AI in AML: The new model-risk mandate for banks and fintechs

The financial services industry is undergoing a profound transformation in how institutions detect and prevent money laundering and financial crime. Artificial intelligence (AI) and machine learning (ML) technologies have rapidly proliferated across anti-money laundering (AML) functions, fundamentally reshaping transaction monitoring, case management, and sanctions screening capabilities. In this paper, “AI” is used broadly to encompass both classical machine learning models (e.g., transaction scoring, anomaly detection) and newer generative AI systems, including large language models (LLMs) and third-party foundation models used for tasks such as summarization, narrative generation, and investigative support.

Recent research demonstrates that AI-driven AML systems can reduce false positives by 70% while improving detection of high-risk events by 30%—a step-change improvement over traditional rule-based approaches. Even in the challenging world of sanctions a recent report by the The Federal Reserve Board saw up to 92% fewer false positives, and 11% higher true detection.

Yet this technological revolution has triggered a parallel regulatory awakening. What began as model risk management (MRM) frameworks for credit and market risk models is now being systematically extended to AI systems deployed within compliance functions. The convergence is neither accidental nor optional: regulators increasingly view sophisticated AML AI systems as models subject to the same rigorous validation, governance, and documentation standards traditionally reserved for capital-impacting quantitative systems.

The thesis of this paper is straightforward but consequential: banks and fintechs must now treat AML AI systems with the same rigor, documentation standards, and independent validation applied to credit models. This shift represents not merely a compliance checkbox, but a fundamental reframing of how institutions develop, validate, and govern AI in their most critical compliance functions. Organizations that recognize this mandate early and build robust model risk frameworks around AML AI will gain meaningful competitive advantages in deployment speed, regulatory confidence, and operational outcomes.

While many of the examples in this paper focus on predictive and scoring models common in AML transaction monitoring, the same model risk management principles apply to generative and agentic AI systems increasingly embedded in AML workflows.

The regulatory architecture for model risk management was established in 2011, when the Federal Reserve and the Office of the Comptroller of the Currency (OCC) jointly issued SR 11-7, “Supervisory Guidance on Model Risk Management.” This guidance introduced a comprehensive three-pillar framework, defining model risk as “the potential for adverse consequences from decisions based on incorrect or misused model outputs and reports.”

Critically, SR 11-7 defined a “model” broadly as “a quantitative method, system, or approach that applies statistical, economic, financial, or mathematical theories, techniques, and assumptions to process input data into quantitative estimates.” This expansive definition was intentional, designed to capture any quantitative decision-making tool regardless of technological sophistication or implementation. For over a decade, institutions primarily applied this framework to traditional risk models—such as value-at-risk calculations, credit scorecards, interest rate risk models, and stress testing engines.

The regulatory landscape shifted decisively in 2021 when federal banking agencies issued an “Interagency Statement on Model Risk Management for Bank Systems Supporting Bank Secrecy Act/Anti-Money Laundering Compliance,” explicitly confirming that MRM principles apply to AML systems. The statement clarified that transaction monitoring systems, sanctions screening tools, and AI-powered compliance platforms meet the definition of “model” under SR 11-7, subjecting them to the same validation, governance, and control expectations.

This matters now because regulatory enforcement has intensified. The SEC's Division of Examinations identified AI governance as an examination priority for 2025, signaling heightened scrutiny of how firms develop, validate, and monitor AI systems. Similarly, the New York Department of Financial Services (NYDFS) and the Consumer Financial Protection Bureau (CFPB) have demonstrated—through enforcement actions and examination guidance—that AI governance within compliance functions will receive the same scrutiny as safety-and-soundness models.

The key principle underpinning this convergence is simple: any quantitative method that materially influences risk decisions—including compliance decisions—constitutes a model subject to validation standards. The technological sophistication of modern AI/ML systems does not exempt them from these requirements; indeed, their complexity and potential for opaque decision-making intensifies the need for rigorous MRM.

The first pillar of SR 11-7 addresses how models are developed, deployed, and operationalized. For AML AI systems, this pillar presents unique documentation and technical challenges that differ materially from traditional credit or market risk models.

Documentation Requirements for AML AI Models

Robust model risk management begins with comprehensive documentation of data lineage, feature engineering decisions, and model training methodologies. Data completeness and integrity form the foundation—input data must be “accurate, complete, consistent with model purpose and design, and of the highest quality available.” For AML applications, this requires clear documentation of:

The OCC's Model Risk Management Handbook emphasizes that documentation should be “sufficiently detailed so that parties unfamiliar with a model can understand how the model operates, its limitations, and its key assumptions.” This standard proves particularly demanding for complex machine learning models, where feature interactions and decision boundaries may be non-linear and difficult to explain.

AML-Specific Model Development Challenges

Three technical challenges distinguish AML model development from more traditional modeling applications:

Performance Metrics Beyond Accuracy in AML

Accuracy—the proportion of correct classifications—proves inadequate as a primary performance metric for AML models due to severe class imbalance. A model that classifies 99.9% of transactions as legitimate achieves 99.9% accuracy while detecting zero instances of money laundering. Instead, AML model validation must emphasize metrics such as:

Performance Metrics for Generative AI and LLM-Based AML Use Cases

For generative AI use cases—such as transaction summarization, evidence synthesis, or SAR narrative drafting—traditional classification metrics (e.g., precision, recall, PRAUC) are not applicable. These systems do not “predict” suspicious activity but generate content that supports human judgment.

For these AI applications, traditional statistical performance metrics are insufficient. Institutions must therefore rely on alternative validation signals, including:

Implementation Controls for AML AI Models

Rigorous implementation controls distinguish production-ready AML AI models from experimental prototypes. SR 11-7 emphasizes that “model risk management depends on substantial investment in supporting systems to ensure data and reporting integrity, together with controls and testing to ensure proper implementation of models, effective systems integration, and appropriate use.” Essential implementation controls include:

Independent validation forms the cornerstone of model risk management, providing objective assurance that models perform as intended and meet their design objectives. The OCC's Model Risk Management Handbook states unequivocally that “validation should be done by people who are not responsible for development or use and do not have a stake in whether a model is determined to be valid.”

Independent Validation Requirements

The question of who can validate AML AI systems requires careful consideration of both organizational independence and technical expertise. The “three lines of defense” model provides the governing framework:

For community banks and smaller fintechs, achieving true independence may require external validation resources, as the technical expertise required for AI model validation often does not exist separately from development teams.

Scope of Model Validation 

Comprehensive AML AI model validation encompasses three core elements mandated by SR 11-7:

AML-Specific Model Validation Challenges

Two technical challenges uniquely complicate AML AI model validation:

Back-Testing and Outcome Validation Requirements

While traditional back-testing—comparing model predictions to realized outcomes—proves challenging for AML models (there is no definitive dataset of “all money laundering that occurred”), alternative outcome validation approaches include:

The OCC's 2021 Model Risk Management Handbook provides practical guidance emphasizing that “traditional back-testing may not be the best form of outcomes analysis for BSA/AML models” and endorsing these alternative validation approaches.

The third pillar addresses the organizational framework, policies, and oversight processes that ensure model risk management operates effectively across the enterprise.

Model Inventory Requirements

Sound governance begins with knowing what models exist across the enterprise. SR 11-7 mandates that “banks should maintain a comprehensive set of information for models implemented for use, under development for implementation, or recently retired.” For AML AI systems, this requires cataloging, at a minimum:

The inventory must capture not only the existence of each model but also its risk rating, validation status, identified limitations, responsible personnel, and dependencies on other models or data sources. Many institutions discover during inventory exercises that AI/ML components have proliferated across AML functions without centralized tracking—a governance gap that creates both compliance risk and operational inefficiency.

Risk Tiering

Not all models warrant the same validation rigor. The OCC Handbook states that “model risk increases with greater model complexity, higher uncertainty about inputs and assumptions, broader use, and larger potential impact.” Risk tiering frameworks classify models as high-, moderate-, or low-risk based on factors including:

In practice, many emerging AML AI use cases—such as transaction summarization, investigative prioritization, evidence aggregation, and SAR narrative drafting—operate in a decision-support capacity. Where trained investigators retain full authority to accept, modify, or reject AI outputs, overall model risk is materially reduced. Regulators generally view these “human-in-the-loop” systems as lower-risk applications, warranting proportionate validation and governance rather than the full rigor required for automated decisioning models. Lower risk, however, does not imply exclusion from model inventories or oversight expectations. This distinction is particularly important for LLM-based applications, where outputs are informational rather than determinative, and investigators retain full authority over regulatory judgments.

The following illustration demonstrates how the degree of automation typically influences AML AI model risk classification in practice, assuming other risk factors such as data quality, complexity, and regulatory sensitivity are held constant.

High-risk models require more frequent validation (at least annually), more extensive documentation, and senior management involvement in approval and oversight processes.

Board and Management Oversight

SR 11-7 establishes clear board-level responsibilities: “Board members should ensure that the level of model risk is within their tolerance and direct changes where appropriate.” For AML AI specifically, this means senior leaders must understand and approve:

Boards need not understand the mathematical intricacies of gradient boosting algorithms, but they must understand which AML functions rely on AI, what risks those models carry, and how those risks are managed. Management reporting should include metrics such as models with overdue validations, models operating under exceptions, false positive trends, and SAR conversion rates.

Third-Party Model Risk

Many banks and fintechs rely on vendor platforms for AML AI capabilities, whether specialized monitoring systems, data enrichment services, or end-to-end compliance platforms. SR 11-7 explicitly addresses third-party models: “Vendor products should nevertheless be incorporated into a bank's broader model risk management framework following the same principles as applied to in-house models.”

Vendor due diligence must probe:

These challenges are amplified for third-party foundation models and LLM APIs used for AML decision support. Institutions should expect limited transparency into model internals, no access to traditional model development documentation, and reliance on provider assurances rather than independent model reports. As a result, validation must focus more heavily on controlled use-case scoping, output testing, human review processes, and contractual governance rather than model mechanics. In addition, effective governance of LLM-enabled AML use cases should include controls such as:

Institutions cannot outsource accountability for model risk. Even when using vendor models, banks remain responsible for validating that the model performs appropriately in their specific operating environment, with their customer population and transaction patterns. The vendor's validation documentation informs but does not replace the institution's own validation requirements.

Model Risk Documentation Standards

The governance framework culminates in documentation standards ensuring transparency, auditability, and continuity. Required documentation includes: