious transactions or an account closure, as long as it does not reveal the existence of a SAR, so customer communications drafted with AI need the same care.

How Botminds secures your data →

What should AI never decide in an AML program?

The accountability in an AML program sits with named people: the BSA/AML officer, the investigators and the committees that decide on customer relationships. AI should make their work faster and better evidenced, never take their decisions.

• Whether to file a SAR, and what it says when filed.
• Whether a screening hit is a true match, and whether to block or reject a payment.
• Whether to exit a customer relationship or close an account.
• A customer's final risk rating and any exception to policy.
• Any communication with law enforcement or with a customer about suspicious activity.

How do we evaluate AML software and run a pilot?

Model risk expectations still apply to the systems that support your program: the April 2026 interagency model risk guidance (Federal Reserve SR 26-2), which replaced the 2021 statement on model risk for BSA/AML systems, is covered in our guide to AI in banking, so plan to document and test AI tools as you would any other control.

Regulators have also said innovation is welcome. The 2018 joint statement from FinCEN and the federal banking agencies encourages banks to consider innovative approaches to BSA/AML compliance and notes that pilot programs should not, in and of themselves, draw supervisory criticism even if they ultimately prove unsuccessful.

• Pick one workflow with a backlog you measure today, such as entity KYC refresh or alert investigations for one scenario family.
• Run it in parallel with your current process on real cases, including the messy ones, over a fixed window; we suggest six to ten weeks.
• Measure time per case, touch time, completeness of files and narratives against your quality assurance checklist, and every disagreement between the agent's draft and the investigator's decision.
• Have quality assurance sample the agent-assisted cases at a higher rate than usual during the pilot.
• Agree with compliance, model risk, information security and internal audit how the tool will be documented before it goes live.

AI in banking: model risk, third-party and fair lending rules →

A checklist for any vendor

1. Does every finding, match decision and narrative sentence link to its source record?Examiners and your quality assurance team must be able to trace a conclusion to the document or transaction behind it in one click.
2. Which decisions does the system make on its own, if any?The right answer is none that file, block, exit or rate a customer. The agent prepares and recommends; a named person decides, and the record shows who.
3. How are discounted screening hits recorded?Each discounted hit should carry the identifiers compared and the reason, so a reviewer can re-perform the decision later.
4. How does it handle beneficial ownership through trusts, holding companies and foreign registries?Ask for a demo on one of your own complex structures, with documents in their original languages and every node sourced.
5. How is SAR-related data protected?Look for role-based access to case data, a log of every view and edit, encryption in transit and at rest, and deployment options that fit your policy, including on-premises.
6. What will you give our model risk and internal audit teams?Expect documentation of how the agents work, accuracy measured on your cases, ongoing monitoring and the ability to replay any past case.
7. How does it work with our existing monitoring, screening and case systems?AI that sits on top of the systems you already validated is faster to approve than a replacement of your detection engine.

Questions