September 23, 2026

The Rules-to-Agents Migration Path for AML Programs

Axle Team

Key takeaways

AML program modernization is not a system replacement. The realistic path keeps detection rules as the trigger layer and moves investigation labor to agents in stages, each with its own control evidence.
FinCEN's April 2026 program proposal reframes the target: effective, risk-based programs that push resources toward higher-risk activity, with machine learning and generative AI named as acceptable means.
The April 2026 revised model risk guidance removed two obstacles at once. Deterministic rules are no longer "models," and generative and agentic AI sit outside its scope.
Start with the alert class whose correct disposition is most standardized, not the one with the highest volume. Agent QA needs a stable definition of "right."
Back-test on last quarter's closed alerts before touching live work. Historical dispositions are your labeled dataset and your first exam exhibit.

AML program modernization in 2026: why "rules to agents" is the right frame

AML program modernization means restructuring how a program detects, investigates, and reports suspicious activity so that effort tracks risk instead of alert volume. In practice: keep rules-based detection as the trigger, move evidence gathering and first-line disposition to AI agents in controlled stages, and redeploy analysts to escalations, SAR decisions, and quality review.

Modernization is often sold as a platform swap: replace the legacy monitoring engine, re-tune scenarios, wait 18 months. That project has its place, but it does not change the program's economics. Alerts still land on a queue and a person still works each one.

The rules-to-agents path attacks the other side: what happens after the alert fires. It can run on the monitoring system you already have.

What the 2026 proposals change about the target

FinCEN's April 7, 2026 notice of proposed rulemaking would replace the current program rules with a single standard built around effectiveness. The fact sheet describes the goal as "empowering financial institutions to direct more attention and resources toward higher-risk customers and activities rather than toward lower-risk customers and activities." The preamble is explicit that technology is a legitimate way to get there:

As part of having risk-based set of internal policies, procedures, and controls reasonably designed to ensure compliance with the BSA and FinCEN's regulations, financial institutions may choose to responsibly adopt new technologies or innovative approaches to comply with BSA requirements. Consistent with this purpose, FinCEN encourages financial institutions to evaluate whether new technology or innovative approaches in other resources might help to more effectively combat financial crime. Innovative approaches could involve machine learning, GenAI, digital identity, blockchain monitoring and analytics, or APIs.
— FinCEN, Anti-Money Laundering and Countering the Financing of Terrorism Programs, proposed rule, 91 FR 18704 (April 10, 2026)

The same preamble addresses the model risk management overhang that has slowed many AML technology projects:

While FinCEN has not issued or been party to any prior MRMG guidance, FinCEN shares certain concerns articulated in the comments to the RFI that these models, which are designed to assess different types of risks with different information input, processing, and reporting components may be overly burdensome and ill-fitted to address illicit finance risks.
— FinCEN, same proposed rule, 91 FR 18704

Ten days later the banking agencies acted on that concern. The revised interagency model risk guidance of April 17, 2026 (SR 26-2 / OCC Bulletin 2026-13) rescinded the 2021 statement on model risk management for BSA/AML systems, defined "model" to exclude "deterministic rule-based processes," and placed generative and agentic AI outside its scope.

FinCEN's comment period closed June 9, 2026. The Federal Reserve published its parallel proposal for Board-supervised banks on July 9, 2026, with comments closing September 8, 2026. FinCEN proposes an effective date 12 months after the final rule. None of this is final, but the direction is consistent across every agency. A modernization plan drafted now should be built for the effectiveness standard, not the process standard it replaces.

The four-stage migration path

0. Rules baseline — What the agent does: Nothing yet. What analysts do: Work every alert. Control evidence produced: Scenario tuning, threshold validation, QA sampling.
1. Agent-assisted — What the agent does: Gathers evidence, drafts disposition. What analysts do: Review every draft, make every decision. Control evidence produced: Draft-vs-final agreement rate, time per alert.
2. Bounded disposition — What the agent does: Finalizes defined low-risk alert classes. What analysts do: Sampled QA, all escalations, all SAR decisions. Control evidence produced: Decision matrix, QA error rates, back-test results.
3. Multi-workflow — What the agent does: Monitoring, screening, KYB reviews, SAR drafting. What analysts do: Investigations, decisions, oversight. Control evidence produced: Cross-workflow QA, effectiveness metrics.

Stage 1: the agent drafts, the analyst decides

Deploy the agent on one alert type. It pulls the customer file, prior alerts, counterparty data, and expected activity, then drafts the disposition. The analyst corrects and finalizes. Nothing in the control environment changes; you have added a research assistant. What you gain is data: how often the analyst agrees, where they disagree, and how long the alert took with and without the draft.

Stage 2: bounded disposition with sampled QA

Once agreement on a given alert class is consistently high and the disagreements are understood, write a decision matrix: alert type, customer risk tier, permitted outcome. The agent finalizes within that matrix and escalates everything else. QA samples its closures at a fixed rate and tracks error rates the same way it tracks analyst error rates. This is the stage where the 2018 interagency statement on innovation earns its keep:

Pilot programs undertaken by banks, in conjunction with existing BSA/AML processes, are an important means of testing and validating the effectiveness of innovative approaches. While the Agencies may provide feedback, pilot programs in and of themselves should not subject banks to supervisory criticism even if the pilot programs ultimately prove unsuccessful.
— Federal Reserve, FDIC, FinCEN, NCUA, and OCC, Joint Statement on Innovative Efforts to Combat Money Laundering and Terrorist Financing, December 3, 2018

Stage 3: agents across the program

With one workflow proven, the pattern repeats. Screening alerts get their own decision matrix (Baley handles this at Axle), as do KYB reviews (Justin) and SAR narrative drafting (Sam). Analysts concentrate on escalated investigations and the filing decision. Rules remain the detection layer throughout.

Keep the rules; move the work

A common objection is that agents should replace the scenarios, since scenarios generate the noise. Resist that in the first two stages. Deterministic rules are auditable, examiners understand them, and under SR 26-2 they are not even "models." Their weakness is that every alert costs the same human effort regardless of merit. Agents fix the cost side. After a year of structured agent outcome data, that data becomes the evidence base for threshold changes and scenario retirement, which is how a modern program should tune anyway.

One practitioner note. Do not pick your Stage 1 alert class by volume. Pick it by how standardized the correct disposition already is. Structuring alerts on payroll accounts, for example, usually have a narrow set of legitimate explanations and a clear escalation trigger. High-volume classes with judgment-heavy dispositions give you noisy agreement data and a QA function that cannot say what "correct" means. And run the back-test on a full quarter of closed alerts, including the ones that became SARs, before any live traffic. The output is a confusion matrix an auditor can read, and the first exhibit when an examiner asks why you trusted the agent with Stage 2.

The transaction monitoring alerts page describes what Stages 1 and 2 look like on a live queue. The ROI calculator converts alert volumes and handle times into the analyst hours each stage recovers.

FAQ

Does AML program modernization require replacing the transaction monitoring system?

No. The rules-to-agents path leaves the detection system in place and changes what happens after an alert fires. Replacing the monitoring engine is a separate project, and outcome data from agent dispositions makes that project better informed if you do it later.

How do examiners view AI in AML programs?

The 2018 interagency statement said pilot programs "should not subject banks to supervisory criticism even if the pilot programs ultimately prove unsuccessful." FinCEN's 2026 proposal would weigh effective use of AI tools as a favorable factor in enforcement decisions. Examiners will still test governance, documentation, and QA.

What is the difference between machine learning in AML and AI agents?

Machine learning models score or rank risk and feed a human queue, and they remain subject to model risk management. Agents execute investigative steps and produce documented dispositions; under SR 26-2 they are outside model risk scope and governed by the institution's broader risk framework.

Next step

If your modernization plan is still framed as a platform swap, reframe it as a staged migration and start collecting Stage 1 agreement data. Axle's platform overview shows how monitoring, screening, diligence, and SAR agents run alongside existing rules with the decision rights and audit trail this path requires.

The Rules-to-Agents Migration Path for AML Programs

More from the blog