September 15, 2026

How AI Agents Investigate a Transaction Alert, Step by Step

Axle Team

Key takeaways

AI transaction alert investigation follows the same seven steps a good L1 analyst follows: scope the alert, assemble the customer and transaction picture, test the alerting typology, look for what the rule missed, decide, write the rationale, and route for review.
The difference is consistency and completeness. An agent runs every step on every alert, in the same order, and writes down what it found, which is what examiners actually test.
FinCEN's October 2025 SAR FAQs confirm there is no requirement to document no-SAR decisions, but a concise documented rationale is still the cheapest defense you have in an exam.
Human review stays in the workflow. The agent produces a recommendation and a rationale; a reviewer owns the disposition. Where that line sits should be a documented, risk-based policy decision.
Measure the agent the way QA measures analysts: overturn rate on sampled dispositions, escalation precision, and time-to-decision, tracked by typology.

What AI transaction alert investigation looks like in practice

AI transaction alert investigation is a workflow in which an AI agent receives a transaction monitoring alert, pulls the relevant customer, account, and transaction data, evaluates the activity against the alerting typology and other red flags, and produces a recommended disposition with a written rationale and evidence references. A human reviewer then approves, modifies, or escalates the recommendation.

That is the whole idea. Nothing about it is exotic, and that is the point. Institutions that struggle with alert backlogs are rarely short on analytical judgment. They are short on hours. An agent that executes the routine steps of an investigation reliably, and documents them, frees analysts for the cases where judgment matters.

Below is the step-by-step version, using a common alert type as the running example: a structuring scenario on a small-business deposit account.

Step-by-step: how an AI agent works a transaction alert

1. Scope the alert

The agent reads the alert payload: scenario name, threshold logic, triggering transactions, lookback window, and any prior alerts on the account. It restates the question in plain terms: "Six cash deposits between $8,200 and $9,700 over eleven days, totaling $54,100, on an account with a stated cash-intensive business profile."

This step matters more than it sounds. Analysts under backlog pressure skip it and start from the transaction list. Restating the alert forces the investigation to be about the hypothesis the rule raised, not just the transactions.

2. Assemble the customer picture

The agent pulls KYC data (business type, expected activity, onboarding date, beneficial owners), prior alert and case history, prior SARs, and any open enhanced due diligence. It flags gaps: an expected-activity profile that was never updated, or a beneficial owner change with no refresh.

3. Assemble the transaction picture

Now the agent looks at the full activity, not just the alerting transactions: deposit patterns over a longer window, outbound flows, counterparties, channels and branches, and timing relative to business hours. For the structuring example, the key questions are whether the deposit amounts cluster just below the reporting threshold, whether they were made at different branches or by different people, and whether the pattern is new.

4. Test the typology, then look past it

The agent evaluates the alerting typology directly. Is there evidence the deposits were designed to evade reporting, or is the pattern consistent with a business that simply takes in cash daily? FinCEN's October 2025 FAQs are explicit that a threshold-adjacent pattern alone is not enough:

"Financial institutions are not required to file structuring SARs absent information that the transaction, or series of transactions, is designed to evade reporting requirements under the BSA."
— FinCEN, Frequently Asked Questions Regarding Suspicious Activity Reporting Requirements, October 2025

Then the agent looks for what the rule did not ask about: rapid outbound wires after the deposits, new high-risk-jurisdiction counterparties, adverse media on the owners, or activity inconsistent with the stated business. Rules alert on one pattern; investigations are supposed to cover the account.

5. Recommend a disposition

The agent produces one of a fixed set of outcomes: close with rationale, close and update customer profile, escalate to L2 / case, or recommend SAR. It does not invent categories. Keeping the decision variable fixed is what makes the agent's performance measurable.

6. Write the rationale and cite the evidence

Every recommendation comes with a written rationale that names the specific data points relied on and links to the source records. For a close, the rationale answers the alert's hypothesis directly. For an escalation, it lists the unresolved red flags and the additional information needed. If the case proceeds to a SAR, that same evidence feeds the narrative. See how to write a SAR narrative for what that should contain.

7. Route for human review

The recommendation, rationale, and evidence go to a reviewer. Depending on policy, low-risk closes may be sampled rather than individually reviewed, while every escalation and SAR recommendation gets a human owner. The reviewer's decision, and any disagreement with the agent, is logged.

Why documentation is the whole game

Examiners do not re-investigate your alerts. They test whether your process works. The FFIEC BSA/AML Examination Manual is explicit that the SAR decision is an inherently subjective judgment and directs examiners to focus on whether the bank has an effective SAR decision-making process rather than on individual SAR decisions (FFIEC BSA/AML Examination Manual, Suspicious Activity Reporting).

That cuts both ways for AI. A process that produces the same steps, the same evidence, and a written rationale on every alert is very easy to test. A process where the agent's reasoning is not visible is not a process at all in the examiner's eyes.

On no-SAR documentation specifically, FinCEN clarified in October 2025:

"There is no requirement or expectation under the BSA or its implementing regulations for a financial institution to document its decision not to file a SAR. FinCEN has previously encouraged, but not required, financial institutions to document the decision not to file a SAR."
— FinCEN, SAR FAQs, October 2025

The same FAQ adds that where an institution chooses to document, "a short, concise statement documenting a financial institution's SAR decision will likely suffice" in most cases. This is exactly the output an agent produces at near-zero marginal cost. Our advice: keep documenting closes. The relief is that the documentation can be short, not that it should disappear.

The practitioner insight: the disagreement log is the product

Most teams evaluating AI transaction alert investigation focus on agreement rate: how often did the agent's disposition match the analyst's? That number is table stakes and mostly measures how many easy alerts you have.

The number that changes your program is the disagreement log. Every alert where the agent and the reviewer diverged, tagged by who was right after QA. In our experience running these workflows, the disagreements fall into three buckets, and each one is a different action item:

Agent was right, analyst was wrong. Usually a fatigue or shortcut error. This is your training and QA finding.
Analyst was right, agent was wrong. Usually a data gap (the agent could not see a system the analyst checked) or a novel typology. This is your integration or prompt-tuning backlog.
Both defensible. This is your policy ambiguity. Write the rule down and the disagreement disappears.

The trade-off is that maintaining this log takes reviewer discipline in the first months, when the temptation is to just approve. Teams that skip it end up with an agent that is fast and a QA function that cannot explain why it trusts it.

What regulators have said about AI in transaction monitoring

None of this is new territory for the agencies. The 2018 interagency statement anticipated exactly this workflow:

"For example, when banks test or implement artificial intelligence-based transaction monitoring systems and identify suspicious activity that would not otherwise have been identified under existing processes, the Agencies will not automatically assume that the banks' existing processes are deficient."
— Federal Reserve, FDIC, FinCEN, NCUA, OCC, Joint Statement on Innovative Efforts to Combat Money Laundering and Terrorist Financing, December 2018

Two 2026 developments are worth tracking. The revised model risk management guidance (SR 26-2 / OCC Bulletin 2026-13, April 2026) places generative and agentic AI outside its scope and leaves governance to the institution, which is covered in our post on model risk management for AI in AML. And FinCEN's April 2026 AML/CFT Program Rule NPRM proposes that use of "innovative tools such as artificial intelligence" would be a factor the Director considers in enforcement and significant supervisory action decisions. It is a proposal, but the signal is clear.

How to measure an investigation agent

Overturn rate on sampled closes — What it tells you: Whether closes are defensible. How QA already measures analysts: Same metric, same sample.
Escalation precision — What it tells you: Whether escalations turn into cases or SARs. How QA already measures analysts: L2 acceptance rate.
Evidence completeness — What it tells you: Whether each step above has a data reference. How QA already measures analysts: QA checklist scoring.
Time to recommendation — What it tells you: Throughput and backlog effect. How QA already measures analysts: Alerts per analyst-day.
Disagreement log by bucket — What it tells you: Where to invest next. How QA already measures analysts: Not typically tracked, and should be.

Run these by typology. An agent that is excellent on structuring and weak on trade-based patterns should be trusted differently on each.

Where Axle fits

Rose is Axle's transaction monitoring investigation agent. She works alerts through the steps described here, produces a written rationale with source references for every recommendation, and hands off to a human reviewer inside the workflow. The transaction monitoring alerts solution page covers how teams configure review thresholds, and the ROI calculator helps size the backlog effect before a pilot.

FAQ

Can AI close transaction monitoring alerts without human review?

Technically yes; whether you should is a risk-based policy decision that your model risk and compliance governance should make and document. Most institutions start with full human review of every recommendation, then move low-risk closes to a sampled review once overturn rates and disagreement logs support it.

Do we have to document alerts that are closed without a SAR?

No. FinCEN's October 2025 SAR FAQs confirm there is no BSA requirement to document a decision not to file. FinCEN still encourages it, and a short, concise statement is usually sufficient. Because an agent produces that statement automatically, most teams keep documenting.

How is AI alert investigation different from rules-based monitoring?

Rules decide which activity generates an alert. Investigation decides what the alert means. AI agents work the investigation step; they do not replace the detection scenarios, though the evidence they surface is useful input for rules tuning.

See how Rose investigates transaction alerts end to end: https://www.axleruns.com/agent/rose

How AI Agents Investigate a Transaction Alert, Step by Step

More from the blog