AML risk assessment software helps a bank build its institution-wide BSA/AML risk assessment: the written reading of where money laundering and terrorist financing risk sits in its products, customers, geographies and channels, how strong its controls are and what risk is left. Most tools on the market are structured templates or scoring engines that still need a person to type in every number. Agent-built software goes further: it pulls the numbers from the bank's systems, scores them under the bank's own method, drafts the narrative and checks it. Botminds' BSA/AML Risk Assessment is software of that kind, and its design question is the one a BSA officer should ask any vendor: which decisions does it leave with people?
The examples come from a fictional sample bank as it runs through the solution: Tessaly Community Bank, a $3.4 billion sponsor bank whose 2026 assessment is drafted overnight and then decided by its BSA officer, its BSA Committee and its board. Regulatory text is quoted from the regulators and linked where it appears.
The limits matrix: what agents may do, and what no agent may decide
| Decision | The agents may | No agent may | Who decides |
|---|---|---|---|
| The inventory of data points | Pull counts, volumes and balances as of the assessment date and keep the system, the item and the passage each came from | Estimate a missing value (it is marked provisional), or read the content of individual SARs: counts only | The BSA analyst confirms each figure |
| Inherent risk of each category | Score it under the bank's methodology and explain the level in one sentence naming the data behind it | Change the methodology, or keep a score below the 0.80 confidence setting | The BSA officer accepts or overrides, with a reason code |
| Control strength | Rate each control from tests, quality reviews, the independent test and exam findings | Rate a control without dated evidence | The BSA officer |
| Residual risk | Read it from the bank's matrix of inherent risk against control strength | Override a residual rating | The BSA officer, with a reason code that stays on the audit trail |
| The narrative | Draft each section with a citation on every figure | Write a figure without a citation, or mention an individual SAR or customer | The BSA officer edits and owns the text |
| The challenge | List every claim that is out of date, with the evidence and a proposed fix | Edit the draft, or dismiss its own challenge | The BSA officer accepts, edits or dismisses each one by name |
| Risk appetite and methodology | Nothing beyond running the approved version | Propose or approve weights, scales or thresholds | Proposed by the administrator, approved by the chief risk officer as a new version |
| Submission and approval | Assemble the committee and board packs | Submit or approve | The BSA officer submits; the BSA Committee and the board approve |
What is AML risk assessment software?
AML risk assessment software is any tool that helps a bank identify its money laundering and terrorist financing risk categories, analyze the data in each and document the result. The FFIEC manual describes that work as two steps: identify the risk categories particular to the bank, such as its products, services, customers and geographies, then analyse the information found in each (FFIEC, BSA/AML Risk Assessment). It sets no format and expects no particular method.
That freedom is why the market looks so different from tool to tool. Three families cover most of it. Questionnaire and template tools give the bank a structure of categories and scales and let staff enter values. Scoring engines add weights and a residual matrix, so a change in one value moves the rating. Agent-built drafting tools, the newest family, also do the gathering, the citing, the writing and the checking. All three leave the two FFIEC steps with the bank; they differ in how much of the work between those steps a person must still do by hand.
What the regulators say about AI in the risk assessment
No regulation requires or forbids software for the risk assessment, and recent statements lean toward letting banks try it. The 2018 joint statement on innovation, from the federal banking agencies and FinCEN, says a pilot that fails does not by itself invite supervisory criticism, and that a bank with an effective program sized to its risks will not be penalised for choosing not to innovate (joint statement, December 2018; the guide to piloting AI on SARs shows the statement at work).
FinCEN's April 2026 proposal for AML/CFT programs, still a proposal, goes further. It counts machine learning, generative AI, digital identity, blockchain analytics and APIs among innovative approaches, names and requires no particular technology, and says responsible experimentation will not, on that ground alone, raise an institution's risk of significant supervisory or enforcement action (91 FR 18704). The FinCEN AML program rule NPRM has its own guide.
Model risk guidance is the third text, and it changed in 2026. On April 17, 2026 the agencies replaced their model risk guidance and rescinded the 2021 statement on BSA/AML models. The new guidance excludes spreadsheet arithmetic and deterministic, rule-based processes from the definition of a model, leaves generative and agentic AI outside its scope, and expects to matter most to banking organisations with more than $30 billion in total assets (OCC Bulletin 2026-13; the guide to risk rating models reads it closely). Out of scope is not the same as unsupervised: the 2023 interagency guidance on third-party relationships still applies to a vendor's tool, and the bank's own governance must still explain how a rating was reached.
Seven agents, seven jobs, and the people between them
Agent-built software works best when each agent has one job and one set of limits, so a reviewer can see which agent produced what. In BSA/AML Risk Assessment seven agents divide the work, and three people stand between the draft and the board's vote.
How BSA/AML Risk Assessment builds the assessment, and where people decide
Agent
Data gathererPulls the data points from six systems as of the assessment date, with the system, item and passage of each.
Never: estimates a missing value or reads SAR case content
Agent
Risk scorerScores inherent risk for each category under the bank's methodology, with a one-sentence reason.
Never: changes the methodology
Agent
Control assessorRates each control on its evidence, applies the residual matrix and proposes action plans.
Never: overrides a residual rating
Agent
Narrative writerDrafts the sections from the data, the ratings and last year's assessment.
Never: writes a figure without a citation
Agent
ChallengerReads the draft against last year's approved version, the FFIEC manual and FinCEN's publications.
Never: edits the draft or dismisses its own challenge
A person decides
BSA officerConfirms, overrides with reasons, resolves every challenge and submits as maker.
A person decides
BSA Committee and boardReview and approve; a maker cannot approve her own work.
Agent
Change watcher and exam pack builderRerun only what moved each quarter, and assemble a sealed pack for examiners.
Never: re-approve, or release a pack without the BSA officer
For the sample bank the overnight run took 27 minutes. The data gatherer pulled 112 data points: 48 from the core banking system, 17 from transaction monitoring, 9 counts from case management, 19 from the general ledger, 15 from the partner program files and 4 from the board portal. The risk scorer scored 38 categories with confidence between 0.81 and 0.99, so none fell below the 0.80 setting. The control assessor rated 41 controls: 14 Strong, 24 Adequate and 3 Needs improvement. The challenger found seven claims out of date.
BSA/AML Risk Assessment: how the agents built the draft
Can AI do an AML risk assessment?
AI can draft an AML risk assessment; it cannot be the one who makes it. The FFIEC manual puts the design of the method and the communication of the risks with bank management, and the board, not a tool, is responsible for the program the assessment shapes. A rating is a judgement about the bank's own business, and the person who signs it has to be able to defend it.
When the bank has established an appropriate BSA/AML risk assessment process, and has followed existing policies, procedures, and processes, examiners should not criticize the bank for individual risk or process decisions.
FFIEC BSA/AML Examination Manual, BSA/AML Risk Assessment
That sentence is the case for software and its limit in one. Examiners judge the process. Software that runs the same documented method on every category, keeps the evidence and shows who decided what makes the process easier to show. Software that produces a rating nobody at the bank can explain makes it harder, however accurate the number.
There is a second reason to keep people in charge. Treasury's 2026 National Money Laundering Risk Assessment, reviewing recent enforcement actions, lists among common deficiencies "adopting new AML/CFT solutions through third party relationships with service providers that introduce vulnerabilities that can be exploited by illicit actors" (Treasury, 2026 NMLRA). A tool is a third party. The bank owns what it does.
How do you automate a BSA risk assessment without losing the why?
You automate the gathering, scoring and drafting, and you keep a trail from every rating back to the data, the rule and the source that produced it. The test of an automated assessment is the examiner's question "why is this row what it is?", answered in one click rather than by reconstructing a spreadsheet.
Four design choices make that possible. Every figure carries the system, the item and the passage it came from, so a reader can open it. Every rating word opens its weighted score, the categories under it and the data behind them, with last year's values beside this year's. A value the agent is not sure of goes to a person rather than into the draft. And every decision a person makes, accepting a challenge, overriding a rating or dismissing a claim, needs a name and, for a dismissal or an override, a reason code.
A rating that opens its data
What to ask a vendor of AML risk assessment software
The questions that separate tools are about evidence and authority, not features. A BSA officer can put these to any vendor, ours included, and ask to see the answer on the bank's own data rather than on a slide.
Eight questions for any AML risk assessment software vendor
- Whose methodology does it run?
The bank's own categories, weights, scales and residual matrix, versioned, or the vendor's fixed model.
- Where does each figure come from?
Ask to open one rating and follow it to the source system and the passage, as of the assessment date.
- What happens when data is missing?
A good tool stops and asks. A tool that fills gaps with estimates writes guesses into a board document.
- Who can override a rating, and is the reason kept?
Overrides should need a name and a reason code and show on the row and the audit trail.
- Can it compare this year with last year?
The commonest error in an annual assessment is last year's sentence surviving into this year's draft.
- What does it never do?
Submit, approve, change the methodology, or read SAR case content. Ask to see the limits as settings.
- How does it refresh?
Rerun only the categories whose data moved past a threshold, and send any row that moves back for approval.
- How is it governed as a third party?
Read-only connections, data handling, versioned prompts and models, and exports an examiner can read.
Is risk assessment software worth it for a small bank?
For a small bank with a stable book and a few products, a well-kept spreadsheet that documents its factors and weighting can be enough; the FFIEC manual asks for a sound process, not a product. Software earns its cost where the book moves fast, the data sits in several systems, or one person carries the program and cannot afford three weeks of copying every fall. Community banks already split this decision: in the Conference of State Bank Supervisors' 2025 survey, 34.3% met their BSA/AML technology needs in-house, 47.8% through a combination and 17.9% through a third party.
How community banks meet their BSA/AML technology needs
For the sample bank the arithmetic runs like this. Our estimate of the annual assessment by hand is about 25 working days, 15 of them copying 112 data points from six systems; the design target with the solution is four days, most of it the BSA officer's review. A sponsor bank whose partner programs nearly doubled in a year gains more than a bank whose products have not changed in a decade, because the refresh, not the first draft, is where a spreadsheet falls furthest behind. The OCC's own direction of travel points the same way: in 2026 it tailored community bank BSA examinations to their "generally low levels of money laundering and terrorist financing risk" (OCC, Spring 2026), which rewards a bank that can show its low risk quickly and with evidence.
Where the solution does not fit is just as clear. A bank whose core system cannot export its counts, or whose methodology is not written down, will spend its first weeks on those problems, not on agents; the inputs to gather before a BSA/AML risk assessment tool lists them. And no software replaces the officer's knowledge of the bank's customers. It moves that knowledge from copying numbers to judging them.
What examiners receive: the trail and a sealed exam pack
The comparison of approaches, template, consultant, packaged software or agents, is laid out in the BSA/AML risk assessment template guide. To see the agents on a full assessment, from the overnight draft to the board's vote, start from BSA/AML Risk Assessment.
Questions people ask
Who approves the BSA risk assessment?
No rule names an approver for the risk assessment itself. The rules require a written AML program approved by the board and noted in the minutes, and the FFIEC manual says the assessment should be provided to the board, management and business lines. Many banks have the BSA Committee and then the board approve it, as the sample bank does.
Is an agent-built risk assessment a model under the 2026 model risk guidance?
The April 2026 guidance places generative and agentic AI outside its scope and excludes deterministic rule-based processes and spreadsheet arithmetic, and the agencies said they plan a request for information on AI. That does not remove oversight: the bank still governs the tool as a third-party relationship and must be able to explain every rating.
What data does an AML risk assessment need?
Counts, volumes and balances for each product, service, customer type, geography and channel, plus evidence for each control: tests, quality reviews, the independent test and exam findings. The FFIEC manual gives examples such as the number and dollar amount of domestic and international funds transfers. Last year's approved assessment and the bank's written methodology complete the set.
Can software replace the BSA officer's judgement on residual risk?
No. Software can read a residual rating from the bank's matrix, but the officer must be able to override it when the matrix misses something, with the reason kept. In BSA/AML Risk Assessment no agent may override a residual rating; only a named person can, with a reason code.
Does using AI for the risk assessment raise enforcement risk?
FinCEN's April 2026 proposal says responsible experimentation with innovative technology will not, by itself, add risk of significant supervisory or enforcement action, and the 2018 joint statement says a failed pilot is not grounds for criticism. Both assume the program stays effective, so the bank remains accountable for what the tool produces. The proposal is not yet final.
How long does an agent-built draft take?
For the sample bank, the overnight run took 27 minutes from the first data pull to the hand-off to the BSA officer. The design target for the whole annual assessment, including the officer's review, the challenges and the committee and board packs, is four days, against our estimate of about five weeks by hand.