Who Decides What Counts as an Explainable AI Decision in FCC?

AI explainability in financial crime compliance (FCC) is the ability to show how and why an automated decision was reached in plain, actionable terms. With the growing uptake of AI, from prioritising alerts to shaping onboarding, screening, and monitoring decisions, regulators are increasingly incorporating explainability into their requirements.

Explainability is not defined by a single rule and, globally, regulators have each taken positions, differing on who is owed an explanation, how binding it is and how much detail it requires.

1. EU AMLR Article 76(5): The Customer's Right to an Explanation

From 10 July 2027, the EU Anti-Money Laundering Regulation (AMLR) permits decisions resulting from automated processes, including AI systems, provided three conditions are met:

1. The data processed is limited to data obtained through customer due diligence (CDD).

2. Decisions to enter, refuse, or maintain a business relationship, carry out or refuse an occasional transaction, or adjust CDD measures are subject to “meaningful human intervention to ensure the accuracy and appropriateness of such a decision”.

3. The customer may obtain an explanation of the decision and challenge it, except where it relates to a suspicious transaction report.

This is the only binding, AML-specific explanation right among the seven positions. The regulation does not, however, define “meaningful human intervention” or what an adequate explanation must contain.

2. HKMA: Explainable AI in Financial Crime Monitoring

The Hong Kong Monetary Authority (HKMA) has been one of the most active supervisors on AI in financial crime. Its 2019 High-level Principles on AI require applications to be “explainable (i.e. no black-box excuse) to all relevant parties”, with boards accountable for all AI-driven decisions. In 2024 it asked banks with significant Hong Kong operations to consider AI for money laundering and terrorist financing monitoring.

Its June 2026 report goes further: “Supervisors expect explainable, well governed A.I. that demonstrably improves effectiveness rather than merely efficiency.” Unlike the AMLR’s approach, the HKMA’s 2019 consumer protection principles exempt AML and fraud monitoring from explanations to customers. In Hong Kong, the audience is the supervisor and internal audit.

3. MAS: Explainability Scaled to Materiality

The Monetary Authority of Singapore (MAS) finalised its Guidelines on AI Risk Management on 7 October 2026. They take effect from 7 October 2027, with life cycle controls, including explainability, expected by 7 October 2028. The degree of transparency and explainability “should reflect the context and nature of the AI use case and its assessed risk materiality”, judged on impact, complexity, and reliance.

For FCC, MAS names financial crime as an AI risk, warning that uncertain AI behaviour in AML “could mean that suspicious transactions go undetected”. Where a use case does not affect customers, explanations may still be needed for internal stakeholders involved in oversight or validation. If a model cannot achieve an appropriate degree of explainability, MAS expects firms to reassess whether it suits the use case.

4. Wolfsberg Group: Explainability Built for Financial Crime

The Wolfsberg Group is an association of global banks rather than a regulator, but its guidance is written specifically for FCC. Its 2022 principles call for AI that “results in fair, effective, and explainable outcomes”, with firms responsible for decisions that rely on AI, whether developed in-house or sourced externally. It also cautions that transparency should not facilitate evasion or breach reporting confidentiality.

Its 2025 statement on monitoring for suspicious activity asks firms to explain their approach through three lenses: risk coverage; model design, development, and calibration; and model usage. On usage, its stance is clear: “there is always a need to explain why an alert was generated in the first place”, for example through the features that influenced the output.

5. FCA: Existing Rules, New Pressure

The UK's Financial Conduct Authority (FCA) has said it does “not plan to introduce extra regulations for AI”, relying instead on the Consumer Duty and the Senior Managers and Certification Regime. It expects AI systems to be “appropriately transparent and explainable”, while acknowledging its framework “does not specifically address” explainability.

The FCA's Mills Review, published in July 2026, raises the bar: “A useful answer is not enough if the basis for it cannot be reconstructed.” Firms need to show how a decision was reached, not just that it was accurate. For FCC, each alert decision should be traceable to the data and reasoning behind it.

6. CJEU: What a Meaningful Explanation Must Contain

Two Court of Justice of the EU (CJEU) rulings on credit scoring under the GDPR, rather than FCC, set the closest legal benchmark for an explanation's content.

In SCHUFA (2023), a customer was refused a loan based on a score from a German credit agency. The Court held that the score itself counted as automated decision-making where a lender “draws strongly” on it, even though the lender formally made the decision. An AI output relied on heavily may therefore be treated as the decision, even when a person signs it off.

In Dun & Bradstreet Austria (2025), a mobile operator refused a customer a €10-a-month contract after an automated credit check. The Court required an explanation of “the procedure and principles actually applied”, adding that “a complex mathematical formula, such as an algorithm” is not enough. Where appropriate, this could include how a change in the data would have led to a different result. The Court also held that trade secrets do not justify refusing an explanation outright.

These rulings offer a reference point for the AMLR's undefined standard.

7. FSB: Explainable AI or Compensating Controls

The Financial Stability Board (FSB) has flagged limited explainability as a risk since 2017. Its June 2026 consultation on sound practices, which is not yet final, proposes that firms “adopt more explainable AI, or consider compensating controls” where appropriate. It accepts that explainability may matter less in some uses, citing fraud detection, and names AML/CFT among relevant use cases.

What Do the 7 Positions Mean for FCC Teams?

Key takeaways:

• The EU AMLR is the only binding, AML-specific explanation, applying from 10 July 2027.

• Hong Kong and Singapore expect explainable AI, with Singapore scaling expectations to risk materiality and naming financial crime as an AI risk.

• The Wolfsberg Group and FSB point to explainability across coverage, design, and usage, or compensating controls where it is limited.

• The FCA and CJEU show that a disclosed algorithm is not, on its own, an explanation.

• Across all seven positions, accountability stays with the institution.

Explainability is becoming a design requirement. Silent Eight's Iris platform is built with this in mind: every decision carries a natural-language rationale and a structured evidence trail, within policy boundaries set by the compliance team. Human-in-the-loop oversight is built in, as decisions that meet predefined conditions, or fall outside those boundaries, are escalated for human review.

As explanation becomes a supervisory and customer expectation, the systems that hold up will be those designed to explain every decision from the start.