The push for banks to leverage Artificial Intelligence (AI) in the fight against financial crime is encountering a familiar regulatory paradox: one agency champions the adoption of cutting-edge technology, while prudential supervisors acknowledge that the rulebook for its safe implementation is still being written. This dynamic creates a challenging environment for financial institutions eager to harness AI’s potential, particularly agentic AI systems that operate with a degree of autonomy. However, compliance experts argue that the foundational principles of robust model governance, already integral to Anti-Money Laundering (AML) programs, can and should be adapted to guide these new technologies.
The landscape of AI regulation in banking is evolving rapidly. In April 2026, federal banking agencies retired SR 11-7, a pivotal guidance document that had shaped the validation of AML models for over fifteen years. Its successor, OCC Bulletin 2026-13 and SR 26-2, explicitly carves out generative and agentic AI, classifying them as novel and fast-evolving. While these new frameworks signal a shift, they emphasize that existing risk management practices should continue to inform the controls banks implement. A forthcoming request for information (RFI) from regulators is expected to provide further clarity on AI-specific supervisory expectations.
Coinciding with these regulatory shifts, the Financial Crimes Enforcement Network (FinCEN) proposed a significant overhaul of AML and Counter-Financing of Terrorism (CFT) programs in the same month. This reform aims to move beyond prescriptive requirements towards a standard of demonstrated effectiveness. Crucially, FinCEN has indicated that financial institutions will not face increased enforcement risk for responsible experimentation with machine learning and generative AI, signaling an opening for innovation.
The core of the current debate lies in the differing approaches of various regulatory bodies. One segment of the regulatory apparatus is actively encouraging banks to integrate AI into their financial crime detection and prevention efforts. Concurrently, prudential supervisors, responsible for the safety and soundness of banking institutions, have been candid about the absence of a fully developed framework for AI governance. This creates a potential disconnect, where innovation is encouraged but the guardrails for its secure and compliant deployment are not yet definitively established.
Aishwarya Kothapally, a financial crimes compliance executive with extensive experience in AML model governance, observes that this tension is not entirely new. She draws a parallel to the challenges faced in traditional AML model governance, particularly concerning the fine-tuning of transaction monitoring systems. "When an audit or model risk management review scrutinizes a tuning change," Kothapally explains, "they demand more than just the final threshold parameters. They require a comprehensive understanding of the data and population used for testing, the underlying methodology and assumptions, pre- and post-tuning alert volumes, considerations for coverage and false positives, and the subject matter expert (SME) judgment applied, including who challenged and approved the change."
Kothapally also notes a recurring issue where the detailed rationale behind such changes is sometimes lost in the shuffle, only to be painstakingly reconstructed later from fragmented sources like analysis files, emails, meeting notes, and earlier test outputs. This underscores the critical importance of clear, comprehensive, and contemporaneous documentation, a principle that will be even more vital when dealing with complex AI systems.
Anticipating Examiner Scrutiny: Key Questions for Agentic AI
As banks explore the deployment of agentic AI in financial crime compliance, they can anticipate a series of questions from examiners that will echo familiar inquiries about traditional models, but with an added layer of complexity due to the autonomous nature of AI. These questions revolve around fundamental aspects of system integrity, accountability, and oversight.
Explainability: A cornerstone of regulatory compliance, explainability in the context of agentic AI means being able to clearly articulate the decision-making process. When an AI agent closes an alert after reviewing multiple data sources, the bank must be able to demonstrate precisely which sources were consulted, the weight assigned to each piece of information, and the rationale behind the final decision, all in a format comprehensible to an examiner. This moves beyond simply identifying suspicious activity to explaining why the system flagged it as such.
Accountability: The distributed nature of AI development and deployment presents a significant challenge for accountability. An agentic system might be built using a language model from one vendor, an entity resolution engine from another, and integrated with internal data connectors. This multi-faceted architecture means that responsibility for its outputs can be diffused. When an AI agent makes an erroneous decision, the bank ultimately bears the responsibility. This necessitates clear lines of ownership within the institution, with individuals accountable for the outcomes of AI-driven processes.
Human Oversight: The degree and nature of human involvement in AI-driven processes is a critical area of focus. Research conducted by KPMG in 2026 with US banking leaders highlighted that a "human-in-the-loop" design is central to scaling AI capacity without compromising AML and Know Your Customer (KYC) oversight expectations. Examiners will seek to understand whether human review serves as a genuine control mechanism, rigorously validating AI-generated findings, or if it devolves into a mere perfunctory approval. The effectiveness of human oversight will be judged by its practical application and its ability to identify and correct AI errors.
Audit Trail: Underpinning all these considerations is the integrity of the audit trail. For agentic AI systems, this means meticulously logging every step of the AI’s reasoning and actions. Without a comprehensive record of inputs, processes, and decisions, it becomes impossible to reconstruct the system’s behavior after the fact, undermining explainability, accountability, and human oversight.
Ongoing Effectiveness: Beyond the initial deployment, regulators will expect banks to demonstrate the ongoing effectiveness of their AI-driven financial crime programs. This includes understanding how the institution verifies that the system continues to perform as intended, identifying triggers for recalibration, detailing the process for testing and approving changes, and ensuring the completeness, accuracy, and traceability of the AI’s inputs. The emphasis will shift depending on the specific function. For transaction monitoring, this means a focus on scenario coverage, threshold efficacy, and escalation protocols. For sanctions screening, it will involve scrutinizing list coverage, matching logic, and the mitigation of false negatives. In both cases, a central question will be the demarcation between autonomous AI decision-making and human review.
Establishing Controls: Building on Existing AML Governance
Crucially, the controls required for agentic AI are not entirely novel; they are largely adaptations of existing AML model governance principles. Banks do not need to wait for new guidance to begin implementing these essential safeguards.
Documentation of Logic and Changes: Similar to traditional AML models, the reasoning behind an AI agent’s decisions and any modifications to its parameters must be meticulously documented. This documentation should be clear enough for a non-technical examiner to understand. Change control processes must capture the specific reasons for any alteration, ensuring a transparent history of system evolution.
Data Provenance and Quality Assurance: Agentic AI systems are highly dependent on the quality and integrity of their training and operational data. Banks must establish robust processes for tracking the lineage of data used by AI agents, ensuring its accuracy, completeness, and relevance. This includes validation of data sources and ongoing monitoring for data drift or corruption.
Testing and Validation Frameworks: While traditional model validation might focus on static datasets, agentic AI requires more dynamic approaches. This involves testing the AI’s performance across a range of scenarios, including edge cases and adversarial inputs. Back-testing against historical data remains valuable, but it must be augmented with simulations and live testing that reflects the AI’s active role in decision-making.
Risk Assessments and Scenario Planning: Banks need to conduct thorough risk assessments specific to their AI deployments. This includes identifying potential failure modes, biases, and unintended consequences. Scenario planning should anticipate how the AI might behave under various market conditions or in response to emerging financial crime typologies.
Independent Review and Challenge: Just as traditional models undergo independent review, AI systems should be subject to similar scrutiny. This independent challenge function helps to identify weaknesses, biases, and potential compliance gaps that internal teams might overlook.
Navigating the Evolving Regulatory Landscape
The retirement of SR 11-7 and the introduction of OCC Bulletin 2026-13 and SR 26-2 mark a significant moment in banking regulation, signaling a recognition of the limitations of existing frameworks in the face of rapidly advancing AI technologies. The explicit exclusion of generative and agentic AI from the new guidance underscores the nascent stage of regulatory understanding and supervisory practice in this domain.
Federal Reserve Vice Chair for Supervision Michelle Bowman has publicly acknowledged the need to assess the fitness of current AI guidance for the future. Her remarks, often referencing the evolving model risk framework’s inadequacy for generative or agentic AI, highlight the proactive approach being taken by senior leadership to address these challenges. When future guidance is issued, it is expected to draw heavily on the experiences and practices of institutions that have prioritized robust governance during this transitional period.
The implications of this regulatory evolution are far-reaching. For banks, it presents both an opportunity and a challenge. The opportunity lies in the potential of AI to significantly enhance the efficiency and effectiveness of financial crime compliance programs, enabling faster detection of illicit activities and a reduction in false positives. The challenge resides in navigating the current uncertainty surrounding regulatory expectations and implementing AI responsibly and compliantly.
The Imperative of Governance Maturity
Ultimately, the degree of autonomy a bank can safely delegate to a machine is directly correlated with its governance maturity. Institutions that invest in building comprehensive and robust governance frameworks before deploying AI systems will be better positioned to scale their agentic capabilities. They will have the necessary processes, controls, and documentation in place to manage AI risks effectively and demonstrate compliance to regulators.
Conversely, those that prioritize rapid deployment without commensurate attention to governance may find themselves in a reactive position, grappling with remediation efforts and compliance gaps. The gap between encouraging AI innovation and establishing clear, actionable regulatory guidance creates a critical window for banks to proactively strengthen their governance structures. The principles of regulator-ready governance, emphasizing clear documentation, rigorous change control, and continuous validation, remain paramount. While the specific application may evolve with AI, the core tenets of sound risk management and compliance are immutable. The future of AI in financial crime compliance hinges on the ability of banks to build trust through transparent, accountable, and well-governed systems.
