AI in AML: transaction monitoring, alerts and SAR narratives at banks.

What is AI in AML?

AI in AML means models doing the scoring, reading and drafting inside an anti-money-laundering programme: transaction monitoring on customer context instead of fixed thresholds, alert triage that ranks and clears the queue, investigation files and enhanced due diligence assembled by language models, sanctions screening with entity resolution, trade-document reading, and suspicious activity report narratives drafted for a BSA officer to edit and file. 40 of the 140 banks profiled here record one of those steps on AI, 26 in production.

An anti-money-laundering programme has four legal parts in every major jurisdiction: know the customer and rate the risk, monitor transactions and behaviour for suspicious activity, investigate what the monitoring flags, and report what the investigation confirms to the financial intelligence unit, in the US by filing a suspicious activity report with FinCEN. Sanctions screening runs alongside under a separate statute and the same tools. None of those parts changes when a bank adds AI; what changes is how the work is done. Rules-based monitoring fires an alert when a transaction crosses a threshold (a cash deposit over an amount, a wire to a country, a pattern of structuring), and the industry's open secret is that the overwhelming majority of those alerts are closed as false positives after an analyst reads them. A contextual model scores the same transaction against the customer's profile, history and network and ranks it; a triage model re-scores the alert queue; a language model assembles the case file and drafts the narrative; a person decides.

The record on this site shows three generations in use at once. Rules-plus-case-management platforms have been in production for a decade (Cathay describes NICE Actimize monitoring and LexisNexis Bridger screening in its Wolfsberg questionnaire without any claim of machine learning). Supervised machine learning entered monitoring and triage around 2021: HSBC piloted Dynamic Risk Assessment that year, TD Bank put machine-learning models into its transaction monitoring system in 2025, Zions uses AI against false positives in the wire room and in AML/BSA alert review, Valley's models segment risk and reduce false positives in alert review. Generative and agentic AI arrived in 2025 for the reading-and-drafting jobs: FNBO's agents gather evidence on AML, fraud and sanctions alerts, OceanFirst's investigators run enhanced due diligence through Copilot, The Bancorp drafts narratives with AI, BMO is among the first to deploy FIS's financial-crimes agent built with Anthropic. Across all of these, 53 of the 140 banks here record some AML or KYC activity on AI; the monitoring-and-investigation subset on this page is 40, and the onboarding side is on AI for KYC.

Which banks use AI in AML?

26 banks run AI in a monitoring, alert, investigation or screening step in production on the record, led by HSBC, TD Bank, BMO, Santander, KeyBank, Capital One, Zions, Valley, Western Alliance, FNBO, ING and Scotiabank; 5 are rolling out, 2 are in pilot and 7 have announced plans. The programmes with published results are the ones that replaced rules-based monitoring with a contextual model (HSBC) or put a triage model or agent in front of the alert queue (BMO, Santander, FNBO, OceanFirst).

The table lists every bank whose profile records an AI activity in monitoring, alerts, investigations, sanctions screening or SAR drafting, strongest status first and largest bank first within a status. “In production” means the bank or a named vendor says it is live; the date is the earliest sourced event on the bank's timeline for the activity, so a 2024 date is usually a first disclosure rather than a go-live. A few rows record a platform or a spend without a claim that models are involved (Flagstar's $30 million to $40 million of AML software and privacy investment, Frost's sanctions-screening modernisation); they are kept because the bank filed them under its AI work, and the detail says what is and is not claimed.

Two patterns stand out. First, the published results come from banks that changed the monitoring architecture, not from banks that added a model to the old one: HSBC replaced rules with a contextual model and reports both fewer false positives and more crime found, which is the pair of numbers an examiner wants to see together. Second, the fastest-growing category is the agent in front of the investigator: FNBO runs 15 investigators and analysts with agents that halve the time per case, Santander's Openbank models work about 100,000 alerts a year, KeyBank's stated target is AI handling routine alert investigations with humans checking the output and taking the complex cases. 30 rows are in production; the AI disclosure index ranks the US banks on their whole record.

What results do banks report from AI in AML?

HSBC's Dynamic Risk Assessment checks about 980 million transactions a month with 60% fewer false positives and two to four times more financial crime found; BMO reports false AML alerts down about 10% and adverse-media searches cut from about 180 minutes to 20; Scotiabank's Tangerine pilot cut existing alert volumes by 37%; Santander's Openbank models process about 100,000 alerts a year, completing in minutes investigations that took hours; KeyBank's generative-AI screening proof of concept took 15 to 20 minutes per investigation against several hours; OceanFirst's investigators clear a complex enhanced-due-diligence case in about five minutes instead of six hours or more; FNBO's agents halve investigator time per case; Western Alliance projects 60 to 80% faster triage.

These are the banks' own figures as reported, with the date and the source. They measure different things (transactions screened, false-positive rate, alert volume, minutes per case, programme spend) and are not comparable with each other; the strongest are the ones that pair an efficiency number with an effectiveness number, as HSBC's does. Internal projections and targets are labelled as such.

How to read them: a false-positive reduction (HSBC's 60%, BMO's 10%, Scotiabank's 37% alert cut) is a result only if coverage held, which is why Scotiabank says it is designing its own solution to improve precision rather than simply adopting the pilot's. A minutes-per-case figure (KeyBank's 15 to 20 minutes, OceanFirst's five, FNBO's 15) measures the drafting and reading the model took over, not the decision; the investigator still decides. The spend figures are the other side of the ledger: TD Bank's $507 million of US BSA/AML remediation in fiscal 2025, rising to about $550 million in 2026, is what a monitoring rebuild costs after an enforcement action, and the machine-learning models are a line inside it.

Where do the models sit in the AML pipeline?

Seven places, in the order a case moves: transaction monitoring, alert triage, investigation and enhanced due diligence, SAR narrative drafting, sanctions and watchlist screening, trade-document reading, and the post-enforcement rebuild. Each has a bank on the record doing it, listed in the table below; in every row the model scores, ranks or drafts and a person decides.

The table follows a case from the transaction that triggered it to the report that closed it. Each row names the model class and a bank on the record that runs it; the bank page carries the source. In every row the model scores, ranks, reads or drafts, and a person signs the decision that the Bank Secrecy Act attaches to a person.

The hardest stage to automate is the first one, and for a data reason rather than a model reason. A contextual monitoring model only outperforms rules if it sees every account, channel and product the rules saw and the customer's full history besides; a bank with payments on one core, cards on another and trade finance on a third has to reconcile them before the model is worth validating. That is why HSBC describes its programme as a financial-crime architecture on Google Cloud, with more than 600 applications already migrated, rather than as a model, and why TD Bank describes a new transaction monitoring system first and the machine-learning models inside it second. The triage and drafting stages are easier because the data is the alert itself; that is where regional and community banks (OceanFirst, FNBO, The Bancorp) have gone first.

What do FinCEN and the bank regulators require?

US regulators encourage AI in AML in writing (the 2018 joint statement, FinCEN's Innovation Hours, the AML Act of 2020, the 2026 programme proposal that counts 'effective use of artificial intelligence' in a bank's favour) and attach two conditions: a machine-learning monitoring, screening or customer-risk-rating model is a model under SR 26-2, to be inventoried, validated and monitored in proportion to its materiality, and a bought platform is a third-party relationship under SR 23-4. The HKMA went further in 2024 and told Hong Kong banks to study and plan AI monitoring with board sign-off.

No rule prohibits AI in AML, and the US agencies have encouraged it in writing since December 2018. The obligations that bind are the ones that bind any AML programme (the Bank Secrecy Act and FinCEN's programme, monitoring and SAR rules in the US; the EU's anti-money-laundering directives and the new AML Authority; the UK's Money Laundering Regulations and JMLSG guidance; the FATF recommendations all of them implement) plus two AI-specific layers: model risk management for the models and third-party risk management for the vendors. The tracked documents most relevant to an AML programme are below; the full set of AML and KYC documents is on the by-use-case page. The FATF's own 2021 report on new technologies for AML/CFT is not yet in the tracker.

Three documents matter most in practice. The 2018 joint statement is the permission slip: it names artificial intelligence, says pilots that find gaps will not necessarily draw supervisory action, and has never been withdrawn. SR 26-2 is the condition: it absorbed the 2021 BSA/AML model-risk statement, keeps machine-learning monitoring, screening and customer-risk-rating models in scope, scales validation to materiality, and leaves generative drafting assistants to the bank's broader governance; model risk management covers what that means in practice. FinCEN's 2026 programme proposal is the direction of travel: effectiveness over technical completeness, enforcement reserved for significant failures, and ‘effective use of artificial intelligence’ with demonstrable outputs counted in a bank's favour. Outside the US, the HKMA's 2024 circular is the only text that tells banks to adopt AI monitoring and report a plan to the supervisor.

What controls do examiners expect around an AI AML model?

Eight, each traceable to a document in the tracker: a model inventory with materiality tiers, validation before and after go-live, threshold and below-the-line coverage testing, explainable alerts, a human decision on every SAR and account action, data lineage from source systems to the model, vendor model oversight, and documentation an examiner can read. The 2021 BSA/AML statement and SR 26-2 both say a pilot or upgrade does not by itself require full revalidation.

The guidance does not contain a checklist for AI in AML; it contains principles that examiners apply to the monitoring system in front of them. The table translates those principles into the eight artefacts a bank is asked for, with the document each one traces to. The common thread is the one OCC Bulletin 2021-19 set out and SR 26-2 kept: not every BSA/AML system is a model, the bank decides which ones are under its own risk-based framework, and testing or upgrading one does not by itself trigger supervisory action.

The control that decides most examinations is the third one. A bank that cuts alerts by a third has to show that the SARs it would have filed under the old thresholds are still being filed under the new model, which means keeping the old rules running in parallel or sampling below the line for long enough to prove it. City National's January 2024 consent order makes the point from the other direction: it requires periodic independent validation of the models and filtering thresholds in the bank's BSA/AML monitoring system. The alert-explainability control is the second decider, because a closed alert with no recorded reason is indistinguishable from a missed one.

Which vendors supply AML AI software?

10 vendors in this site's AML compliance category; the ones most often named by the banks here are NICE Actimize (4 banks), Alloy (3 banks), Quantexa (2 banks), Feedzai (2 banks). The largest banks build the monitoring model and rent the platform and data: HSBC with Google Cloud, FNBO on Verafin's agents, BMO on FIS's financial-crimes agent built with Anthropic.

The table lists the vendors in this site's AML compliance category, with the number of banks in the US set that name them on the record. A bank naming a vendor is a disclosure, not a market share; the category guide explains what to check when buying, and the fraud detection guide covers the vendors that serve both sides.

The build-versus-buy line runs where it does elsewhere in banking. The largest banks build the monitoring model and rent cloud and data: HSBC co-developed Dynamic Risk Assessment with Google and now runs a group programme with Google Cloud; TD Bank rebuilt its own platform. Regional banks buy a platform and switch on its models: KeyBank on NICE Actimize X-Sight, Sallie Mae on Unit21, Dime selecting Quantifind for payment sanctions screening. Community banks reach for the agent inside the platform they already have: FNBO's agents run inside Verafin with the same access a human investigator holds, OceanFirst pastes Fiserv and Verafin data into Copilot. The next wave is the core providers' own agents: BMO will be among the first to deploy FIS's financial-crimes agent built with Anthropic. Fintechs are both customers and suppliers of the same stack; the ones on this site with an AML use case are below.

How does AI in AML connect to KYC and fraud?

KYC decides who gets in and how risky they are; AML watches what they do and files the SAR; fraud controls protect the account from takeover, scams and mules. The models overlap more than the org charts: the entity-resolution engine that scores a sanctions hit at onboarding scores the counterparty of a payment, the behavioural model that spots a mule account feeds both fraud and AML, and FinCEN's deepfake alert belongs to onboarding and monitoring alike. US rules treat KYC and AML as one BSA/AML programme.

A bank's financial-crime stack has three gates with one customer record behind them. KYC is the front gate and the periodic re-check; AML watches the account afterwards and files the SAR; fraud controls protect the account from takeover, scams and mules. The models overlap more than the org charts do, which is why the same vendors appear on all three of this site's pages and why KeyBank bought one platform for fraud and AML together. On this site the onboarding and identity side is on AI for KYC, the account-protection side on AI fraud detection, and the vendors common to all three on AML compliance tools. What the people running these programmes say about them is below.