How Agentic AI Improves Your AML Detection System’s Accuracy
Our Chief Data Scientist, Felix Berkhahn, recently presented on how agentic AI is transforming AML detection. He outlined three ways AI agents can optimize detection systems by analyzing false positives, identifying missed risks, and incorporating investigator feedback to recommend adjustments to detection rules and thresholds.
1. Threshold optimization
When FIs set monitoring thresholds too low, they inundate analysts with false positives that waste time and resources. Set them too high, and they miss real criminal activity. What's more, FIs must frequently optimize thresholds to keep pace with changing consumer behaviors, growing customer bases, new products, and criminal behavior.
But the optimization process is inefficient from the start. Typically, a data scientist manually pulls and analyzes historical data on a monthly or quarterly basis. This data is used to propose a single threshold change, which is then tested against old data in a static model. This approach assumes criminals will keep using the same methods — a dangerous assumption since they often change their techniques.
The manual nature of this process creates multiple bottlenecks. The data scientist must conduct expensive "pseudo-investigations" of historical alerts, manually reviewing samples to determine which were legitimate suspicious activity versus false positives. This labor-intensive validation process, while critical, can take days or weeks to complete for even small threshold adjustments.
Agentic AI automates the entire process. Instead of testing one threshold change at a time against historical data, AI agents intelligently choose and test the most promising parameter combinations simultaneously. They run targeted simulations on real-time data and instantly show you how those optimized changes affect your alert queue, false positive rates, and detection coverage. The result: a faster, more accurate analysis, delivered in minutes instead of manual back-testing.
2. Rule logic tuning
Rule logic tuning is a fundamentally different challenge than threshold optimization. When new financial crime typologies emerge, analysts can't just adjust numerical triggers. They must study each new typology, break it down into logical conditions, and design entirely new rules or modify existing ones.
Unlike optimizing thresholds, which focuses on adjusting transaction amounts, creating rule logic involves multiple interconnected conditions that must be carefully balanced. A single rule might combine time-based patterns, relationship networks, and behavioral anomalies - each condition affecting how the others perform.
The resource requirements are heavy and highly specialized. Turning these typologies into accurate rules takes deep knowledge of both emerging money laundering methods and normal customer behavior. You also need experts who can translate suspicious behavior patterns into clear, actionable rules.
AI agents are your on-demand data scientists. They continuously analyze transaction patterns, alert outcomes, and investigation results to find potential gaps in rule coverage. This includes reviewing cases that resulted in SARs or escalated investigations. When patterns emerge that current rules didn't initially flag, the agent recommends modifications.
For example, an agent might analyze recent SARs and notice a pattern where money laundering cases involved transactions between $8,000-$9,500 to jewelry stores or car dealerships. Based on this insight, the agent would recommend adding a new rule that specifically monitors for this combination of transaction amounts and merchant types, closing the detection gap before more criminal activity slips through.
3. Scenario coverage mapping
AML systems detect financial crime by matching transactions against predefined patterns called typologies. Knowing these typologies helps detection systems recognize suspicious activity and raise alerts for investigation. However, what keeps many compliance leaders awake at night is not what their systems can detect, but what they can't.
Detection coverage gaps happen for many reasons. Criminals constantly change tactics faster than systems can adapt — if a new laundering technique isn't in the model's training data, the system misses it.
Criminals are also getting better at mixing techniques and scaling their operations. A system might catch a single known typology just fine, but when someone combines layering, structuring, and trade-based laundering in a new sequence, it might not trigger any rules because each activity looks innocent on its own.
Growing crime syndicates involve more parties and increasingly complex money movement. Existing detection systems struggle with this complexity, often dismissing individual transactions without recognizing the larger network of behavior.
Every financial institution also faces unique risks based on its customer base, products, geography, and structure.
Agentic AI agents can highlight gaps in scenario detection where current systems underperform. Trained on common typologies, they can identify new types of suspicious activity and explain why it looks suspicious.
But there's a challenge: cost. For enterprises banks processing massive transaction volumes, the annual cost of running these models can balloon into the millions. It’s a budget few compliance departments can justify.
The answer lies in combining traditional AI systems with agentic AI.
Traditional AI models serve as the first line of defense, tuned with lax thresholds to cast a wide net and quickly identify the most likely suspicious transactions. This layer handles massive volume, processing hundreds of thousands of transactions daily.
Agentic AI handles the flagged subset, doing deep investigation work that would be too labor-intensive for humans and too expensive to automate at full scale.
Each flagged gap comes with documentation: what looks unusual, which typologies were tested, why they didn't match, and what suggests this is beyond your current abilities. This lets analysts evaluate the system's thinking and confirm whether the gap is a real threat or just an edge case needing refinement.
This gives compliance leaders a clear, data-driven view of their system’s blind spots, so they can prioritize resources on the most critical areas. By proactively identifying these gaps, the agent helps institutions build a more robust defense against a wider range of financial crimes.
Hawk’s AML Analyst Agent
The Hawk AML Analyst Agent is a powerful, enterprise-grade solution designed to integrate smoothly into your existing financial crime prevention framework. Unlike general-purpose AI, the Analyst Agent is built specifically for financial crime and compliance, embedding deep domain expertise directly into its reasoning.
Instead of treating regulatory and investigative knowledge as static text, it turns that knowledge into structured, actionable guidance. For example, a dedicated Typology Agent parses and summarizes typology documents, extracting practical signals and risk patterns that the system can apply to live cases.
Similarly, a Data Enrichment Agent interprets complex case data such as transaction histories, customer profiles, and external watchlists aligning it with domain ontologies so downstream analyses focus on what truly matters for investigators.
The Analyst Agent not only integrates seamlessly with existing detection models and data sources but also mirrors human investigative workflows, providing explainable reasoning, highlighting relevant signals, and adapting as regulations evolve. The result is a true investigative partner that’s auditable, adaptable, and tailored to the realities of financial crime.
Download Hawk’s agentic AI whitepaper
We've covered how agentic AI makes AML systems more precise, but there's more to the technology. Read here for how AI agents can streamline your entire investigation and SAR filing process. Thinking about bringing agentic AI into your AML program? Download our NEW whitepaper here, which covers everything compliance leaders need to think about, from performance and accuracy to security, integration, and ROI.