How AI can transform anti-money laundering operations

AML in one minute

Anti-money laundering (AML) rules impose on banks the obligation to prevent the entry of criminal money into the financial system. In practice, this involves three activities: knowing your customer, by identifying each customer, understanding the customer’s business and keeping the customer file up-to-date (KYC or customer due diligence, CDD). There is also the monitoring of transactions to check every payment against rules and flag transactions that appear suspicious. Then, investigating and reporting, by having analysts check which of the flagged transactions involved genuine suspicions that should be reported to the national Financial Intelligence Unit (FIU).

All transactions are screened, some raise alerts, fewer lead to reports to the FIU: most alerts are false positives, legitimate transactions that only appear unusual.

Europe is rewriting its AML rulebook

A single EU regulation and a new EU authority will replace the current patchwork of national AML rules. In July 2025, the new EU Anti-Money Laundering Authority (AMLA) opened in Frankfurt. From 10 July 2027, the Anti-Money Laundering Regulation (AMLR) will apply directly in all 27 member states: one rulebook for everyone. 40 selected high-risk financial institutions will start being directly supervised in 2028. All of them are active in at least 6 member states. The preparation window is now and new limits are added to the AMLR. For example, for higher-risk customers, their files must be updated at least every year and at least every 5 years for all other. (AMLR, Art 26).

The existing regulation already requires financial institutions to implement risk-based and proportional controls. Hence, AI offers an opportunity to make these controls in line with existing obligations by increasing scalability and efficiency in a world that has become increasingly complex, whether it is in customer due diligence, ongoing monitoring, or detecting and reporting suspicious activity.

The reactive cycle

Why do AML costs keep coming back, even after heavy investment?

Rules-based transaction monitoring systems lead to a high volume of alerts, of which only a fraction are significant. However, each of these alerts requires manual intervention, which is highly resource intensive for compliance teams. When the number of new alerts exceeds the number of processed cases, the volume of alerts grows exponentially. This results in increased costs and the risk of regulatory intervention.

The financial institution can choose to invest in extra resources, both internal and external, or a remediation program, which is often extremely expensive. While such actions reduce the backlog, they do not address the issue of excessive and insignificant alerts, and the institution faces high costs again.

The price of catching up

The Netherlands serves as an example of exponentially rising costs. Dutch banks spent €1.6 billion on AML compliance in 2024, compared to €1.16 billion in 2021. The 9 surveyed banks employed 13,000 full-time equivalent staff members to combat money laundering, and in 2024, Dutch banks identified more than 530,000 suspicious transactions, more than double the figure in 2020. However, according to the Netherlands Court of Audit, it remains unclear whether all this effort has been channelled into preventing and detecting more money laundering (Algemene Rekenkamer, March 2026).

Three levers to become proactive

AI can make the difference in 3 places. In alert handling, alerts are handled in order of chronological arrival; a proactive approach ranks them by risk, riskiest first. In investigations, analysts build every case file by hand; in a proactive set-up, AI prepares the file while analysts investigate and decide. In customer reviews, reviews follow a fixed calendar; a proactive approach triggers them on real changes in behaviour. In each case, AI supports the analyst rather than replacing them. It works at the start of the process; people still make the call.

Lever 1: Alert handling

Rank alerts by risk, not by arrival. Today, alerts are worked first in, first out. With machine learning, a model learns from past cases, such as customer background, transaction history and the outcome of earlier alerts, and estimates how likely each new alert is to end up being reported, so analysts can take the riskiest first. Closed alerts matter too: keeping the outcome of every alert, including those closed without a report, teaches the model to separate false positives from genuine risk. Good data collection is the foundation.

What the evidence demonstrates. Norwegian Computing Center and DNB, Norway’s largest bank, have deployed a machine-learning model on actual transaction data. Ranking alerts using this model led to 36% fewer transactions to assess, with 95% of those that eventually turned out to be reported retained; to detect 80% of these, the workload was 51% lower (Jullum et al., 2020). Observe that the test was retrospective, on historical data: in practice, a bank may not know if a deprioritised alert will turn out to conceal a scheme unknown to contemporary detection capabilities, or criminals will fail to adapt. Continuous validation and back-testing is necessary, an area in which Dutch supervisors feel there is scope for improvement.

Lever 2: Investigations

AI prepares the case. Analysts make decisions. AI first collects all the relevant information: account details, transactions, patterns, previous alerts and cases, and adverse media, if available. It then creates a case narrative: the context, rationale for triggering the alert and the relevant activity. Next, it highlights patterns, gaps in information, risk indicators and relationships requiring investigation. The analyst investigates and makes the decision, gathers up evidence, runs additional checks and looks for further information not found by the AI. If needed, AI drafts the suspicious transaction report and the investigator approves it. People retain responsibility for evaluating and judging evidence, making decisions and taking accountability.

Significant time benefits, subject to conditions. Based on time spent in sandbox testing, it can take up to 30% less time to investigate a straightforward non-reportable case involving an individual and up to 80% less time to investigate a complex reportable case involving a company. These are sandbox results, not production benchmarks, subject to three conditions. Completeness: AI cannot access information it does not have access to. Analysing the relationship manager or reviewing local press and social media may be necessary for an investigator – retrieving all the information is not the same as investigating. Accuracy: AI may misinterpret evidence or present a statement as a fact when it is not. Effort to verify: if verifying the AI’s analysis takes more time than it saves, benefits are negated.

Lever 3: Customer reviews

Review on change, not on schedule. The AMLR caps the gap between file updates at one year for higher-risk customers and five years for everyone else. In between, a file can stop describing the business the customer actually runs. AI-supported layers can sit between customer activity and the CDD update and analyst review: a behavioural profile, built from the customer’s transactions over the past year; continuous comparison, where new activity is matched against that profile all the time; and a check for significant, lasting change, where a one-off spike is set aside and a persistent shift is escalated.

Spike or shift? A one-off spike is set aside, while a lasting shift beyond the expected range of the profile triggers a review. The result is earlier signals: reviews follow risk rather than arbitrary dates, and specific events can raise a red flag so investigators act at the earliest moment. It is a complement, not a replacement: it works alongside transaction monitoring and makes CDD reviews more dynamic, adding interpretable behaviour profiles, new data sources and customer-level patterns. Mind the overlap, though: the more advanced a bank’s existing monitoring, the less an off-the-shelf analytics layer adds, although it can still improve explainability.

From catching up to staying ahead

AI alone will not make an institution compliant. However, used with discipline, it allows investigators to spend their time where the risk lies. Start with the problem: the alert queue, case preparation or the review cycle. Then, treat every closed alert as data: models can learn from outcomes. Keep people in charge: AI prepares, and analysts decide. Provide a continuous validation: back-testing, monitoring and assuming that criminals will adapt to the changes. Safeguards built-in from day one: privacy, bias and explainability. With the AMLR applying from July 2027 and AMLA’s direct supervision from 2028, now is the time to move from remediation to prevention.