How to use AI for regulatory compliance on wires: a one-month test

To use AI for regulatory compliance, pick a task where the rule is written down and every output can be checked against it, run the AI on a month of your own past data in parallel with your reviewers, measure what it misses and what it flags wrongly, and keep people making every decision that moves money or reaches a regulator. On wires, the travel rule check is a good first task: the rule names the fields, examiners already test it by sampling, and the hard part, deciding whether "ONE OF OUR CLIENTS" identifies anyone, is a judgment about unstructured text, the kind of task a Federal Reserve Governor has named one of the most common current uses of AI. Botminds' Funds Transfer Recordkeeping & Travel Rule applies agents to exactly that task, judging each required field, drafting requests to sending banks and keeping the five-year file, with an analyst and a supervisor signing every hold, return and fix; this guide shows how to test it, or anything like it, before you rely on it.

How can AI be used for regulatory compliance?

Mostly as a reader and a drafter, with people deciding. When Treasury asked the industry in 2024, respondents said financial firms are "increasingly using AI – and particularly experimenting with Generative AI – for internal business operations, including but not limited to risk management, regulatory compliance, treasury management, fraud detection, and back-office functions" (Treasury, AI in Financial Services, December 2024). Federal Reserve Governor Michelle Bowman said in November 2024 that "One of the most common current use cases is in reviewing and summarizing unstructured data", where the output "provides information in a more usable way to assist a human" (Federal Reserve speech, November 22, 2024).

Regulators use it the same way on their own work. GAO reported in 2025 that "NCUA, CFTC, and the Federal Reserve use AI to help detect errors or outliers in data submitted by financial institutions," and that none of them let AI decide on its own or relied on it as the only input (GAO-25-107197; the Reg E remittance transfer rule and where AI agents stop quotes the finding). Flagging errors in submitted data, with a person deciding, is close to a description of a travel rule check.

The wire version of that pattern has three jobs an agent can do and one it should not. It can read each message and judge whether each required field identifies a party; it can draft the request to the sending bank on an approved template; and it can keep and retrieve the file. It should not hold, credit, return or release money, change a customer's data or decide that a pattern is suspicious. Those are signed by people.

Is AI allowed for BSA compliance? What regulators have said

No BSA rule forbids it and none specifically permits it; existing law applies to the result. Governor Bowman put it directly in the same speech: "AI is not exempt from current legal and regulatory requirements, nor is its use exempt from scrutiny." Treasury's recommendation to firms is procedural: "prioritize their review of AI use cases for compliance with existing laws and regulations before deployment and that they periodically reevaluate compliance as needed" (Treasury, 2024). A one-month test on past data is that review, done in a form an examiner can read.

For the travel rule specifically, supervisors anticipated automation long before AI. The federal banking agencies' 2009 guidance on cross-border funds transfers recognized that "given the volume of messages and data for large U.S. cover intermediary banks, a manual review of every payment order may not be possible," asked for a risk-based way to find blank or meaningless fields, and told banks to plan how their automated monitoring would adapt (interagency guidance, FDIC FIL-72-2009; originator information on wire transfers quotes the guidance). The question an examiner asks is not whether the method is automated, but whether the bank knows it works.

Does model risk guidance apply to AI agents?

Not directly, as of October 2026. The revised interagency guidance on model risk management, issued April 17, 2026, "supersedes and replaces SR letter 11-7" and also SR 21-8, the 2021 statement on model risk for systems supporting BSA/AML compliance (Federal Reserve SR 26-2). It then puts the newest tools outside its scope: "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance." It also excludes "deterministic rule-based processes and software where there are no statistical, economic, or financial theories underpinning their design or use", and is expected to be "most relevant to banking organizations with over $30 billion in total assets."

Out of scope is not the same as unsupervised. The same text says "a banking organization's risk management and governance practices should guide the determination of appropriate governance and controls for any tools, processes, or systems not covered in this document" (revised guidance text), and the OCC says the agencies "plan to issue in the near future a request for information that addresses model risk management generally and considers, in particular, banks' use of AI, including generative AI and agentic AI" (OCC Bulletin 2026-13). Until that arrives, a bank's own evidence is the governance: what the agent was tested on, against whom, with what result, and who signed the decision to go live.

Why a travel rule check is a good first AI task

Because its boundaries are already drawn. The rule lists the fields, so a verdict can always be traced to a paragraph. The judgment is narrow: is this value present, missing, meaningless or incomplete. The ground truth can be built in a week by two reviewers. Examiners already have a procedure for testing it: sample transfers from each of the bank's three roles, originator's, intermediary and beneficiary's bank (FFIEC examination procedures). And the cost of an error is contained if the agent never moves money: a wrong flag costs an analyst a minute, and a missed gap is caught by the same second reviewer the bank uses today.

Compare that with asking AI to decide whether activity is suspicious, which turns on facts outside the message and ends in a filing. The travel rule check is where an agent's reading speed matters and its judgment can be audited line by line, which makes it a sensible place to learn how your bank governs agents before trying anything harder.

How long should an AI compliance pilot be? Four weeks on past wires

Four weeks is enough for a travel rule test if it runs on past data. A live pilot has to wait for gaps to arrive; a test on last month's wires has them all on day one, along with what your team actually did about each. The bank labels a sample, the agents run in shadow over the same month, and the last week is spent on differences, not on waiting.

The sample should be drawn the way an examiner would draw it, across the three roles, and stratified where the risk is: the correspondents that send the most, the channels that originate most outbound wires, and any field type your team argues about. The guide on measuring how often two reviewers agree explains why the reviewers' agreement, not perfection, is the bar.

How do you test an AI compliance tool? The measures that decide it

Count misses and false flags separately, by field type and by direction, against the adjudicated answers, and read every case where the agent cleared a value your reviewers flagged. Averages hide the failures that matter: a tool that is right on 99% of fields can still miss the one placeholder that a sending bank uses on structured payments.

What results justify going live?

Results you wrote down before the test. Set the thresholds in week one, in a memo the BSA Officer signs: the agents must miss no outbound gap in the sample, miss inbound gaps no more often than your reviewers disagree on the same field type, keep false flags under a rate your team can absorb, and cite every verdict. Then the go-live decision is a comparison, not a negotiation.

What the agents show you during the test

A test is only as good as what you can see. Each agent in the solution records its plan, what it found, the sources it read, its confidence and who it handed to, so a reviewer comparing an agent's verdict with the adjudicated answer can see why they differ: a wrong library entry, a missing piece of context, or a value the reviewers themselves misjudged. On the sample wire below, the whole run took eight seconds.

Each agent's plan, findings, sources and confidence, with a button to reject the finding

Where people stay in charge once it goes live

The test's last question is whether the controls you relied on in the test survive production. In the solution the answer is built into the screens: an analyst signs each credit, hold, return or fix with a reason code, the Wire Room Supervisor approves it, and the system will not let anyone approve their own step. Below the confidence floor the agent does not give a verdict on meaninglessness at all; a person does. Agent versions are pinned and a change needs the BSA Officer.

The decision is the analyst's, the approval the supervisor's, and the system enforces the split

Where the solution fits less well is worth saying before the test, not after. A bank with a few dozen qualifying wires a week has too little volume to learn much from a month, and its reviewers can apply a written standard by hand. And no vendor's estimate of time saved should go into a business case: measure the minutes per gap in week four, and use the guide on what BSA recordkeeping costs by bank size to price them. To run the test on a sample of your own wires, start from Funds Transfer Recordkeeping & Travel Rule; for how the main agent judges a field, see originator information, name or placeholder.

Questions people ask

Can an AI agent decide to hold or return a wire?

It can recommend; it should not decide. In Funds Transfer Recordkeeping & Travel Rule the Disposition agent recommends credit, hold or return with its confidence, and an analyst signs the decision that a supervisor approves. Regulators describe their own AI use the same way: GAO found they were not using AI to make decisions autonomously.

What data does a one-month test need?

A month of past inbound and outbound wire messages, the customer names, addresses and accounts the bank holds, the list of correspondents, and the bank's own request templates, disposition rules and approval limits. The agents read copies; nothing in production is touched.

Is SR 11-7 still the guidance for AI compliance tools?

No. SR 11-7 was superseded on April 17, 2026 by revised model risk guidance (Federal Reserve SR 26-2), which also replaced the 2021 BSA/AML model risk statement, SR 21-8. The revised guidance places generative and agentic AI outside its scope while the agencies prepare a request for information on AI.

What if the agent and our reviewers disagree?

Adjudicate the case and write the reason down. Sometimes the agent is wrong and a library entry or the confidence floor changes; sometimes a reviewer missed a value and the written standard needs an example. Either way the case joins the test set that every later version must pass.

Why test on past wires rather than run a live pilot?

Because past data has the answers. Last month's wires come with what your team actually did about each gap, so the agents can be compared case by case in days, with no risk to a live payment and no wait for unusual cases to arrive.

Does an AI test need the BSA Officer's sign-off?

It should have it, at both ends. The thresholds for going live should be set in a memo the BSA Officer signs before the test, and the result signed after, because Treasury's recommendation is to review AI uses against existing law before deployment, and the BSA Officer owns that law at the bank.