Skip to content
Press / to search

Financial Crime Operations

Agentic KYC, AML, fraud, and sanctions casework with policy-bound investigation, human adjudication, and audit evidence.

Use Case PlaybookLast reviewed:
At a glance

Purpose

Help financial-crime teams move from alert queues to evidence-bound case decisions. A conforming runtime can coordinate investigation agents that gather facts, compare policy, draft narratives, and recommend disposition while keeping policy- or regulation-designated decisions with accountable humans.

The roles/gates below are illustrative institution policy, not universal AML/sanctions rules or regulatory approval. An accountable domain owner determines current jurisdiction, reporting, confidentiality and retention duties. FATF’s digital-transformation research is context, not certification of this workflow. Admit exact enterprise and any required durable/high-assurance profiles with actual features and current deployment evidence; the repository does not run case systems or filings.

Why this is agentic-first

KYC, AML, sanctions, and fraud workflows are not single prompts. They require multiple evidence sources, policy interpretation, identity resolution, adverse-media review, transaction analysis, case writing, and supervisory approval. McKinsey describes agentic AI in financial-crime contexts for client onboarding, KYC refreshes, transaction monitoring, sanctions, and fraud investigations from alert to case closure.

ContextOS is useful because every case must explain why the agent touched each source, which rule fired, who approved the disposition, and which evidence snapshot supports the decision.

Context Pack

LayerRequired entries
decision_layer.decision_specs[]fincrime.alert.triage, fincrime.kyc.refresh, fincrime.case.disposition, fincrime.report.file
policy_layer.policy_bundles[]AML policy, sanctions policy, fraud policy, customer risk policy, data-retention policy
policy_layer.approval_gates[]GATE_INVESTIGATOR_REVIEW, GATE_MLRO_APPROVAL, GATE_REGULATORY_REPORT
tooling_layer.adapter_registry[]adp_corebanking.lookup, adp_kyc.fetch, adp_txn.analyze, adp_sanctions.screen, adp_case.update, adp_report.file
memory_layer.memory_policy.write_classes_allowedevidence_link, correction, decision_outcome; case-pattern labels are domain content, not additional canonical write classes
evaluation_layer.eval_targets[]P/U/L/S/E targets; false negatives, escalation quality, narrative completeness and review acceptance are domain-suite metrics

Agent roles

AgentResponsibilityBoundary
Alert Triage AgentClusters alerts and resolves customer, account, and transaction identity.Cannot close cases.
Evidence AgentFetches KYC, sanctions, transaction, and adverse-media evidence.Read-only except case notes.
Policy AgentMaps evidence to policy rules and required case fields.Cannot override policy.
Narrative AgentDrafts an evidence-linked case summary, rationale and timeline for qualified review.Draft only; fluency is not filing validity.
Supervisor AgentChecks completeness, contradictions, and approval requirements.Can block disposition.

Execution flow

  1. invokeAgent arrives with intent=fincrime.investigate, alert IDs, jurisdiction, customer ID, and queue priority.
  2. Trusted admission resolves current policy/source/jurisdiction/retention/schema pins and exact controls; the compiler consumes supplied structured inputs and stops on applicable policy-expression errors.
  3. Alert Triage Agent clusters duplicate or related alerts.
  4. Evidence Agent gathers account, KYC, transaction, sanctions, and adverse-media evidence.
  5. Policy Agent evaluates rule matches and required fields.
  6. Narrative Agent drafts a case package with citations and gaps.
  7. Supervisor Agent verifies evidence completeness and conflict status.
  8. Low-risk false positives can be recommended for human batch approval. Suspicious activity, sanctions hits, or regulatory filings require named approval.
  9. The Gateway validates complete stored action/payload/destination/pin approval, eligible current roles/quorum and atomic redemption, plus current scope/revocation, actual boundary/data routes and aggregate reservation before owned operation dispatch.
  10. The implementing runtime emits a DecisionRecord with decision_key="fincrime.case.disposition".

Separate recommendation, authorized disposition and verified filing/case-system postconditions. A lost filing acknowledgement leaves an unknown stable operation and uncertain reservation; follow the institution/provider reconciliation path rather than submitting again from a timeout or expired key. Checkpoints preserve original case/release interpretation, current ownership/fencing and shared budget/deadline; delayed approval does not refresh authority. Protected correction/withdrawal is a new independently governed operation.

Verify actual purpose, source classification, recipient/model processor, residency, access and retention for customer records, adverse-media content, drafts, telemetry, caches and exports. A reviewer agent or generic consent flag cannot authorize disclosure. Keep personal/work and tenant scopes separate, govern derivative memory proposals/copies and preserve required independent review. Execution Contract and Conformance define the runtime/evidence limits.

Decision gates

GateTriggerRequired evidence
GATE_INVESTIGATOR_REVIEWAny case closure, escalation, or customer risk-rating change.alert cluster, rule matches, evidence refs, narrative
GATE_MLRO_APPROVALSuspicious activity recommendation or high-risk jurisdiction.full case package, policy citations, reviewer notes
GATE_REGULATORY_REPORTFiling, correction, or withdrawal of regulated report.filing payload, jurisdiction rule, approval chain

Failure modes

  • Identity collision - verify authoritative source identifiers and CEID-linked evidence for customer/account/transaction relationships. A SID or similarity score is a retrieval feature, not proof of identity or authority.
  • Source conflict - contradictory KYC or sanctions data triggers escalate instead of disposition.
  • Policy version mismatch - admission validates the supported pinned policy set and interpretation; the compiler does not implement a universal version resolver. Resume under a changed set requires explicit migration/reauthorization.
  • Narrative without evidence - Supervisor blocks case updates when claims lack evidence_refs.
  • Over-automation risk - high-risk decisions stay as recommendations until human approval.

Metrics

  • Case package completeness.
  • False-positive/false-negative performance on declared labeled, stratified cases, with sampling, unknown outcomes and review limits disclosed rather than assuming all live misses are observable.
  • Investigator acceptance rate.
  • Time from alert to first decision.
  • Regulatory filing defect rate.
  • Number of policy gaps discovered through operator correction.

Research signals