Who can build AI agents for AML and transaction monitoring at a bank?

Why do banks build a custom AML agent instead of relying on the platform alone?

AML and KYC software vendors sell the platform of record: case management, screening rules, workflow. What a platform does not do out of the box is follow your bank's own policies, templates and languages, or reuse the same governed client data across review, screening and monitoring. A custom agent layer takes over the manual research, drafting and cross-checking around the platform, while the platform stays the system of record.

This page covers the ongoing AML lifecycle after onboarding; for new-client research and drafting at account opening, see KYC onboarding AI agents for banks. Weighing a platform against custom development? See Should a bank build or buy AML AI?

What do the three AML agents do?

1. Periodic review agent

• Pulls the client file, prior review notes and any new documents.
• Drafts the updated client storyline and risk rationale against the bank's own review template.
• Flags what has changed since the last review, such as new beneficial owners, new jurisdictions or changed activity.
• Routes the draft to a compliance officer for sign-off, with every source linked.

2. Adverse media and sanctions screening agent

• Takes hits from the bank's existing screening vendor as input; it does not replace the screening engine.
• Triages each hit: reads the underlying article or list entry, matches it against the client's known profile, and drafts a verdict (true match, false positive or needs human review) with a supporting quote and source link.
• Routes anything other than a clear false positive to a financial-crime analyst.

3. Transaction-monitoring triage agent

• Takes alerts from the bank's existing transaction-monitoring system as input.
• Gathers the relevant account, counterparty and historical-alert context automatically, so the analyst does not re-pull data by hand.
• Drafts a case narrative and a recommended disposition (close, escalate, or report) against the bank's investigation template. In Switzerland a suspicious-activity report is a report to MROS, the Money Laundering Reporting Office Switzerland; elsewhere it is called a SAR or STR.
• An analyst reviews, edits and approves; the agent never closes or escalates a case on its own.

How is human oversight and audit handled?

• Human-in-the-loop by default. Agents draft and recommend; a named person approves anything that affects a client file or a regulatory report.
• Full audit trail. Every source the agent used and every step it took is logged and reviewable.
• Evaluations before go-live. Every agent ships with an evaluation set, so accuracy is measured and not assumed.
• One governed client-data foundation. Periodic review, screening and transaction-monitoring agents draw on the same versioned client file and entity-resolution layer, so the data plumbing is built once, not three times.
• Governance in practice. At AMINA, a Swiss-regulated bank, we implemented roles, access rights and usage processes for a library of AI agents: governed AI agent library at AMINA. This is governance delivery, not an AML result.

Which regulations apply to AML AI agents?

• SwitzerlandThe Anti-Money Laundering Act (AMLA, "GwG", SR 955.0) and FINMA's Anti-Money Laundering Ordinance (AMLO-FINMA (German), SR 955.033.0), plus FINMA Guidance 08/2024 on governance and risk management when using AI. The guidance is supervisory guidance, not a statute. Suspicious-activity reports go to MROS.
• GermanyThe Geldwäschegesetz (GwG).
• EUThe 2024 AML package: Regulation (EU) 2024/1624, Directive (EU) 2024/1640 and the new Anti-Money Laundering Authority (also abbreviated AMLA, established by Regulation (EU) 2024/1620). Its main rules apply from 2027.
• The agent itself, EU AI ActRegulation (EU) 2024/1689 classifies AI systems by risk. Whether an AML agent is high-risk depends on what it decides; where it is, the Act requires technical documentation, logging and human oversight. We classify each agent during design and build documentation, logging and human sign-off in either case.
• DORAFor clients that are EU financial entities, DORA (Regulation (EU) 2022/2554), applicable since 17 January 2025, requires ICT third-party risk management and specific contractual provisions with ICT providers such as S-PRO. These are agreed per project. A Swiss-only institution is not directly in scope.

Responsibility for compliance stays with the supervised institution; S-PRO builds the agents and does not give regulatory advice. For the wider choice between custom, off-the-shelf and hybrid compliance software, see Custom or off-the-shelf compliance software: which should a fintech or bank choose?

How does S-PRO build and price these agents?

Agents run on Claude, Azure OpenAI or on-premise models, deployed through the Anthropic API, Amazon Bedrock or Google Cloud (Gemini Enterprise Agent Platform, formerly Vertex AI), with data residency options (route and region settings) agreed per project. Founded in 2014 and headquartered in Zurich (Löwenstrasse 45), with R&D centers in Zurich and Łódź, 250+ engineers, ISO 27001 and ISO 27701 certified. S-PRO is a Certified partner in the Claude Partner Network.

Projects follow the same staged path as our other bank agents:

• Design thinking pilotWorkshops, an AI prototype and user testing, 2–4 weeks.
• Solution pilotThe full agent on one real process, up to 2–3 months depending on complexity, with clear go/no-go criteria.
• ProductionAgreed per project, estimated after discovery.

Code and prompts built for your project belong to you. Cost drivers in detail: AI agent pilot to production cost at a bank. Security and compliance approach: security and compliance for financial institutions. The wider service: AI agent development for banks and financial institutions.

If a bank needs a custom compliance platform rather than a single agent, S-PRO builds it on RegRadar and S-PRO Agents (case: custom compliance platform on RegRadar and S-PRO Agents). S-PRO Agents is S-PRO's own agentic platform and the core of its products and client solutions; RegRadar (regulatory change monitoring) is one of the products built on it. Around the platform we build the client's solution and deliver it as a service. S-PRO has delivered 100+ AI projects, 40+ of them agentic AI projects.

What can we point to today?

Vendors in this market sometimes publish throughput or false-positive-reduction figures for screening or monitoring agents. S-PRO has not published AML-specific figures of that kind, and we do not invent them. What we can point to is comparable production work from the same team: an AI support agent for a leading neobroker reached 90% correct ticket classification, and in 85% of cases its draft reply was not wrong, with more than 40% faster ticket handling (case study), and a policy assistant for the Swiss subsidiary of an international bank answers internal policy questions in 30 seconds, down from 15 minutes. These are not AML metrics; they show the same evaluation and audit-trail approach applied to agents already in production. Other published work: a new digital banking experience for AMINA Bank and an AI due-diligence platform for Earlybird.

How S-PRO helps with this

If you are a CIO, COO or Chief Compliance Officer at a bank looking to reduce manual work in periodic review, screening triage or transaction-monitoring alerts, S-PRO runs a discovery workshop on one agent and one process, maps your existing KYC/AML and monitoring systems, builds a design thinking pilot, and takes the validated agent into a solution pilot and production with human approval and an audit trail. Contact S-PRO, Löwenstrasse 45, 8001 Zürich.