Agentic AI for transaction monitoring: one alert, every step traced

Agentic AI for transaction monitoring is software that works an alert the way a Level 1 analyst does: it opens the customer's profile, the account history, the counterparties and the earlier alerts, answers the questions the procedure asks, and drafts a disposition with its reasons. What makes it agentic is that it takes these steps itself, across several systems, rather than scoring a transaction or answering one prompt. What makes it safe to use in a bank is everything around it: limits on what each agent may touch, a second agent that argues the other side, a person who decides, and a trace of every step. Botminds' AML Alert Triage runs seven agents on that design, and the alert below is followed through all of them.

The design is not a matter of taste. In April 2026 the federal banking agencies revised their model risk guidance and left generative and agentic AI outside its scope, because both are new and still changing fast (OCC Bulletin 2026-13; Federal Reserve SR 26-2). No supervisory framework yet tells a bank how to validate an agent. Until one does, the evidence that an agent behaved is whatever the bank can replay.

What is agentic AI in AML compliance?

In AML compliance, agentic AI means software agents that carry out a multi-step task, such as researching an alert, by choosing which systems to query, reading the results and producing a work product a person reviews. It sits after detection. The monitoring system still decides which transactions alert; the agents work the alert queue the system produces.

That separates it from the two kinds of AI banks already run in monitoring. Machine-learning scores rank or filter alerts, which the FFIEC has long recognised as intelligent systems that "are adaptive and can filter transactions, based on historical account activity or compare customer activity against a pre-established peer group" (FFIEC BSA/AML Examination Manual). Generative assistants summarise and draft. Treasury's 2024 review of AI in financial services heard from respondents already using generative AI beside their investigation platforms to gather and summarise case data and to automate the writing and filing of reports (US Treasury, December 2024). An agent combines the two jobs and adds the one that takes an analyst the longest: going and getting the facts.

One alert, step by step: what the trace of a disposition contains

The flow above is one alert from Botminds' sample data. Take the sample bank's Tuesday as the example: alert 26-0914-118233 fired overnight on Fenwick Auto Body LLC, a collision repair shop and a customer since 2014. The alert reader took about a second to state what fired. The investigating agent then answered three questions, each in about a second and a half, and each with its sources: the inflow sat inside the $35,000 to $60,000 a month the profile expects from insurers and 3% above the 11-month average; all four counterparties were known and paid in at least 11 of the last 12 months, none on a watch list, the latest 314(a) list or a sanctions list; and the same pattern had alerted four times before, each closed.

Every one of those statements carries a citation to a passage in a system of record, and every answer carries a confidence: 97%, 98% and 96% on this alert. The agent drafted a closure under the bank's reason code C-03, "activity consistent with the customer's business". The challenger then ran its seven checks: new counterparties, round or just-below-threshold amounts, cash, geography, speed against the usual pattern, a change of owner, links to escalated alerts, cases or the 314(a) list. It found nothing and signed off. Only then did the alert reach the analyst with a proposal on it.

The brief the analyst opens, with the agents' steps on the right

The trace is not decoration. It is how a quality-control analyst, an auditor or an examiner reconstructs why an alert was closed without re-running the investigation. Every action by people and agents is kept with who, what, when, why and which evidence, for five years, the BSA's general retention period (31 CFR 1010.430).

Can AI close AML alerts? Where the decision stays

The BSA rules do not say who must close an alert, but the bank answers for every closure, and in Botminds' AML Alert Triage no agent closes one. A named Level 1 analyst closes or escalates every alert, QC can reopen any closure, and Level 2 accepts every escalation. The agents propose.

The reasoning is about accountability rather than capability. The SAR rule makes the bank responsible when it knows, suspects, or has reason to suspect that a transaction is reportable (31 CFR 1020.320). The FFIEC expects a defined escalation path from detection to disposition, and expects the bank's procedures to name who makes the final call on filing a SAR, one person or a committee (FFIEC manual). A system that closed alerts on its own would itself be a control the bank had to test and defend, and with agentic AI out of scope of the model guidance, there is no agreed method for doing so.

Keeping a person on every alert does not mean keeping the old pace. In the sample, alerts with the same scenario, reason code and evidence are grouped into a like-alert batch of up to 25 that the analyst signs together after opening any brief she wants. Each alert keeps its own rationale and record, an alert the challenger questioned is never batched, and QC samples 20% of batch-signed closures.

Is agentic AI a model under the 2026 model risk guidance?

No, and that is a gap to manage rather than a pass. The revised guidance of April 17, 2026 leaves out of its model definition fixed rule-based software with no statistical, economic or financial theory behind it, puts generative and agentic AI outside its scope altogether, and says it matters most to banking organizations above $30 billion in total assets (OCC Bulletin 2026-13). The guide to customer risk rating models works through what the new definition covers.

The same letters rescinded the 2021 interagency statement on model risk for BSA/AML systems (SR 26-2), and the agencies said a request for information on banks' use of AI, generative and agentic AI included, would follow soon. As of late October 2026 that request had not been published. A bank deploying agents today therefore writes its own controls, and the sensible template is the one it already applies to anything that influences a regulatory decision: a defined purpose, versioned configuration, testing against known outcomes, monitoring after go-live and a named owner.

The Wolfsberg Group's five principles for AI and machine learning in financial crime compliance put the same idea in standards language: legitimate purpose, proportionate use, design and technical expertise, accountability and oversight, openness and transparency. They ask institutions to validate how AI is used and configured on a regular cycle, and to keep watching after go-live that it performs consistently (Wolfsberg Principles, 2022). Treasury's voluntary Financial Services AI Risk Management Framework, released in February 2026, adapts the NIST framework to banks large and small (US Treasury, February 2026).

Do regulators allow AI in transaction monitoring?

Yes. Federal supervisors have said since 2018 that they encourage it, on conditions. Under the joint statement of December 2018, an AI-based monitoring system that finds suspicious activity the bank's existing process missed is not, by itself, taken as proof that the existing process was deficient; the agencies judge that process on its own merits, apart from the pilot's results (Joint Statement on Innovative Efforts, 2018). A pilot that fails is not in itself grounds for criticism, as the guide to piloting SAR narrative drafting sets out, and one that exposes a gap is protected too, in the words set out below.

The same statement sets the condition: "bank management should prudently evaluate whether, and at what point, innovative approaches may be considered sufficiently developed to replace or augment existing BSA/AML processes." FinCEN's April 2026 proposal would go further: it lists machine learning and generative AI among innovative approaches, and says an institution that experiments with them responsibly takes on no extra risk of supervisory or enforcement action merely for using them (FinCEN, 91 FR 18704). That text is a proposal; comments closed on June 9, 2026 and no final rule had been published by late October, as the guide to the proposed program rule explains.

The practitioners interviewed in a 2024 peer-reviewed study were blunt about what wins regulators over. Asked to rate five features of a new monitoring method, eight AML specialists gave explainability the highest average score, 9.1 out of 10, above scalability and detection speed; one said "if there are any regulatory or audit issues, you've got to be able to explain your method" (Oztas et al., Future Generation Computer Systems, 2024).

Pilot programs that expose gaps in a BSA/AML compliance program will not necessarily result in supervisory action with respect to that program.

Joint Statement on Innovative Efforts to Combat Money Laundering and Terrorist Financing, 2018

Why a second agent argues for escalation before any closure

A single agent that drafts closures will tend to find what it was asked to find. The challenger exists to break that tendency: it reads the same sources on a separate model family, looks only for reasons to escalate, cannot be switched off, and never proposes a closure itself. If it disagrees, the investigating agent's draft is withheld and escalation is proposed instead.

In the sample queue the challenger earns its place on Pellham Logistics. The investigating agent drafted a closure at 74% confidence, below the 85% bar, and the challenger found that counterparty 3, Sarvan Trading LLC, had received an $18,400 wire into an account opened 41 days earlier, at an address shared with two parties escalated in July. The draft was withheld; escalation under the bank's reason code E-02, "new or unexplained counterparty", was proposed at 91%.

When the challenger disagrees, no closure is proposed

What an auditor should be able to replay from an AI alert disposition

An AI-assisted disposition is auditable when someone who was not there can reconstruct the decision from what was kept. The FFIEC already expects investigators to write down their conclusions and any filing recommendation (FFIEC manual). With agents in the chain, the record has to say which parts were the agent's and which the person's.

The audit trail keeps people and agents on one timeline

How to evaluate agentic AI for transaction monitoring before you buy

Evaluate it on your own closed alerts, with your own outcomes held back. A back-test on a few hundred alerts that analysts and QC have already decided, including the ones that became SARs, shows three things no demonstration can: how often the agents propose the decision your people reached, what they cite when they disagree, and whether the challenger catches the escalations. The 2018 joint statement treats exactly this kind of pilot, run alongside the bank's existing BSA/AML processes rather than in place of them, as the expected way to test an innovation.

Ask each vendor to show, on screen and on one of your alerts: what the agent may read and what it may never write; the confidence bar and who can change it; whether any setting can let an agent close an alert; how the challenger differs from the agent it checks; how a changed prompt or model is versioned and approved; and what the export to an examiner contains. If the answer to any of these is a slide rather than a screen, treat it as unproven.

Weigh the evidence on cost honestly too. Agents do not remove the need for monitoring staff; they change what the staff spend time on. What the analyst's job keeps covers the people side, and keeping the engine and fixing the queue covers where agents sit beside the monitoring system a bank already owns.

Where agentic AI does not belong in the alert chain

Three jobs stay out of the agents' reach in this design. Detection: the monitoring system's scenarios and thresholds decide what alerts, and the agents never change a scenario; the tuning analyst agent proposes changes to the Head of FIU with its evidence and recommends no change where SARs were filed. Suppression: no agent rescores or hides an alert, which is the failure AI in AML transaction monitoring examines in the Bank of America case. And the SAR: the escalation writer opens the Level 2 case with its summary and records a detection date, but never drafts or files a SAR, and only the Head of FIU can approve a change to that date.

The Wolfsberg Group's 2024 view of the technology is a fair note to end on: generative AI and large language models in financial crime work "are in their infancy and their application will require more research and validation" (Wolfsberg Statement on Effective Monitoring, 2024). Agents that gather and propose, with a person deciding and a trace of every step, are how a bank gets the time back without betting its SAR programme on that research being finished.

Questions people ask

How does AI triage transaction monitoring alerts?

In an agentic design, an agent reads each alert, queries the systems that hold the customer's profile, history, counterparties and prior alerts, answers fixed questions with citations, and drafts a closure or escalation under a reason code. In AML Alert Triage a second agent then argues for escalation, and a Level 1 analyst decides.

Does an AI agent need model validation?

The April 2026 model risk guidance excludes agentic AI from its scope, so it does not require it. A bank should still test agents against known outcomes before use and monitor them after, as the Wolfsberg principles recommend, because the bank remains responsible for every disposition.

Is it a problem if the agent and the analyst disagree?

No; it is information. In the sample design the analyst can edit the rationale or disagree with a reason, any closure against the challenger is always checked by QC, and human overrides are counted by reason code so the configuration can be reviewed.

What is the difference between agentic AI and a machine-learning alert score?

A score ranks or filters alerts and usually decides what a person sees first, or at all. An agent does the research on an alert a person will see and writes up what it found. The risks differ: a score can hide activity, while an agent's main risk is a confident but wrong rationale, which is why citations and a challenger matter.

Can agents work alerts from any transaction monitoring system?

They work on the alert output, so the source system matters less than access: the alert with its scenario and transactions, plus read access to the profile, core, payments and case systems. Decisions and reason codes are written back to the monitoring system.