AI agents in bank AML and KYC compliance: five real programs and what legal teams should learn

Anti-money laundering (AML) compliance is one of the largest and least loved costs in banking. A Forrester study commissioned by LexisNexis Risk Solutions put the cost of financial crime compliance at US$61 billion a year for financial institutions in the US and Canada, and 99% of respondents said their costs had risen ¹⁶. McKinsey estimates banks assign up to 10% to 15% of their full-time staff to know-your-customer (KYC) and AML work, and that the industry still catches only about 2% of global financial crime flows ¹⁴.

Two things changed in 2026. Regulators on both sides of the border began rewarding programs for being effective, not just thorough. And AI agents, meaning software that can carry out multi-step tasks such as gathering documents, checking records and drafting a case file rather than just answering questions, moved from demos into live compliance work. For general counsel and chief compliance officers, the question is no longer whether AI belongs in financial crime compliance, but how to use it without creating new liability.

The business problem: too many alerts, too little signal

Most banks still monitor transactions with fixed rules, such as flagging any cash deposit over a threshold or any wire to a high-risk country. Rules are easy to explain to an examiner, but they produce floods of alerts, mostly false alarms. Analysts spend their days clearing noise while networks that do not trip a simple rule slip through.

The consequences of getting this wrong are now concrete. In October 2024, TD Bank pleaded guilty to US Bank Secrecy Act and money laundering conspiracy charges. The US Department of Justice found that from 2018 to 2024, TD left 92% of its US transaction volume, about $18.3 trillion, out of automated monitoring, and that three money laundering networks moved more than $670 million through its accounts ⁷. The Justice Department’s share of the penalty alone was about $1.89 billion ⁷.

Canada’s enforcement is rising too. FINTRAC, Canada’s financial intelligence unit, issued 35 notices of violation in 2025–26, a 52% increase over the prior year, with more than $247 million in total penalties ¹¹. In March 2026, Parliament passed Bill C-12, which raises maximum penalties under Canada’s anti-money laundering law roughly 40-fold, to as much as $20 million per very serious violation or 3% of gross global revenue, and adds a violation for a compliance program that is not "reasonably designed, risk-based and effective" ¹². (The law firm analysis notes the higher penalties are subject to transitional provisions.)

The regulatory shift: from paperwork to effectiveness

In April 2026, FinCEN, the US Treasury bureau that enforces anti-money laundering rules, proposed a rule to "fundamentally reform" how banks’ AML programs are judged ¹. Treasury Secretary Scott Bessent framed the goal bluntly: "For too long, Washington has asked financial institutions to measure success by the volume of paperwork" ³. The proposal says innovative approaches "could involve machine learning, generative artificial intelligence (GenAI), digital identity," and FinCEN’s fact sheet says the agency would consider a bank’s use of "innovative tools such as artificial intelligence" when weighing enforcement ¹². Comments closed on June 9, 2026. At the time of writing, no final rule had been published ¹.

The same month, US banking regulators replaced their long-standing model risk guidance (SR 11-7) and a 2021 statement on models used in Bank Secrecy Act systems with new guidance, SR 26-2 ⁴. According to an analysis by Sullivan & Cromwell, the new guidance leaves generative and agentic AI out of scope as "novel and rapidly evolving," and the agencies plan to ask for public input on AI ⁵. In plain terms: US banks are being encouraged to use AI in compliance, but the supervisory rulebook for agents is not written yet.

Canada has gone further on governance. The Office of the Superintendent of Financial Institutions (OSFI) finalized Guideline E-23 on model risk management in September 2025, effective May 1, 2027 ¹⁰. It explicitly includes AI and machine learning methods in its definition of a model, requires an enterprise inventory of models with non-negligible risk, risk-rates each one, and covers models bought from third-party vendors ¹⁰. An AI tool screening customers at a federally regulated Canadian bank will need to sit inside that framework.

Case studies: what real programs show

1. HSBC: fewer alerts, more real cases. HSBC, which screens over 1.2 billion transactions a month, replaced rules-based monitoring with a machine learning system built with Google Cloud. In the 12 months after go-live, compared with the 12 months before, HSBC reported finding two to four times as much suspicious activity while cutting alert volumes by 60% ¹³. This is a vendor-published account by an HSBC executive, and it describes predictive machine learning, not agents, but it is the clearest public evidence that better models can improve accuracy and workload at once.

2. TD Bank: AI as part of a remediation. TD’s recovery plan relies partly on AI. On its first-quarter 2026 earnings call, TD said it had "implemented machine learning models in our transaction monitoring system last year," with more models to come, and it launched a centralized KYC platform in February 2026 ⁸. In May 2026, TD said it expected to spend upwards of $500 million on AML that year, including a new monitoring system "with embedded machine learning and AI capabilities" ⁹. The lesson: AI is not the cure on its own, but one part of a costly rebuild of data, staff and governance.

3. Scotiabank: deep learning against specific crimes. Scotiabank described in June 2026 how it uses machine learning, supported by a dedicated computing cluster for its deep learning AML models, to detect transactions linked to online child sexual exploitation, as industry lead for the public-private Project Shadow ¹⁸. No performance figures were given, but it shows AI aimed at one crime pattern rather than general alert reduction.

4. A global bank’s KYC "agent squads". McKinsey describes a global bank that redesigned KYC reviews around ten "agent squads," each made up of four or five AI agents that split the review work, including one that checks quality, with a full audit trail ¹⁴. McKinsey suggests one practitioner can supervise 20 or more agent workers, and estimates agentic AI could deliver productivity gains far beyond the 15% to 20% seen with earlier AI tools ¹⁴. These are consultancy estimates based on its own client experience, not independent results, and McKinsey itself notes adoption takes about twice as long as building the technology.

5. Deutsche Bank: agents prepare, people decide. In September 2026, Deutsche Bank’s private bank put an agentic AI tool into production in Singapore and Hong Kong to prepare source-of-wealth assessments, one of the most labor-intensive parts of KYC for wealthy clients ¹⁷. The bank stressed the tool prepares assessments for human review "while retaining human oversight and accountability." No efficiency figures were released.

The limits legal teams should plan for

• Evidence is thin and often vendor-sourced. The strongest numbers come from vendor and consultancy material ¹³¹⁴. Few banks publish before-and-after results, and none of the agent deployments above has independent performance data yet.
• Trust is still low. In a Moody’s survey of 600 risk and compliance professionals, 26% said they were actively using agentic AI, but only 4.5% trusted AI to act fully autonomously, and 47% required humans to keep final decision authority ¹⁵.
• Criminals use AI too. FinCEN warned in late 2024 that criminals are using generative AI to create falsified documents, photos and videos that get around identity checks, and listed red flags such as a customer using a third-party webcam plug-in during live verification ⁶. KYC controls built for paper documents need updating.
• Explainability is a legal requirement in practice. Examiners, auditors or courts may review why an alert was cleared or a customer exited. If no one can explain the model’s call, the bank carries the risk.

Where human oversight stays essential

The pattern across these programs is consistent: AI gathers, sorts and drafts. Accountable people decide. Legal and compliance leaders should insist on four guardrails.

1. Humans own the regulated decisions. Filing or not filing a suspicious activity report, onboarding or exiting a high-risk customer, and closing a sanctions alert should stay with a named, trained person.
2. Every agent action is logged. The McKinsey and Deutsche Bank examples both emphasize audit trails ¹⁴¹⁷. Examiners will ask what the agent saw, what it did and who approved it.
3. AI tools go in the model inventory. OSFI’s E-23 requires this for Canadian federally regulated institutions ¹⁰. US banks should do the same even while agentic AI sits outside SR 26-2 ⁵.
4. Vendors are held to the bank’s standard. E-23 explicitly covers third-party models ¹⁰. Contracts should require documentation, testing access and notice of model changes.

Practical next steps for legal and compliance leaders

1. Map your alert funnel. Measure alert volumes, false-positive rates, time per case and backlog. Without a baseline, no AI result can be proven.
2. Start with preparation, not decisions. Good first uses are drafting case narratives, gathering KYC documents and summarizing customer histories for an analyst to review.
3. Run new tools in parallel. Let an AI model or agent work alongside existing rules for a period, compare outcomes and document the results, much as HSBC compared 12 months before and after ¹³.
4. Write the governance before the pilot. Define who approves each AI tool, how it is validated, and how its decisions are explained.
5. Track the rules. Watch for FinCEN’s final program rule, the US agencies’ request for input on AI in model risk, and Bill C-12’s penalty coming into force ¹⁵¹².
6. Refresh identity verification against deepfakes using FinCEN’s red flags ⁶.

Sources

1. FinCEN, US Department of the Treasury (April 10, 2026). Anti-Money Laundering and Countering the Financing of Terrorism Programs. Proposed rule, Federal Register.
2. FinCEN (April 2026). Fact Sheet: AML/CFT Program Proposed Rule.
3. FinCEN (April 7, 2026). FinCEN Proposes Rule to Fundamentally Reform Financial Institution AML/CFT Programs. Press release.
4. Board of Governors of the Federal Reserve System, with OCC and FDIC (April 17, 2026). SR 26-2: Revised Guidance on Model Risk Management.
5. Sullivan & Cromwell (April 29, 2026). OCC, Fed and FDIC Issue Revised Guidance on Model Risk Management. Law firm analysis.
6. FinCEN (November 13, 2024). FinCEN Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions (FIN-2024-Alert004).
7. US Department of Justice (October 10, 2024). TD Bank Pleads Guilty to Bank Secrecy Act and Money Laundering Conspiracy Violations.
8. PYMNTS (February 26, 2026). TD Bank Scales AI to Fix AML Program. Reporting on TD’s Q1 2026 earnings call.
9. BNN Bloomberg (May 28, 2026). TD Bank reports $4.25B second-quarter profit, raises dividend.
10. Office of the Superintendent of Financial Institutions (September 11, 2025). Guideline E-23: Model Risk Management. Effective May 1, 2027.
11. FINTRAC (2026). FINTRAC results by the numbers, 2025–26.
12. Blakes (March 31, 2026). Canada’s new anti-money laundering legislation significantly raises penalties and adds new violation. Law firm analysis of Bill C-12.
13. Google Cloud Blog, Richard D. May of HSBC (November 29, 2023). How HSBC fights money launderers with artificial intelligence. Vendor-published, compares 12 months before and after go-live.
14. McKinsey & Company (August 7, 2025). How agentic AI can change the way banks fight financial crime. Consultancy estimates.
15. Moody’s (October 9, 2025). Navigating the shift: How agentic AI is reshaping risk and compliance. Vendor survey of 600 risk and compliance professionals.
16. LexisNexis Risk Solutions, conducted by Forrester Consulting (February 21, 2024). Study reveals annual cost of financial crime compliance totals $61 billion in the United States and Canada. Vendor study, 160 US and Canadian respondents, fieldwork May–June 2023.
17. Hubbis (September 24, 2026). Deutsche Bank Private Bank deploys agentic AI for source-of-wealth KYC in Singapore and Hong Kong.
18. Scotiabank (June 9, 2026). How Scotiabank is using AI to combat child exploitation. Company publication.