Agentic AI in AML: Workflows, Controls and Accountability

In brief: Agentic AI in AML uses models and connected tools to carry out multi-step compliance tasks, such as gathering evidence, identifying gaps and preparing a case for review. Its usefulness depends on the surrounding workflow: the agent's mandate, access rights, source quality, decision authority and record of what actually happened. Institutions retain their regulatory responsibilities. A sound implementation defines which actions may be automated, which require escalation, and how reviewers can challenge the evidence and conclusions.

Research note: This article uses EU law as its legal foundation, as applicable at the date of publication. Current national AML requirements, forthcoming AMLR provisions and draft AMLA guidance are distinguished below. The control designs and worked example are practical recommendations, not a prescribed regulatory template. Readers outside the EU can use the operational framework while mapping legal requirements to their own jurisdiction.

An AML analyst rarely needs only a well-written answer. They need the right customer documents, the relevant policy, a reliable account of transactions, unresolved questions and a defensible next action. Agentic AI promises to connect those steps.

The shift is already visible in financial services. In May 2026, Amalgamated Bank announced a design partnership with FIS and Anthropic to pilot AI-supported financial-crime investigations. That is evidence of active development, rather than independently established production results. Amalgamated Bank's announcement illustrates why compliance teams now need to examine the whole workflow, including the tools an agent can use.

The central question: what authority has the institution delegated to the system, and what evidence will show that it stayed within that authority?

What is agentic AI in AML?

An AI agent can select and sequence actions in pursuit of a task, using tools and adjusting to their results. For example, it might retrieve a customer file, notice that an ownership document is missing, search an authorised source, compare the result with the customer's declaration and prepare an exception report. A conventional workflow follows a predefined route, while an agent has some discretion over the route. This distinction is also used in Anthropic's engineering guidance on agents and workflows.

Approach	AML example	Main control question
Rules-based automation	Schedule a periodic review when a configured date is reached.	Are the rule, inputs and exception handling correct?
AI assistance	Summarise documents selected by an analyst.	Does the summary accurately reflect those documents?
Agentic workflow	Select authorised evidence sources, investigate gaps and prepare a review package.	Were the actions permitted, the evidence sufficient and the outcome correctly recorded?

A single AML process can combine all three. A fixed rule may trigger a review, an agent may assemble the evidence, and an authorised officer may decide how to proceed. Giving the model more discretion is useful only where that discretion improves the task.

Which AML workflows can AI agents support?

The most useful starting point is a task-level delegation map. "Automate KYC" is too broad: retrieving a document, assessing its reliability and approving a customer relationship involve different permissions and consequences.

The following matrix proposes theoretical starting controls for AML workflow automation (any actual implementation requires careful legal assessment).

Workflow	Useful agent contribution	Recommended decision boundary
Regulatory change management	Monitor approved sources, identify changed provisions and map affected procedures.	Confirm jurisdiction, legal status, application date and operational impact before changing policy.
Policies and business-wide risk assessment	Organise risk inputs, compare documents and support internal preparation.	Responsible internal persons formulate and approve decisions where required; preserve the distinction between preparation and a formal proposal.
Documentary gap assessment	Compare policy text with a defined set of requirements and cite missing coverage.	Validate the finding and obtain operational evidence before concluding that a control works or fails.
CDD and enhanced due diligence	Assemble evidence, map ownership assertions and flag contradictions.	Resolve material uncertainty through the approved process; extraction alone does not verify identity or beneficial ownership.
Alert investigation	Build a transaction chronology, identify information gaps and draft analysis.	Set explicit permissions for escalation and closure. Do not infer closure authority from permission to investigate.
SAR/STR preparation	Draft a source-supported narrative and identify missing facts.	Use the institution's authorised assessment and reporting route; restrict access and external disclosure.
Ongoing customer review	Compare new evidence with the existing file and suggest review triggers.	Control changes to customer-risk classifications, monitoring settings and relationship status separately.

This separation matters across sectors. A payment institution's merchant review, an investment firm's complex ownership assessment and a bank's transaction investigation may use similar software while requiring different evidence and escalation routes. A business-wide assessment must also reflect the particular institution's risks; see the AMLR business-wide risk assessment guide.

Who is accountable when AI performs AML tasks?

Current AML obligations and governance

For EU obliged entities, the starting point remains applicable national law implementing Directive (EU) 2015/849, as amended. Article 8 requires proportionate policies, controls and procedures; Article 8(4)(a) already refers expressly to model risk management practices. Article 13 sets out core customer due diligence duties. An AI-generated statement that a customer has been verified does not establish that the underlying measures were performed. Directive (EU) 2015/849, Articles 8 and 13.

For credit and financial institutions, the EBA's AML/CFT compliance officer guidelines provide an established governance reference. Paragraph 68 preserves institutional responsibility when functions are outsourced and identifies strategic decisions that should remain within the institution. Paragraph 70 addresses oversight of providers. These are supervisory guidelines with a defined scope, rather than a universal rule for every AML-regulated profession. EBA/GL/2022/05, paragraphs 68–70.

AMLA's assumption of the EBA's AML/CFT mandates did not itself withdraw those guidelines: the authorities confirmed that existing instruments continue until replaced. EBA–AMLA handover announcement.

AMLR outsourcing restrictions: prepare for 2027

The AMLR, Regulation (EU) 2024/1624, generally applies from 10 July 2027. Article 18 retains the obliged entity's liability for outsourced tasks and prohibits outsourcing specified matters, including the proposal and approval of the business-wide risk assessment, policy approval, customer-risk decisions, relationship-entry decisions and approval of suspicious-transaction detection criteria. It also restricts FIU reporting outsourcing, with an exception for another obliged entity in the same group and Member State. Article 18(7) contains a separate, narrow derogation for certain collective investment undertakings, subject to conditions and supervisory approval. AMLR, Articles 18 and 90.

An outsourcing restriction is not, by itself, a blanket prohibition on internal AI assistance. Assess the substance of the arrangement: who performs the regulated task, who exercises judgement and whether a supplier is providing software or taking over a function. Calling a service an “agent” settles none of those questions.

AMLA's draft monitoring guidance points towards reviewable systems

AMLA's draft guidelines on ongoing monitoring discuss AI and other advanced technologies directly. Paragraphs 84–95 address effectiveness, validation, responsibility, data quality and proportionate oversight. They envisage sufficient understanding to assess and challenge a tool's role and outputs, without demanding full technical interpretability of the underlying model. They also caution against treating deployment of advanced technology as evidence of effectiveness. AMLA consultation paper, sections 2.10–2.11.

Status matters: the consultation closed on 3 September 2026; the text remained a draft at this article's research cut-off. It is a useful signal for design and preparation, not a final binding checklist. AMLA consultation status.

How do the AI Act, GDPR and DORA affect AML agents?

AI Act classification depends on intended use. An AML application is not automatically a high-risk AI system merely because it serves financial institutions or assesses high-risk customers. Article 6 and the relevant annexes require a use-specific analysis. Biometric, creditworthiness or law-enforcement functions may raise different questions. The Commission's draft classification guidance includes an example distinguishing a private firm's own AML compliance from work performed on behalf of law enforcement. That example is interpretative draft guidance, not an exemption from the Act. AI Act, Article 6 and Annex III; Commission draft classification examples.

Use the amended timetable. Regulation (EU) 2026/1744 amended the AI Act in July 2026. Under amended Article 113, Chapter III Sections 1–3, except Article 6(5), apply from 2 December 2027 for Annex III high-risk systems and 2 August 2028 for Article 6(1) systems; transitional provisions also need checking. Amended Article 4 requires measures supporting the development of staff AI literacy, taking account of knowledge and use context. It does not require a guaranteed individual proficiency level. Regulation (EU) 2026/1744, Article 1(5) and (40).

GDPR requires a separate assessment. Consider lawful basis, purpose limitation, minimisation, accuracy, security, processor arrangements, transfers and whether a data protection impact assessment is required. Article 22 concerns solely automated decisions about natural persons with legal or similarly significant effects, subject to its exceptions and safeguards. It does not cover every automated summary or triage step. A nominal human approval is not a sound substitute for assessing whether a person meaningfully influences the decision. GDPR, Articles 5, 6, 22, 25, 28, 32 and 35 and Chapter V; EDPB-endorsed automated-decision guidelines.

DORA matters for financial entities within its scope. It has applied since 17 January 2025. Using an external AI service can engage ICT third-party risk requirements: assess the arrangement, supported functions, contractual terms and exit arrangements. Article 28 preserves the financial entity's responsibility; Article 30 addresses contractual provisions. DORA's scope and proportionality rules must be checked rather than assumed to cover every AML-regulated business. DORA, Articles 2, 4, 28, 30 and 64.

What controls should surround an AML AI agent?

An AI harness is the software surrounding a model that connects it to tools, information and execution mechanisms. It can organise tasks, manage context and enforce some permissions. The Australian Cyber Security Centre's September 2026 guidance explains why security depends on this surrounding system as well as the model. A harness is an engineering concept, not an AML regulatory status or certification. ACSC guidance on agentic AI harnesses.

1. Give each workflow a written mandate

Define the task, case scope, permitted data, available tools, decision owner and stop conditions. “Prepare an EDD evidence package for customer 123” is a workable mandate. “Complete compliance” is not.

Make consequential actions explicit: sending a customer message, changing a risk classification, closing an alert, submitting a report or amending a monitoring rule. Define which can occur automatically, which require authorisation and which are unavailable to the agent. Apply the relevant legal restrictions before deciding how much discretion to delegate.

2. Enforce access and action limits outside the model

A prompt asking the agent to remain within its remit is only one instruction. The application should enforce case-level access, permitted tools and action limits regardless of the model's response. Separate read access from write access; a tool that retrieves a customer file need not also permit changing it.

For consequential actions, bind approval to the specific action and information reviewed. If the customer, content or proposed decision changes, an earlier approval should not silently authorise the new action. Limit retries and prevent duplicate submissions. Check the actual system response before marking an action complete.

3. Preserve source identity, legal status and uncertainty

A usable legal reference identifies the instrument, provision, version and application date. A customer finding identifies the document or record, its date and the passage or field supporting the finding. Retrieval improves access to evidence; it does not establish that the evidence is current, reliable or applicable.

Keep three categories visible: observed fact, analytical inference and unresolved question. A missing ownership document is a fact about the file. An inferred ownership chain is a hypothesis until supported. A legal consultation proposing a control is different from an applicable obligation.

This distinction is especially important in documentary gap assessment. “The policy does not describe this control” and “the institution does not perform this control” require different evidence. An agent should not convert the first finding into the second.

4. Treat retrieved material as untrusted input

A customer PDF, website or email can contain instructions designed to manipulate an agent. A document might tell it to ignore an ownership discrepancy or disclose another customer's records. The UK NCSC explains why prompt injection is difficult to eliminate: language models do not provide a dependable separation between instructions and data. NCSC analysis of prompt injection.

Use technical access boundaries, constrain destinations and tools, and test malicious content in realistic documents. Treat source approval as a provenance measure, not proof that every retrieved page is safe. An instruction found inside evidence should never itself expand the agent's authority.

5. Make review possible in practice

A review screen should expose the material evidence, contradictions, missing information and proposed action. Reviewers need competence, time and authority to challenge the result. A fluent narrative can otherwise hide weak evidence behind an apparently complete case.

Set escalation routes for uncertainty and technical failures. If a screening connection fails, the record should show that the check failed. If a required document is unavailable, the case should remain incomplete under the relevant procedure. In neither situation should the agent invent a successful result to finish its task.

6. Assign operational ownership

Name the business owner, the person responsible for AML methodology, the technical service owner and the applicable review or reporting roles. Decide who can authorise a new model version, change permissions, investigate incidents and suspend the workflow. Preserve the independence of control functions where required.

For an external service, examine data use, subprocessors, model changes, access to records, incident support and exit capability. The practical question is whether the institution can operate, challenge and, where necessary, stop the process with the information and rights it actually has.

Worked example: an AI-assisted enhanced due diligence review

Consider a fictional EU payment institution reviewing a merchant under its EDD procedure. The customer's ownership declaration names one beneficial owner. A newer corporate record identifies an additional holding company, but the available documents do not resolve who ultimately controls it. Part of the stated source of funds is also unsupported. The institution's procedure requires these issues to be assessed before the pending onboarding decision.

The agent's mandate is to prepare the evidence package and proposed follow-up questions. It has read access to this case and approved information sources. It cannot activate the account, change the customer's risk rating or contact the customer.

Step	Useful output	Boundary to preserve
Establish the record	A dated inventory of the declaration, corporate records and funds evidence.	Record failed retrievals and missing pages; do not describe the file as complete.
Compare ownership evidence	A map showing each source's assertions and the unresolved control chain.	Do not select one source automatically or invent ownership percentages.
Assess information gaps	Questions linked to the institution's EDD procedure and the specific discrepancy.	Separate additional evidence needed from a conclusion that money laundering occurred.
Prepare the review	A concise draft explaining supported facts, uncertainties and possible next steps.	Leave the onboarding and reporting assessments to their authorised routes.
Record the outcome	The reviewer's reasoning, further evidence requested and confirmed subsequent action.	Do not treat the agent's proposed action as an executed action.

An ownership discrepancy does not automatically establish suspicion or trigger an asset freeze. Equally, an unresolved file cannot be treated as satisfactory merely because the agent produced a polished report. Inability to complete required CDD and suspicion engage distinct legal tests and procedures, including those reflected in Articles 14 and 33 of the AML Directive. Applicable national law determines the operational response. Directive (EU) 2015/849, Articles 14 and 33.

The useful outcome is a review package that makes the unresolved issue easier to decide. For a related sector-specific application, the MiCA customer onboarding guide explains how identity, ownership and customer-risk evidence fit into a CASP onboarding process.

What should an AML AI audit trail contain?

A transcript alone is insufficient. The record should connect the task, evidence, actions and decision so that a reviewer can reconstruct material events. The following six-part structure is a practical design proposal.

1. Mandate: the case, task, permitted actions and responsible workflow owner.
2. Sources: relevant evidence identifiers, dates, supporting passages and unresolved contradictions.
3. Versions: the policy, rules, model and configuration used, with enough detail to investigate a later change.
4. Actions: tool requests and results, relevant access checks, errors, retries and confirmation of execution.
5. Review: the reviewer, material challenges, additional evidence and approval or override.
6. Outcome: the decision and rationale, resulting action or escalation, and any remaining limitations.

Capture action evidence from the application and connected systems. An AI-generated account of its own behaviour is not an independent log. A concise, source-supported decision rationale is useful; a purported transcript of the model's internal reasoning is not a substitute for evidence.

Apply access and retention rules to the record itself. Article 39 of the AML Directive restricts disclosure of reporting and related analysis, subject to statutory exceptions; Article 40 addresses specified AML records. These provisions should not be reduced to a rule that every prompt must be retained for the same period. Classify the records, identify the applicable retention obligations and minimise unnecessary personal data. Directive (EU) 2015/849, Articles 39–40; GDPR, Article 5.

How should compliance teams test an AML agent?

Test the model, tools, permissions and workflow together. An accurate final answer can coexist with an unauthorised action; an apparently successful action can fail in the connected system. Agent evaluation therefore needs both the recorded execution and the actual outcome. Anthropic's guidance on agent evaluations explains this distinction.

Build a case set with expert-adjudicated outcomes and acceptable escalation paths. Include ordinary files and difficult cases: conflicting ownership evidence, incomplete source-of-funds documents, a politically exposed person's namesake, a superseded legal source, a failed tool call and malicious instructions embedded in a document. Test attempts to access another customer's data and retries that could duplicate an action.

For each case, ask whether the agent found the material issue, supported its claims, respected permissions and reached an acceptable outcome. Repeat cases where variable behaviour could matter. Preserve disagreement between qualified reviewers rather than assuming every historical decision is correct.

Measure	What it helps establish
Missed material issues and unnecessary escalations	Whether the workflow improves detection without creating unmanageable review work.
Unsupported material statements and citation errors	Whether the narrative is grounded in the available evidence.
Unauthorised or incorrectly confirmed actions	Whether the action boundary works and records reflect actual execution.
Reviewer corrections and unresolved disagreements	Where the system or the underlying methodology needs improvement.
Total handling time, including review and rework	Whether the process saves effort after quality controls are counted.

Choose acceptance criteria for the particular task and consequence of failure. A single headline “accuracy” score conceals important differences between a harmless formatting error, a missed ownership contradiction and an unauthorised disclosure.

Begin with a bounded workflow, often an internal evidence or document-review task. Compare outputs with qualified reviewers before relying on them operationally. Expand permissions only after the supporting evidence justifies the change. Reassess material changes to the model, data, tools, permissions or policy, and keep a usable suspension and recovery process.

Frequently asked questions

Can agentic AI automate AML compliance?

It can automate or assist defined tasks, including evidence collection, document comparison, case preparation and routing. Whether it may also take a consequential action depends on the applicable law, the institution's governance and the particular arrangement. Automation does not transfer the institution's regulatory responsibilities to the model.

Can an AI agent replace an MLRO?

Deploying software does not satisfy requirements to appoint responsible officers or maintain the relevant governance arrangements. AI can support the work performed by an MLRO or AML/CFT compliance officer. Applicable national rules and institutional circumstances determine required appointments, permitted outsourcing and individual responsibilities.

Can AI draft a suspicious activity or transaction report?

It can assist with a draft narrative where the arrangement lawfully permits that processing. The workflow should preserve factual support, confidentiality and the authorised reporting process. Drafting, deciding to report and submitting a SAR or STR are separate tasks; permission to perform one should not imply permission to perform the others.

Is AML AI automatically high-risk under the EU AI Act?

No. The classification depends on the system's intended purpose and the relevant Article 6 criteria and annexes. A high customer ML/TF risk rating is a different concept from a high-risk AI classification. Assess the actual functions and the amended application timetable.

Does an AI harness make an AML agent compliant?

No. A harness can help enforce permissions, coordinate tools and preserve records. Compliance depends on the complete arrangement: applicable obligations, data processing, methodology, decision authority, operational controls and evidence of effectiveness. The label provides no regulatory assurance.

Define the first workflow before expanding autonomy

A useful first deliverable is a one-page mandate: the task, evidence sources, permitted actions, accountable owner, escalation conditions and acceptance criteria. Use it to decide what the agent may do and what the institution must be able to demonstrate afterwards.

This approach also applies to documentary compliance work. AML Agent, through a continuously expanding toolset, currently supports professional document preparation, documentary gap assessment and regulatory tracking.

About the author: George Filippakis is a financial services lawyer with a background in software development and practical AML compliance experience across large banks, payment service providers, crypto-asset service providers and investment firms. He develops AML Agent and researches the intersection of financial regulation, compliance and AI.

Primary sources and further reading

Sources were checked to 14 September 2026. Inline references identify the provisions or passages supporting the legal analysis. Legislative texts, supervisory guidance, consultations and engineering material have different status.

• Directive (EU) 2015/849, consolidated 30 December 2024 - current EU directive framework; national implementation remains material.
• EBA/GL/2022/05 on AML/CFT compliance officers - final guidelines, applicable from 21 November 2022; official supervisory-hosted copy.
• EBA and AMLA handover announcement, 19 January 2026 - continuity of existing instruments.
• Regulation (EU) 2024/1624 (AMLR) - adopted law, generally applicable from 10 July 2027.
• AMLA draft guidelines on ongoing monitoring, June 2026 - consultation draft, particularly paragraphs 84–95; consultation status.
• Regulation (EU) 2024/1689 (AI Act), consolidated 27 July 2026, and amending Regulation (EU) 2026/1744 - classification, literacy and amended timetable.
• Commission draft high-risk AI classification guidelines, July 2026 - interpretative draft; see the linked AML example in the text.
• Regulation (EU) 2016/679 (GDPR) and EDPB-endorsed automated-decision guidelines, WP251 rev.01 - data processing and meaningful human involvement.
• Regulation (EU) 2022/2554 (DORA) - applicable since 17 January 2025, subject to its scope.
• Australian Cyber Security Centre: Agentic AI harnesses, 11 September 2026 - technical security guidance.
• UK NCSC: Prompt injection is not SQL injection - technical security analysis.
• Anthropic: Building effective agents, 19 December 2024, and Demystifying evals for AI agents, 9 January 2026 - engineering sources, not regulatory guidance.
• Amalgamated Bank's AI collaboration announcement, 7 May 2026 - primary evidence of a pilot, not independent performance validation.