The Investigative Edge

The AML compliance function at most financial institutions faces a structural crisis — not in its ability to detect suspicious activity, but in its capacity to investigate it. Despite paying more than $274 billion in global fines over the past decade, the industry intercepts only an estimated 2 percent of illicit financial flows, while compliance costs consume 10 to 15 percent of bank operating budgets. The core problem is that approximately 90 percent of investigator time is consumed by data gathering, document review, and narrative writing rather than the analytical judgment that experienced financial crime professionals were hired to provide. Outsourcing has provided cost relief but has not solved the underlying bottleneck, and rising regulatory expectations for investigation quality and documentation completeness mean that lighter-touch reviews are no longer an acceptable response to capacity pressure.

Generative and agentic AI offer a fundamentally different solution — one that reduces the volume of human effort required rather than simply repricing it. This paper examines five core investigative workflows where the opportunity is greatest: Customer Due Diligence and Enhanced Due Diligence, sanctions and watchlist screening adjudication, SAR investigation and narrative drafting, fraud investigations, and surveillance. For each, AI can automate the procedural scaffolding of investigation — evidence assembly, policy application, document synthesis, and narrative generation — while leaving disposition judgment and quality oversight firmly with human investigators. Institutions deploying purpose-built agentic AI are achieving reductions of more than 80 percent in manual investigative workload and case resolution times up to 10 times faster than manual workflows. The architectural principles that make this reliable — task decomposition, retrieval-augmented grounding, policy encoding, composable system integration, and rigorous human oversight design — are as consequential as the AI models themselves. The recently issued SR 26-2 model risk management guidance, which explicitly excludes generative and agentic AI from its scope while preserving regulatory authority over unsafe practices, creates both an accelerated deployment path and an urgent governance obligation that institutions must address proactively.

The path from pilot to production is not without real obstacles. Data fragmentation across legacy systems, hallucination risk in high-stakes investigative contexts, the workforce redesign that genuine AI adoption demands, and the absence of prescriptive validation rules for LLM-based tools all require deliberate planning. But the risk calculus has shifted: the institutions that invest now in purpose-built agentic AI — with the governance frameworks, data integration, and workforce development that responsible deployment requires — will hold a structural cost and quality advantage over those that wait. With 92 percent of banks planning to increase their generative AI investment and 75 percent expecting their regulators to be supportive, the industry has moved past the question of whether AI belongs in AML compliance. The defining question now is which institutions will build the governance and operational infrastructure to scale it safely, and which will face the same painful retrospective compliance effort that has characterized every previous wave of inadequately governed financial crime technology.