AI in AML compliance: benefits, risks and controls
AI improves AML by reducing false positives in transaction monitoring, prioritising alerts and finding networks that rules miss. It also creates risks: missed suspicious activity if models drift, decisions that investigators cannot explain, and biased outcomes. Control it with validation before replacing rules, parallel runs, below-threshold testing, explainable alert reasons, and investigator review of every escalation decision.
SR 26-2 folded the former BSA/AML model statement (SR 21-8) into its single model risk guidance, so non-generative AML models sit inside model risk management in the US.
What controls should AI-based AML monitoring have?
- Parallel run against existing rules before switching, with documented comparison.
- Below-the-line testing to check what the model is not alerting on.
- Explainable alert reasons for investigators and auditors.
- Drift monitoring as typologies and customer behaviour change.
- Human decision on every escalation and SAR filing.
- Periodic independent validation proportionate to materiality.
Primary sources (reviewed 17 Oct 2026)
- Federal Reserve, OCC and FDIC: SR 26-2, Revised Guidance on Model Risk Management (17 April 2026)
- FATF: guidance on new technologies for AML/CFT
- Financial Stability Board: Sound Practices for Responsible Adoption of Artificial Intelligence, final report (15 October 2026)
This page explains supervisory guidance in plain language. It is not legal advice; confirm how each text applies to your institution and jurisdiction.
Frequently asked questions
Can AI file suspicious activity reports automatically?
The decision to report should remain with trained staff. AI can draft narratives and prioritise cases, with human review and approval.
Related pages
Put these controls to work this month
Start on the cloud risk management software within 24 hours, or ask for training or advice tailored to your institution.