Thanks to all the MSBs that recently joined our Ask Us Anything Session, all about Transaction Monitoring for MSBs. Your questions were great and we hope you gained some new information and insights from our expert team.
ICYMI, here are a couple of key question highlights from the session…enjoy! 🤩
Do you have any thoughts on how AI can be used in Transaction monitoring so it is audit friendly for regulators?
It is helpful to look at AI as something that can complement an existing rule based Transaction Monitoring (TM) system, rather than completely replacing it. Traditional systems are straightforward and easily auditable because they are easy to explain - but challenges arise with traditional systems, including:
🔶 they are built around risks and patterns we already know about. The rules are static and not automatically adapted to new emerging risks and typologies.
🔶 traditional systems need to be manually reviewed and updated as risk changes.
🔶 predefined thresholds in traditional systems may not capture the bigger picture among customers and transactions. Some rules can create unnecessary noise. For example, multiple rules can trigger on the same activity which can lead to false positives and reviewing alerts that are not suspicious.
AI/Machine learning integrations can add a layer of value here by:
🔶 analyzing larger amounts of data and looking into data that is beyond individual transactions and identifying patterns and relationships that may be difficult to capture in a fixed rule.
🔶 identify connections between multiple customers, accounts and transactions that wouldn’t be obvious when reviewing separately or individually.
🔶 helping prioritize alerts. AI can help assess alerts and prioritize which may warrant attention ; helps with volume
🔶 can support investigations by summarizing transaction activity; reduces manual work.
Overall, a hybrid approach makes sense - use of AI can act as an additional layer in your transaction monitoring process on top of your rule based system to help identify more complex patterns and prioritize alerts.
Rule-based monitoring is still an important piece of TM programs, and in order to demonstrate that the TM program is risk-based and effective, Reporting Entities (REs) need to validate their models. This means:
🔶 ensuring that there are proper inputs into the TM system – In other words, being able to demonstrate that the data from the RE’s source system(s) are properly mapped to the TM system.
🔶 ensuring that the rules and thresholds address the risks that are tied to the RE’s risk assessment.
🔶 verifying that the system is operating as intended (i.e., alerts are firing according to rule logic and thresholds) and that alerts and cases are being properly reviewed and decisioned.
This means that RE’s should have a structure of oversight and governance structure over their TM programs. While Canadian regulations don’t specify how to validate your TM system, the NYDFS New York Department of Financial Services (NYDFS) Rule 504, provides a good basis for the standards against which the effectiveness of TM programs should be evaluated.
And, on to the next part of the question - how do you make your AI approach auditable?
Introduce your AI tools in a way that doesn’t create a “black box”. You need to be able to explain and understand what the AI is doing within your system. For example, you will need to be able to explain:
🔶 the “How” and “Why” of the AI integration and how the output was used in the investigation
🔶 how you tested the AI before and after implementation
🔶 what you do to consistently apply ongoing monitoring to the AI tool and its performance and outputs - modeling drifts can happen with AI due to changing data and you will need to review regularly to ensure this doesn’t happen or if it does, you can fix it.
Also, it is very important to ensure that you demonstrate human oversight is being applied. You need to be cautious about allowing an AI agent to independently close an alert or make a STR decision before a human has reviewed. Important compliance decisions must be made by your “human” team.
To summarize, you need to ensure you have proper governance, documentation, testing, continuous performance monitoring and human oversight for both your traditional rule based system and AI integrations to ensure the output can be understood and explained. Don’t just “Fire and forget”. This is how you make your AI agent with your system auditable.
There were so many other great questions and we thank you all for attending…stay tuned for details coming soon for our next Ask Us Anything Session!
And if you need any support with your AML technology system, please contact our experts to learn how we can help you implement and optimize a system that works best for your business’ needs.
We Help Keep FINTRAC Happy 🇨🇦
The article is provided for informational purposes only and is based on The AML Shop's understanding of the regulatory and legislative standards that were in place at the time that the session was held and the article was written. Those standards and FINTRAC's enforcement of them vary and change over time. The AML Shop is not a law firm and this article does not constitute legal advice. This summary also may not be applicable to your specific situation.