A Question the Room Didn’t Want to Answer

Last week, I facilitated a boardroom discussion with financial crime professionals and posed a deceptively simple question: would you allow an AI Agent to complete a financial crime investigation, reach a conclusion and, where appropriate, submit a Suspicious Activity Report (SAR) to the authorities? 

Support for AI-assisted investigations was easy to find. Confidence fell when we removed the human decision-maker.

That hesitation is understandable. Regulators, banks, and the public should expect accuracy, explainability, resilience, accountability, and meaningful oversight from any system empowered to make consequential decisions. But the conversation exposed an uncomfortable asymmetry. 

We are asking AI to demonstrate its trustworthiness against demanding standards while often accepting the performance of established human-led processes as the baseline. 

That is the financial crime paradox. The more consequential the decision, the more proof we demand from new technology – while often accepting the effectiveness of existing processes without the same level of comparative evidence.

What if that baseline itself deserves closer examination?

The Uncomfortable Baseline

Recent enforcement actions are a reminder that financial crime failures are rarely confined to a single point in the workflow. Detection can be incomplete; potentially suspicious activity may not reach investigators; decisions may be inconsistent; reports may be delayed; and governance may fail to identify or correct the weaknesses.

Financial crime failures can occur at every stage of the workflow

Were weakness can arise, from detection to oversight

On 13 October 2026, three US authorities acted against Bank of America. 

FinCEN penalised the bank for failing to mitigate and report priority national security risks [1], while the Office of the Comptroller of the Currency (OCC) assessed a penalty for a deficient and ineffective BSA/AML compliance programme [2], and OFAC announced a settlement over apparent sanctions violations [3]. 

As part of its FinCEN resolution, the bank admitted wilfully violating the Bank Secrecy Act, including failing to file SARs.

Raising this case illustrates a broader question, without making one institution the target of the argument. The OCC described deficiencies in transaction monitoring, escalation, staff expertise, reporting, and oversight. Those findings do not in themselves prove that AI would have delivered a better outcome. They do, however, demonstrate that familiar processes, extensive policy frameworks, and human involvement cannot be treated as proof of effectiveness in themselves.

Banks already perform validation, testing and quality assurance; it would be wrong to suggest otherwise. The issue is whether the measures we use sufficiently establish real-world effectiveness: which genuinely suspicious activity is missed, which decisions are wrong, how quickly risk is escalated, and whether human review measurably improves the result. 

From Proving Compliance to Proving Impact

For decades, our industry has become adept at demonstrating that controls exist and prescribed activities were completed. Policies are documented. Alerts are worked. Cases are closed. Reports are submitted. All of this matters. But process completion is not synonymous with reducing financial crime risk.

There has been a welcome shift towards effectiveness: risk-led deployment of resources, richer context, better prioritisation, and measurable outcomes. At precisely this moment, generative and Agentic AI offer an opportunity to redesign investigations around that ambition, a shift we described in Agentic AI and the End of Reactive Compliance. Yet the debate can quickly retreat to a narrower question: how do we make AI conform to the operating model we already have?

That would be a missed opportunity. Automating a weak process can make the weakness faster, cheaper, and harder to notice. A genuinely transformed operating model should start with the risks we need to identify and the outcomes we need to achieve, then design the workflow, technology, and oversight accordingly.

The Remediation Reflex

When a financial institution experiences control failures, a predictable set of responses can follow: more investigators, extra quality assurance, revised procedures, closer supervision, broader testing, and historical look-backs. 

These actions may be essential, especially where a regulator requires them, but they can also absorb enormous investment while leaving the underlying architecture largely unchanged.

The harder question is whether we are fixing the cause of failure or adding compensating controls around it. If activity becomes stuck between detection and investigation, for example, another review layer may catch some errors. A redesigned end-to-end process could instead make every handoff observable, traceable, and testable, with exceptions escalated before they become systemic.

Technology is not a substitute for governance. Equally, governance should not become a substitute for redesign.

Replace Human-in-the-Loop with Evidence-in-the-Loop

The choice should not be framed as humans versus AI. It should be framed around which combination of people, models, data, and controls delivers demonstrably better outcomes for defined risks.

That calls for comparable measures, applied to human teams and AI Agents alike:

• Detection coverage and missed-risk testing

• Decision accuracy and consistency across similar cases

• Completeness of investigation evidence behind each conclusion

• Escalation and reporting timeliness

• Explainability of each individual decision

• Independent challenge of outcomes

• The rate at which errors are identified and corrected

Human teams and autonomous systems will need different risk controls, but both should be tested against meaningful objectives. The last measure matters most: every decision-maker gets things wrong sometimes, and the real test is how quickly an error is surfaced, explained, and fixed, a point we develop in The Real Test of Compliance AI Is What Happens When It Gets It Wrong.

Human intervention should be placed where it improves decisions or fulfils a necessary accountability requirement, not retained merely because its presence feels reassuring.

Likewise, granting an AI Agent greater autonomy requires controls proportionate to its authority, including limits, monitoring, escalation routes, and a named institution accountable for the outcome. Autonomous submission of regulatory reports may also depend on the applicable jurisdiction, legal obligations, and supervisory expectations.

How Does Evidence-in-the-Loop Work in Practice?

At Silent Eight, this principle shapes how we built Iris 7. The aim is not to ask institutions to trust an AI Agent. It is to make every decision, whether human or AI, able to be measured, challenged, and evidenced.

• Decisions within the institution's own policy: Iris 7 AI Agents take in alerts, assemble the relevant context, apply institutional policy, and produce explainable decisions. They work on top of existing screening and monitoring systems, so redesigning the investigation layer does not have to start with replacing detection.

• Evidence behind every conclusion: Each decision is supported by its reasoning and documented evidence, so a reviewer, auditor, or supervisor can see how the conclusion was reached.

• Human oversight where it counts: Decisions are made under human oversight and accountability, with the governance controls embedded into the decisioning itself rather than added afterwards.

None of this removes the need for governance, validation, or human accountability. It changes what they rest on: evidence from every case, rather than assurance that a process was followed. 

An Opportunity, Not a Shortcut

None of this is a case for lowering the bar for AI. The risks of hallucination, data leakage, bias, correlated failures, and opaque reasoning are real. Nor does a regulatory failure at one bank validate an untested AI alternative. 

A credible transformation programme would establish baselines, run controlled comparisons, independently challenge results, and expand autonomy only when the evidence supports it.

However, it would also stop treating today's human-led approach as the unquestioned gold standard. We should be just as willing to measure where our existing processes fail as we are to test a new model's weaknesses. 

As I argued in The Three Pillars Compliance Leaders Need to Make AI Succeed, that shift depends on leaders who own the redesign rather than delegating it.

The industry has spent years trying to move from compliance towards effectiveness. We should not let the arrival of AI send us backwards into a debate dominated by whether new technology fits yesterday's playbook. The better question is what we can now build, and prove, that we could not before.

The biggest risk may not be trusting AI too much. It may be continuing to trust an operating model without demanding evidence that it achieves what we need.