FinCEN's Stance on AI in AML Programs

What this guide covers

• Regulatory baseline Why AI tools remain subject to existing AML program obligations
• Model governance Validation, explainability, and performance monitoring expectations
• Human oversight Preserving analyst accountability for AI-assisted alerts
• Recordkeeping Documentation examiners expect to reconstruct AI-driven decisions

Model validation and ongoing performance governance

AI and machine learning tools used in transaction monitoring, customer due diligence, and suspicious activity detection remain subject to the same Bank Secrecy Act program obligations that apply to any AML detection method. Compliance teams should not treat AI-driven systems as exempt from existing risk assessment, validation, human oversight, and recordkeeping requirements.

Institutions should be prepared to demonstrate governance of these tools to examiners using established model risk management practices. That includes defined validation criteria and cadence for both pre-deployment testing and ongoing performance monitoring, as well as documentation that describes intended use, scope, and limitations of every AI tool used in AML detection.

Human oversight and explainability in alert review

Human review remains central when AI assists alert generation or scoring. Analysts should be able to explain, for any individual alert, which inputs or features drove the AI-generated score. Override and escalation actions should be logged and retrievable, not only theoretically available under policy.

Explainability should attach to each alert, not only to aggregate model documentation. Connecting AI outputs to existing case files and audit logs keeps analyst accountability intact and supports consistent examination narratives.

Recordkeeping, auditability, and governance architecture

AI-driven AML decisions create recordkeeping obligations similar to any other component of an AML program: institutions should retain sufficient records to reconstruct what happened, when, and why. This does not require new categories of retention distinct from existing BSA/AML recordkeeping practice, but it does require that underlying inputs, outputs, and decision logic be captured in a form examiners can review long after an alert was generated or dismissed.

1. 1

   Versioned model lineage

   Retain data sources, feature sets, parameters, and thresholds in effect at the time each alert was generated.

2. 2

   Case management integration

   Connect AI outputs directly to existing case files and audit logs rather than operating as a separate, disconnected layer.

3. 3

   Per-alert explainability

   Store the rationale for each individual alert alongside the alert itself, not only in aggregate documentation.

4. 4

   Change management logging

   Capture retraining, recalibration, and threshold changes as discrete, timestamped events.

5. 5

   Override and escalation records

   Log every instance where an analyst accepted, modified, or overrode an AI-generated score.

Runtime governance and examination readiness

Runtime governance ties model version, thresholds, inputs, and human actions to each decision so historical alerts can be reconstructed under examination. AI tool documentation should be retained under the same policies governing other BSA/AML recordkeeping requirements.

Teams that can produce intended-use documentation, validation evidence, per-alert rationale, and override history are better positioned to show that AI-assisted detection remains inside the institution’s existing AML control framework.

Readiness checklist

Use the following questions to assess whether governance over AI-driven AML tools will stand up to examiner scrutiny:

• Can you produce documentation describing the intended use, scope, and limitations of every AI tool used in AML detection?
• Do you have defined validation criteria and cadence for both pre-deployment testing and ongoing performance monitoring?
• Can analysts explain, for any individual alert, which inputs or features drove the AI-generated score?
• Are human review and override actions logged and retrievable, not just theoretically available?
• Can you reconstruct the exact model version, thresholds, and data in effect at the time a specific historical alert was generated?
• Is AI tool documentation retained under the same policies governing other BSA/AML recordkeeping requirements?