Why Is Financial Crime AI Still Stuck at Pilot?

Financial crime compliance (FCC) is a major focus for AI in banking, but most of that work has not left the pilot stage. Only 22% of banks have AI running operationally in FCC. Another 70% are still testing, piloting or exploring it.

What holds these pilots back is often not the technology alone. They stall on questions specific to financial crime, above all whether the model finds every known risk. Regulators are broadly open to AI, as regulatory sandboxes show, so the barrier tends to be execution and governance. A bank that answers these questions in FCC has strong proof that AI can work in production.

1. Does the Pilot Find Every Known Risk?

A common test for an FCC pilot is whether the new system finds the risks the bank already knows about, such as past SARs and confirmed true matches. The industry has a phrase for it: “no SAR left behind”.

This is where many pilots stall. Probabilistic models tend to trade one error for another, cutting false positives but letting some genuine risk go undetected. A pilot can cut alert volumes and still fail, because one missed SAR can be enough to stop it. In 2021, the FATF found that some firms held back from new AML technology for fear of supervisory criticism if a pilot failed.

Here, a deterministic approach is more dependable. Each case is assessed against set rules and the bank’s own policy, so the same inputs lead to the same outcome and known risks are far less likely to slip through. Where a case falls outside what policy allows the system to decide, it goes to an analyst for review.

2. Can Model Risk Sign It Off?

For many banks, this is the hardest step. Before a model goes live, model risk management (MRM) has to be satisfied that it is conceptually sound, that its limits are known and that its performance will be monitored over time. Each of those needs evidence, and gaps in evidence can hold a pilot back.

Regulators and industry bodies are raising the bar:

• In the United States, the Federal Reserve’s SR 26-2 replaces the separate 2021 statement on AML model risk with its general model risk guidance. Banks are expected to understand vendor models even without full access to the code or data.

• The Monetary Authority of Singapore (MAS) says unsupported vendor self-attestations are generally not effective.

• The Wolfsberg Group’s 2025 statement on monitoring calls for a responsible move to new systems, one that balances model risk with financial crime risk.

This is where a well-prepared supplier helps. A clear rationale and audit trail for each decision let the bank show how an outcome was reached. That is the evidence MAS asks for, and it helps MRM understand a vendor model as SR 26-2 expects.

3. Can It Run Alongside Existing Controls?

US regulators have said that pilots run alongside existing AML processes are an important way to test new approaches, and that a pilot which fails should not by itself draw supervisory criticism. 

Testing the AI against the existing system should show that it catches everything the old system did. The Wolfsberg Group agrees it matters to understand what the old approach caught and the new one missed, while warning against “low value-added comparisons between past and future performance”. Once a core model is approved, later rollouts can be tested on what changes, so the bank can widen the AI’s scope step by step without a rip-and-replace.

4. Do People Stay in Control of What the AI Decides?

The last question pertains to design. Does the system keep people in the loop where it matters, and are its automated decisions bound by policy that the compliance team sets and can change?

Regulators expect human oversight. MAS lists human oversight among the controls it expects across the AI life cycle, applied in proportion to each use case’s risk. The Central Bank of the UAE’s 2026 guidance names effective human oversight as a core principle.

In practice, good design has three parts:

• The compliance team decides which decisions can be automated, and at what thresholds. It can change those limits without asking the supplier to rework the system.

• Cases outside policy go to a person, and people approve any retraining or policy change.

• Every automated decision records the policy it applied and why.

Sign-off then means approving a scope the bank controls, not a black box. Validation gets easier, and accountability stays with named people.

Is Your FCC AI Ready for Production?

These questions can be answered. Purpose-built FCC AI is already in production at large banks. It runs alongside existing systems, makes decisions within policy the compliance team sets, and has human-in-the-loop review of changes.

Going live is only the start. Typologies and customer behaviour change, so performance needs continuous monitoring. Any update to how the system decides should be tested and approved by people before it goes live, with a record of what changed and why. Model drift and continuous learning both need active management.

Key Takeaways

• A pilot needs to find every known risk, not only reduce false positives.

• Model risk sign-off follows the bank’s standard process, and a well-prepared supplier makes the process easier.

• Running AI alongside existing controls lets the bank test it without a rip-and-replace.

• Policy-bound design with human review lets the bank approve a scope it controls.

Financial crime is where bank AI faces the strictest test of production readiness. That also makes it the most convincing place to pass it.