Faced with ever more sophisticated threats, financial institutions continue to bolster their financial crime and compliance teams, adding new layers of expertise, controls, and oversight capabilities. But these enhancements, and a growing regulatory agenda, demand ever more time and resources. In response, many institutions are betting on agentic AI to boost productivity and achieve better outcomes.
While earlier automation programs sharpened individual compliance steps, agentic AI adds value by orchestrating the entire process, from gathering, researching, and synthesizing data to making documented recommendations. This frees up humans to take on more valuable tasks.
Banks that make the most of agentic AI understand that it is more than a bolt-on technology. The most effective implementations also change how financial-crime prevention and wider compliance teams operate. Those impacts are predicated on building sharper capabilities across the operating model, from data and tech to employee skills, operations, and risk management. The upside is that domain redesign provides a blueprint for agentic rollout.
Drawing on a year of banking industry deployments, this article sets out some key principles. Building on our companion article, “Agentic AI in financial crime prevention: Lessons from winners,” it demonstrates how a niche AI use case in transaction monitoring can both create more efficient operations and lay solid foundations for scaling.
From assistants to end-to-end processes
AI in compliance is no longer the exception; nearly every bank has adopted the technology in some form and to some extent. But most of these efforts focus on supporting individuals. A tool summarizes documents for the analyst, drafts a section of the report, or answers a question about policy, and the analyst then works the case as they did previously.
The next task is to build an end-to-end process in which agents conduct the entire investigation, with every step traceable for quality team, auditor, or regulator review. Effectively implemented, this can produce better and more consistent outcomes while reducing human touch and raising productivity.
Banks that have taken a lead on fully integrating AI highlight five key choices in design and implementation:
- They design to quality, with 30 to 50 percent of the agent network dedicated to quality assurance and traceability.
- They divide the work so that agents and humans leverage their strengths and complement each other. The agents do the data analysis, research, and synthesis and the humans decide, add information, and fill the gaps in the data.
- They keep the economics visible, down to token consumption per case, and optimize economics by choosing the right type of model or tool for each individual step/purpose across workflows.
- They build highly iteratively with close involvement of functional experts.
- They actively manage the risks introduced by the use of AI into the redesigned processes.
The usual starting point is a single use case, which helps banks develop the skills and capabilities that can be applied across domains. Germany’s Commerzbank followed exactly that path with a recent proof of concept in transaction monitoring, which laid the foundations for a more far-reaching agentic AI program (see sidebar, “How Commerzbank used AI to create impact in compliance”).
Building the foundation
The thesis underlying agentic AI transformation is that a combination of technology and new ways of working can drive the transition from analyst-based to agent-orchestrated investigation. In that model, AI agents independently gather data, structure evidence, test hypotheses, understand documents, and make recommendations. Humans provide evaluation and monitoring to ensure good outcomes, manage model risk, and check for bias. For financial-crime experts, that means less time collecting and curating data (from both structured and unstructured sources) and more time exercising judgment on complex situations.
Building the new platform requires commitment and planning. The experience of several leading banks shows that a useful starting point is to construct three supporting pillars:
- Pillar 1: Deploy an agentic AI platform. Project teams should ideally deploy an agentic AI platform in the cloud environment, as well as integrate a large language model (LLM) platform and set up a continuous delivery pipeline. Within weeks, they should be able to access their data sources and systems. An important element, given how fast LLMs and tooling for running agent networks and managing data are evolving, is to embed portability, enabling export to other agentic AI platforms. Once the platform is in place, teams can orchestrate AI agents at scale, with nontechnical officers managing and developing the agents over time.
- Pillar 2: Build the agentic AI factory. An agentic AI “factory” is a network of agents and deterministic tools that runs processes from triggering events to outcomes. To minimize rework, leading banks design outputs to be complete, consistent, and accurate from day one, with quality checks running alongside. In transaction monitoring, agents automatically pick up each new alert, conduct plausibility checks, develop pro/con reasoning, and draft reports and recommendations. A first version can typically be built within weeks and will serve as a scalable blueprint for wider operations.
- Pillar 3: Include quality and governance by design. Leading banks emphasize the importance of designing an evaluation framework to ensure model accuracy/quality, reliability, and fairness. They introduce human-in-the-loop reviews, focusing subject matter experts (SMEs) on judgment and decision-making rather than manual report drafting. Every intermediate result is stored, so that a reviewer, auditor, or regulator can trace each conclusion back to source data.
Taken together, the three components can have a significant impact. In transaction monitoring investigations, we have seen banks achieve a more than 40 percent reduction in human processing time. Quality improves, too. Measured against a predefined checklist, agent-generated reports achieve higher levels of completeness than analyst-written reports, with every claim referenced to its source and every report screened for bias. Agent-generated reports are also consistent from one alert to the next, with the same time window for the transaction analysis and the same structure every time.
Five basic steps
Successful AI implementation is based on the principle that LLMs can perform labor-intensive tasks previously undertaken by humans, contingent on humans managing and overseeing the process. Whether the application is in transaction monitoring or elsewhere, five basic steps can help:
- Decompose and redesign processes. Project leaders should define the scope and steps for each process and then decompose individual processes into substeps, including firmly defining completion. The redesign should start from the question of how AI and humans can best divide the work, rather than from traditional standardization. Agents are unburdened by legacy norms, so the process can be shaped by what they can do reliably and where a person needs to step in, rather than by what was previously practical for a team of analysts. Given AI’s processing speed, for example, no process shortcuts are necessary, which adds to overall completeness. That said, all steps need to be explicit, and the decision framework must capture more than policies—for example, including the factors and the context of each transaction that determine how a case should be read. That part of the work can only be completed with the help of compliance experts.
- Design the collaboration model. The target should be that agents deliver information that is so dependable that humans can focus on the most important deliverables rather than on every intermediate step. For that to work, the system must state where its output is reliable and where it is not: which findings rest on complete data, where information is missing, and where a person should challenge a conclusion. In practice this means separating common patterns (where an agent with the right information can reliably prepare the decision) from new or unusual patterns, where the agent should stop and prompt the human for review. The system should guide the human to the points that need judgment, in addition to presenting the final result for sign-off.
- Take two steps to orchestration. First, design and write the squads required to deliver new processes (likely 15 to 20 squads of three to five agents each). For each squad, define inputs (parameters) and outputs and build deterministic tools, for example, to pull data or calculate a KPI. This will include deciding which LLM to use per agent to maximize utility but also to keep token cost under control. In addition, each agent requires prompts, guardrails, and context. Autonomy can vary depending on the task at hand: Following a predetermined process does not require agentic coordination, whereas creative and unpredictable process steps benefit from some form of autonomy. Teams must also design the workflows to connect agents. Depending on the complexity of individual tasks, they might take a squad approach, where one agent acts as planner, coordinating and launching the other agents within the squad, or alternatively design for a single atomic agent per step. The second step is to design and implement workflows across squads. This will mean describing the agentic AI factory, the sequence of squad launches, and how they are connected.
-
Embed an evaluation framework. Evaluation metrics are a critical element of platform risk and performance management. Leading banks often focus on three dimensions: accuracy and quality (defined as accuracy against data sources and completeness), reliability, and fairness. The model measures each of these against predefined checklists. The control layer must be substantial. In the systems we have seen, 30 to 50 percent of the agent network is dedicated to quality control and traceability. In that context, critic agents check each claim against its source and each report against a checklist before anything reaches a human.
Evaluation frameworks uniquely enable decision-makers to steer the development process and track use cases over time. This ability to assess output quality becomes even more powerful when institutions scale agentic capabilities across compliance activities. One benefit is that adaptation can be achieved faster. When a new pattern appears or an error is found, the correction is usually a change to a prompt or a checklist made in days, rather than a new release of a core system that takes weeks or months. For analysts, the shift is from document management to risk decision-making. They can spend their time on targeted case analysis, based on the points the system flags for them, and on supervising agents and refining their capabilities through better prompts.
- Manage costs and economics. The economics should be managed with high levels of visibility: Token consumption can be tracked per case, so the network can be tuned, for example, by routing simple steps to cheaper models or by sampling rather than running every quality check.
With these design features in mind, the process can be faster, more consistent, and cheaper. From gathering data and establishing the facts through synthesis, interpreting scenarios, and requesting missing information, agents can do far more per case than any analyst has time for. Moreover, the analysis goes deeper, leaving humans to concentrate on interpretation and judgment, especially in more complex cases. In one proof of concept, agents reviewed an extensive history of transactions for every alert, including customers with more than 15,000 transactions in that window. They also ran the same eight web-based checks on every case, pulled in every previous alert and case for the customer, and drafted follow-up questions to the customer where information was missing.
The new setup rebalances the capabilities a transaction monitoring team needs. In the traditional way of working, 60 to 70 percent of people are employed in the process itself, often in nearshore or offshore locations, while 20 to 25 percent work on the IT systems that support the process, and 10 to 15 percent are responsible for quality control, assurance, and audit. With agentic AI, the effort required for the process falls by 30 to 50 percent. The 20 to 25 percent in IT shift to enabling agents and connecting the system to the AI platform and the data, and the 10 to 15 percent in quality control shift to monitoring the system and improving it.
Making it real
While a good starting point for agentic rollout is a single use case, the technology offers opportunities across the compliance domain. Thus, a well-designed use case in transaction monitoring would generate artifacts that are reusable across fraud, sanctions screening, and KYC. The blueprint would be technology agnostic and usable by those who are not technologists, enabling teams to adopt a continuous improvement mindset. Furthermore, the approach is not limited to financial-crime prevention and compliance. One large bank built a multiagent system based on the same principles discussed here and drafted financial-risk assessments for corporate credit, halving the time credit officers spent on analysis.
Whatever the use case, a reasonable expectation should be to capture real value in a relatively small amount of time. A useful way to approach the redesign is on three horizons:
- Horizon 1: Prove technical viability and confirm business value. Deploy a first use case and use it to establish a minimum viable product, which would include core enablers such as data interfaces and storage. Start to build skills into the domain, including offering training to nontechnical SMEs to develop and manage prompts. Decision-makers should also decide on how far they would like to take automation, which will inform decisions on governance and support, as well as upskilling.
- Horizon 2: Scale scope of use case. Once the first version of the use case is in place, extend the project to cover incremental steps in the process (for instance, in the example mentioned here, second-level alerting, drafting suspicious activity reports) or to cover a wider portfolio of inputs. This can leverage the infrastructure that was put in place on Horizon 1.
- Horizon 3: Scale across the domain. Leverage newly developed capabilities and skills to scale technique to new processes (for example, in financial-crime prevention, this could be fraud, KYC, or regulatory compliance). Leverage experts involved in the first use case to help with training.
Armed with an agentic blueprint, and backed by cross-functional build teams and leadership sponsorship, institutions can drive productive transformation. But a vital element is a risk-based mindset. During the development phase, that means applying the evaluation framework to the risks associated with each use case. In addition, AI systems must be designed with built-in safeguards to ensure reliable performance in production, with independent testing applied to customer-facing and other risky use cases. Key design features should include multiple automated control layers and a human in the loop to support oversight and accountability.
Once deployed, AI models must be closely monitored. This will include evaluating human interactions with the model (for example, comparing model outputs with human-approved decisions), tracking key performance metrics to detect issues such as model drift, and making iterative improvements when deviations are identified. Robust governance structures and risk management are essential.
The technical prerequisites for these capabilities are significant. They include obtaining access to high-quality data and securing it, as well as decomposing workflows into the agent network. That said, the process of human change often presents the toughest obstacles. Three key elements define that challenge:
- Trust. The experts who will work with the system must get past two things: the sense that an agentic workflow is an alternative to human analysis and doubt about whether the machine’s output can be relied on. The second concern raises two design questions. Where does the machine’s work end and the human’s begin? And how does the system signal how reliable a given output is, so the human knows when to take over? The answers have to be visible in the output itself, which is also what makes the process traceable and auditable.
- Continuous collaboration. The monitoring described here only works if data scientists and compliance experts keep working together after go-live, adapting the agent network to new scenarios and refining how humans work with it.
- Organizational change. Part of the productivity gain should be reinvested in monitoring and managing the system. The function that emerges, and the capabilities it needs, look quite different from today’s process-led setup. This applies even more when the process is nearshored or offshored and quality control and process management sit far from compliance experts.
Transaction monitoring investigations, and financial-crime prevention more broadly, are compelling examples of activities that can benefit from agentic transformation. To make the most of the opportunity, the urgent task for decision-makers is to assess their options and to act decisively in areas where agentic solutions can produce better outcomes.
