Agentic AI in financial-crime prevention: Lessons from winners

Banking leaders are well aware that managing financial-crime risk is a costly business, mainly due to the high numbers of repetitive, manual activities. McKinsey research shows that banks often assign 10 to 15 percent of employees to know-your-customer (KYC) and anti-money-laundering (AML) activities alone.¹“How agentic AI can change the way banks fight financial crime,” McKinsey, August 7, 2025; McKinsey Global Risk Benchmark; McKinsey 2024 KYC/AML Benchmark Study; share of KYC and AML activities assessed as having significant potential benefit from agentic AI, in large, standardized teams. To tackle that challenge, institutions are now turning to agentic AI. With hundreds of use cases in production, it would be easy to think the industry is on its way to more efficient operations. But that would be seeing only half the picture. In fact, numerous institutions are stuck at a sole use case, with only a few building second and third use cases on the same foundations. The gap can be traced to five key decisions that make the difference between successful AI scaling and the status quo.

In previous work, we argued that agentic AI could change how banks approach financial-crime oversight—not only by accelerating expert analysis, but by assigning entire tasks to teams of AI agents, with human input reserved for validation, exceptions, and coaching.²“How agentic AI can change the way banks fight financial crime,” McKinsey, August 7, 2025. In this article, we go a step further, highlighting real-world experiences from a year of agentic AI delivery and showing how decisions about the reuse of tools and skills, when to use AI (and when not to), performance measurement, human oversight, and governance can lay the foundations for successful scaling.³Delivery figures cited throughout this article—handling times, build effort, evaluation results, run costs, checkpoint counts, and architecture descriptions—are drawn from McKinsey engagement experience across agentic AI deployments with European banks in 2025 and 2026. Institutions are anonymized unless identities are already public. Our companion article, “Agentic AI in transaction monitoring: How banks can scale AI in compliance,” shows how one institution used a single use case in transaction monitoring to do just that.

What agentic AI transformations reveal about financial-crime prevention

Based on our experience, the following are confirmed hypotheses based on agentic AI transformations in financial-crime prevention:

• Agentic AI changes who does the work. This was the central claim of our 2025 article “How agentic AI can change the way banks fight financial crime,” and it holds across domains. Agents gather and structure evidence, generate template-based drafts, and check outputs, while human practitioners validate, handle exceptions, and coach. In source-of-wealth assessments, manual verification across six pillars of income and wealth can require up to 35 hours of work (Exhibit 1). By contrast, a multiagent pipeline can conduct input collection, corroboration, extrapolation, and memo drafting, with analyst reviews at defined checkpoints, in around half the time (Exhibit 2).

• Rewiring a journey beats automating a step. Institutions that decompose an end-to-end process and assign each step to the most appropriate rule, deterministic service, agent, or human capture more value than those that add an agent to an existing workflow. Such rewiring is a key pillar of an impact-based approach. Onboarding transformations, for example, often prioritize the due diligence step which alone accounts for 30 percent of average handling time, and within it, on a small number of sub steps accounting for more than 50 percent of the effort.

• Embedded quality checking remains essential, but there is no standard agent architecture. Our 2025 article described squads of agents with a quality assurance agent in each squad. Delivery experience confirms the importance of those quality checks but shows greater variation in how they are implemented. In transaction monitoring, for example, a dedicated control squad can extract individual claims from a draft alert report and check them for hallucinations, fairness, and completeness. Elsewhere, the same function can be performed by a critic agent that evaluates outputs against defined success criteria or by an automated judge that scores outputs against a fixed reference set.

  The architecture around those controls also varies. One bank built a single generic agent to handle nearly every KYC question in an onboarding flow, with confidence checks embedded in the agent. Another used task-specific agents for extraction, consolidation, conversion, extrapolation, and drafting, connected through a multistep workflow with deterministic services between them. A third built role-based squads with a separate control squad. Each can be effective (Exhibit 3). The emerging lesson is that the number of agents matters less than choosing the right level of agent reasoning and autonomy for the task, a design choice we return to below.

Across our deployments, platform build usually runs for around ten weeks, with the first usable output coming after a couple of weeks, and the first full use case taking 4–6 months to go live in production. Redrawing roles, targets, and ways of working around a supervised agent workforce takes significant change effort, however, and remains one of the most common reasons programs stall at the pilot phase. 

These experiences point to five decisions that distinguish institutions beginning to scale agentic AI from those still building isolated use cases.

Five principles for scaling

Scaling agentic AI in financial-crime prevention is as much about the supporting architecture as the AI itself. Leading banks have moved beyond single use cases by making early decisions on five key themes.

Be clear about what you are reusing

Most institutions consider reusability at the use case level: build transaction monitoring, then map the solution to sanctions screening or KYC. These are worthy actions, but they arrive too late to shape the architecture. There are four levels of reuse available:

• Agents. The general rule is to build an agent generically, in that the same cognitive task recurs many times with different inputs. In one onboarding journey, every question but one could be answered by a single generic question-answering agent, parameterized for each question, and reusable in adjacent domains, such as prospecting. Where a process is a chain of genuinely differentiated steps—extract from documents, reconcile conflicting evidence, convert currencies, extrapolate gaps, draft a narrative—task-specific agents connected by an orchestration layer work better, and a generic agent has nothing to reuse.

• Skills. Agent-level reuse works in practice when banks package business knowledge as skills. That is, they create versioned, shared assets, kept deliberately separate from code, that any agent can draw on. The alternative is to embed policy and format knowledge in individual prompts, where it is duplicated across agents, drifts between them, and is applied probabilistically.

  Three skills recur across our deployments. A report-writing skill encodes the institution’s own output protocols—templates, style guide, tone, semantics, logos—so every agent produces a document the business already recognizes. A policy compliance skill ensures the relevant policy is read consistently by every agent and applied in the same way, rather than being supplied as an input document and reinterpreted on each run. And a critic skill standardizes output review by defining “done” through an explicit checklist and generating validation reports in a consistent form. A useful test of whether the separation has been properly made is whether a subject matter expert, rather than an engineer, can update the skill.

• Scaffolding. This is where compounding happens, and it is the most consistent pattern among the institutions that get to a second and third use case. Subsequent builds were less expensive—not because of the agents, but because of what had been built around the first use case, including the platform and orchestration layer, the evaluation harness, reusable guardrail blocks, and a delivery playbook. To obtain one control plane and one assurance surface, we have seen decision-makers consolidate a fragmented estate of AI tools onto a single platform. New developers can then contribute production agents within a week. In another example, a project leader aligned with the AI center of excellence on how reusable agents would be registered and owned before the first use case was built, so that later squads could draw on a shared inventory.
• Use cases. Portability across domains is real, but it is a consequence of agents, skills, and scaffolding, rather than a substitute for them. In one transaction analysis build, the team modularized the codebase at the outset, so the same asset could serve teams beyond financial crime. They subsequently deployed the asset into fraud and credit functions with a limited incremental build.

The practical test is whether an institution can say, before it starts building, which of the four reuse levels it is optimizing for. Those that are not clear tend to end up with several bespoke pipelines and no compounding advantage.

Reserve agent reasoning for the steps that need it

A common instinct is to address every step with an agent. The more effective approach is to ask whether a fixed, auditable rule can determine the step and, if not, whether a deterministic service can do it. Only then should you apply agent-based reasoning.

This is a discipline worth adopting based on evidence. In one onboarding build, two head-to-head comparisons went against the agent. A rule-based question routing outperformed agent-selected follow-up questions, and a structured third-party API outperformed an agentic web search, in terms of both speed and accuracy. In a source-of-wealth pipeline, deterministic services (fully reproducible, with no model involved) handled currency conversion, interpolation of missing years, document chunking, and aggregation, while agents handled extraction from unstructured documents, reconciliation of conflicting evidence, and narrative drafting. Separating deterministic vs. agentic approaches is not an engineering nicety. Every step moved to a deterministic service becomes cheaper to run, easier to validate, and less prone to hallucinations.

Measure reproducibility, not just accuracy

Agentic outputs are probabilistic: The same input can produce different answers across runs. A control that cannot be reproduced cannot be validated, and an institution that cannot demonstrate reproducibility to its second line of defense will not reach production. In our experience, this is one of the most common gaps in otherwise well-built pilots.

Leading institutions take a dual approach (Exhibit 4). They apply a factual-accuracy test —which can take different shapes—to compare outputs to a “golden truth”: field extraction precision and recall, hallucination rates in structured fields, numeric divergence, the grounding of narratives in retrieved text, and the accuracy of source document citations for extracted fields. They also deploy a test of reasoning and agentic behavior to compare outputs across multiple runs of the same input. This does not necessarily require a golden truth. Instead, they can leverage reproducibility scores, structural consistency of output schema, numeric divergence between runs, logical consistency checks, and whether the agent selected the correct tools in the correct order.

Institutions most often lack metrics for reasoning and agentic behavior, which are usually the cheapest to build because they do not require labeled data. One bank conducted ten evaluations across an onboarding flow, scoring every output on accuracy, run-to-run consistency, latency, and cost against explicit sign-off thresholds: accuracy at or above 80 percent and consistency at or above 70 percent. Across published evaluations, measured consistency ranged from 72 to 100 percent. On the weakest, roughly one run in four returned a different answer to the same input.

Two lessons follow: Consistency belongs alongside accuracy in every sign-off gate, and the variation is not random; the weakest scores fall on the most interpretive questions. Agents are close to perfect at establishing whether a company has a website or which sector it trades in but are materially weaker at making judgments—assessing whether a pattern of behavior is plausible, whether a wealth narrative is coherent, or whether an adverse media hit refers to the same person you are dealing with. That gradient should drive sequencing. Institutions that reach production fastest start where ground truth is checkable and leave interpretive steps behind a human gate.

Design human oversight purposefully

Keeping a “human in the loop” is no longer sufficient for two reasons. The first is economic. Where a fixed share of cases is subject to human review, oversight cost scales linearly with volume. This caps the productivity gain wherever that share is set. Our research on the economics of agentic workflows finds that when an agent performs a customer service task in banking, token costs account for only 20 to 25 percent of variable-run costs, while human oversight accounts for 70 to 75 percent.⁴“Where AI agents pay off: A practical guide to the economics of agentic workflows,” McKinsey, August 24, 2026.

Delivery adds a second cost line. At one large European bank, the marginal cost of running a transaction-monitoring case through the agent factory was approximately €2.50 before optimization—and roughly half of that was not the analysis but the automated quality control wrapped around it. That pattern is not specific to financial crime. Our research on agentic economics finds that roughly 60 percent of an agentic task’s cost is tied to refining answers, rather than producing the first answer.⁵“Is that AI agent worth it? Agentic economics and the modern operating model,” McKinsey Quarterly, July 13, 2026. Optimization can take out more than half that. Potential levers include cheaper models for simpler subtasks, caching to remove duplicate calls, trimming the data passed between agents, and moving quality control from every case to a sample. The last of those achieves its savings by reducing the frequency of quality checks, which in a regulated function is a control decision rather than an engineering decision. Still, the general rule is that assurance is the most expensive part of an agentic pipeline, whether paid for in human time or in tokens.

The reason that having a human in the loop is no longer sufficient is supervisory. In a June 2026 consultation report, the Financial Stability Board pointed to “the impracticality of real-time human monitoring of agent decisions as their use scales.”⁶Sound practices for the responsible adoption of artificial intelligence, Financial Stability Board, June 10, 2026. In addition, second-line functions, internal audit, and supervisors increasingly require specifications on who reviews what, at which step, and with what supporting evidence. Three approaches help frontline teams meet those needs:

• Place gates where judgment is actually required. In one source-of-wealth pipeline, an end-to-end run covers roughly 60 subtasks and completes it in 15 to 30 minutes, with three human checkpoints. At each gate, the reviewer is given specific tasks: validate the employment timeline for completeness and consistency; assess the narrative with a particular focus on data points that are not corroborated or are only partly corroborated against high materiality; and perform a final factual and numerical check of the memo.
• Define autonomy as a ladder, with each rung tied to a confidence threshold. This can mean the agent makes a recommendation, and a named colleague makes the decision; the agent acts, but a human may override the decision within a defined window; the agent acts, but a human is notified but not required to approve; or the agent acts without any human involvement. Each rung carries a higher confidence bar and an explicit check on whether the step is subject to regulatory gating.
• Engineer the confidence gate rather than asserting it. One bank grades source authority and entity-match strength into confidence bands. Only the highest band is consumed without human review, and ungrounded answers are suppressed rather than returned. This is a materially different design choice from returning a low-confidence answer with a caveat.

Through an effective combination of agentic workflows and specified human oversight, banks can conduct tasks such as source-of-wealth assessments up to 50 percent faster.

Build AI risk governance ahead of scale

AI development is outpacing AI risk governance development, and one consequence is consistent across banking: Approval of the first few use cases takes six to eight months, but ongoing monitoring is still unresolved when the second use case arrives. Risk and security concerns, rather than technology, are the most commonly cited obstacles to scaling.

Agentic systems stress existing frameworks in specific ways, so the starting point should be to name those risk drivers. Opacity makes regulated decisions harder to explain. Equally, nondeterminism produces confident but fabricated outputs, while errors compound at the speed and scale of deployment. Agents take action rather than produce recommendations, which raises a question no framework yet addresses effectively: How does a senior manager demonstrate reasonable steps to oversee a system that operates faster than human cognition? Models drift as data environments change, and monitoring intervals designed for periodically retrained models are too long for systems that change continuously. Finally, sector reliance on a small group of AI vendors concentrates risk.

Institutions that scale successfully often incorporate six basic design components (Exhibit 5):

• Risk principles and guardrails should include an enterprise risk appetite that defines approved, conditionally approved, and restricted uses and a risk taxonomy extended to cover agentic-specific risks such as agent autonomy and inter-agent trust.
• Intake and analysis should use defined use case archetypes carrying their own risk profiles, allowing low-risk cases to follow a light-touch path, while high-risk cases are subject to tailored review.
• Triage, mitigation, and model risk management should include approval routing by archetype, a control library mapped to risks, and a defined model risk management perimeter for generative and agentic use cases.
• Ongoing monitoring is necessary at both the platform and use-case level, including for drift, hallucination, and misuse, with trigger-based escalation processes.
• Governance and operating model frameworks should define roles and responsibilities across the three lines of defense, including the forums for challenge and escalation.
• Enablers are the talent, tooling, and AI inventory; without them, governance remains policy on paper.

Within the six-component framework, a handful of controls do disproportionate work, and they are often the controls second-line reviewers ask about first:

• Controls on inputs. Screen inputs for injected instructions, separating trusted configuration from untrusted content and validating every input before an agent acts on it. Prompt injection is the agentic analogue of the structured query language (SQL) injection banks already control for, and an agent with tool or database access widens the blast radius of an attack considerably.
• Controls on data. Tagging sources with sensitivity labels at ingest, which blocks agents from unclassified sources, routes sensitive fields to a separate access-controlled store, and helps banks measure sensitive-data exposure (when an agent reveals unnecessary personal data either in its output or in its reasoning trace).
• Controls on outputs. Check claims for hallucinations, require answers to be supported by cited sources, and suppress unsupported answers rather than returning them with caveats.
• Controls on access. Security should include a tracked identity for each agent, tool-level allow lists, read-only scope by default, just-in-time elevation when broader access is needed, and an append-only cross-system audit trail. Testing should be continuous and cover the same ground—prompt-injection tests for hostile inputs, hallucination tests, and replay tests confirming the agent selected the right tools in the right order.

One further principle is worth adopting wholesale from our work on agentic economics. That is, banks should refrain from operating any autonomous system without a defined mandate, a budget, and a stopping rule.⁷“Is that AI agent worth it? Agentic economics and the modern operating model,” McKinsey Quarterly, July 13, 2026. In a regulated control function, each of these three elements is also a control, and each is straightforward for a reviewer to evidence.

For agentic use cases, teams can set an initial risk tier by scoring four drivers: the level of agency the system has without human intervention, the business impact if it is wrong or manipulated, the sensitivity of the data it processes, and the action surface where it can operate. That scoring can support a tiered approach with standardized controls by risk level, which is what makes a scalable but safe intake process possible.

Model validation needs to be extended rather than replaced. The familiar dimensions still apply, but agentic systems also require assessment of the reasoning architecture itself, including the rationale for an agentic approach, the choice of foundation model and tailoring technique, prompt quality, hallucination tolerance given the use case and citation capability, and controls implemented across the technology stack. It is also worth noting that a large language model cannot generally be validated as a model. Validation should focus on inputs, outputs, and the robustness of the pipeline.

Key considerations for AI risk management in financial-crime prevention

The following are essential considerations for anyone aiming to build safe solutions:

• Supervisors expect banks to validate agentic systems, but guidance is often unclear, which leaves the burden with the institution. For example, supervisors have not issued model validation guidance specific to agentic AI, and the European Central Bank (ECB) has made it clear that generative and agentic systems introduce qualitative changes that cannot necessarily be addressed by extending conventional controls.⁸Pedro Machado, “Technology is neutral, governance is not: AI adoption in the banking sector,” keynote speech at the KPMG RiskTech Conference, Frankfurt am Main, February 24, 2026, ECB Banking Supervision. AI adoption sits within the ECB’s supervisory priorities under operational resilience,⁹“Supervisory priorities 2026–28,” ECB Banking Supervision, accessed September 2026. and the European Banking Authority has made AI and machine learning a priority, while noting that some banks are researching general-purpose AI in areas including AML and combating the financing of terrorism (CFT).¹⁰“Special topic - artificial intelligence,” in Risk Assessment Report - November 2024 European Banking Authority, November 2024; Work programme 2026, European Banking Authority, October 2025. This is why the measurement and evaluation discipline described above is worth building before a supervisor asks for it. Institutions that can show how they test, which thresholds they hold to, and what happens when a threshold is missed are helping to set the standard.

• Teams should determine in the design phase whether a given financial-crime system falls within the EU AI Act’s high-risk regime. The act sets responsible-AI requirements and, under Article 14, mandates human oversight for high-risk systems.¹¹Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024, Official Journal of the European Union, July 12, 2024, L 2024/1689. Classification depends on what the system actually does and what it is functionally linked to, and applications in this domain differ materially in that respect. For example, an onboarding solution that shapes a customer’s access to banking services is a different proposition from an internal tool that triages alerts for an investigator. This is a question for legal and compliance counsel on a use case basis and is worth settling before the architecture is fixed.

  National supervisors are gearing up to apply the EU AI Act. The Federal Financial Supervisory Authority of Germany (BaFin) has said it will examine how banks use AI in direct connection with regulated activities, with high-risk obligations applying from December 2027. In July 2026, it established a dedicated anti-financial-crime function.¹²“Market surveillance of AI: BaFin granted new powers,” BaFin press release, July 29, 2026; “BaFin stärkt Bekämpfung von Geldwäsche und Terrorismusfinanzierung” [BaFin strengthens fight against money laundering and terrorist financing], BaFin press release, May 27, 2026. De Nederlandsche Bank’s 2026 integrity supervision prioritizes the sector’s growing use of AI, alongside the establishment of the EU Anti-Money Laundering Authority.¹³Integrity supervision in focus 2026, De Nederlandsche Bank, June 25, 2026.

• Many supervisors question the human-in-the-loop controls most institutions rely on. As stated above, the Financial Stability Board has noted that the real-time human monitoring of agent decisions becomes impractical as agent use scales. In the United Kingdom, regulators have signaled that AI risk should be governed through existing risk appetite frameworks, but with an emphasis on outcomes. As of late 2026, the Financial Conduct Authority has eight firms live-testing agentic applications, including anti-money-laundering detection and KYC, with an evaluation report expected in the first quarter of 2027. That will be the first quasi-independent read on agentic performance in this domain from any supervisor.¹⁴“FCA announces second cohort of AI live testing,” Financial Conduct Authority press release, April 21, 2026. Until it lands, an institution that can specify the human who reviews, what they review, at what frequency, and against what evidence is in a stronger position than one that can only assert that a human is involved.

The practical implication is that waiting is suboptimal. The establishment of the EU Authority for Anti-Money Laundering and Countering the Financing of Terrorism is raising expectations across the region as sanctions enforcement intensifies. EU fines have totaled roughly €480 million since 2017, including approximately €90 million in 2024, and the number of designated persons and entities has risen nearly fivefold since 2017.¹⁵“Securities services firms and sanctions: Six steps to managing risk,” McKinsey, December 11, 2025.

The Wolfsberg Group offers a useful framing for boards. Its August 2025 statement on effective monitoring for suspicious activity states that model-risk governance should be tailored to the particular nature of financial-crime models. The aim is that model risk is balanced against financial-crime risk, rather than treated as the only risk in view, so that innovative approaches can be deployed faster.¹⁶“Statement on effective monitoring for suspicious activity part II: Transitioning to innovation,” Wolfsberg Group, August 27, 2025. Pillar two is the balancing of model risk against financial crime risk.

In financial-crime prevention, agentic AI has moved from concept to production faster than most institutions expected—and the value is real. But we are still at the beginning of the process. Our 2025 article described a productivity ladder running from a proficient practitioner through to a practitioner using gen AI tools, working with agent assistants, and finally supervising a digital factory of agents.¹⁷“How agentic AI can change the way banks fight financial crime,” McKinsey, August 7, 2025. Productivity across our engagements today is about twice what it was at baseline and at constant or higher quality, which is the agent-assistant rung. Still, the top of the ladder remains untested, and reaching it depends on three shifts: oversight that is purposeful rather than uniform, quality assurance that moves from checking every output to monitoring agent behavior, and a better way to optimize process steps than simply adding agents.

The institutions already moving up the ladder are those that are clear about what they are reusing, as well as those that are implementing reserved-agent reasoning for the steps that need it, measuring key metrics such as reproducibility from the first use case, deliberately designing oversight, and putting governance in place before scaling.

Leading institutions are transforming financial-crime prevention operations from a manual, document-heavy exercise into a continuous, event-driven, high-quality workflow. In the process, they are becoming more consistent—and boosting auditability and the customer experience while reducing costs. Most importantly, they are building financial-crime prevention capabilities that they can scale at speed.