AI Governance for Financial Crime

Define purpose, authority and risk

Start by identifying the use case, affected workflow and decision the model or agent supports. Clarify whether it ranks alerts, summarises evidence, recommends a case outcome, or can trigger actions across connected systems. The more an AI component can change records, close cases or initiate consequential steps, the more carefully authority, approval gates, reversibility and escalation need to be considered. A useful scope distinguishes decision support from delegated action and identifies which people remain responsible at each stage.

Review evidence can include model or agent descriptions, intended-use statements, workflow maps, data sources, validation material, user instructions and existing policies. This helps identify how the organisation controls poor-quality or unrepresentative data, automation bias, prompt or tool misuse, model drift, opaque outputs and excessive permissions. Obligations depend on the organisation, activity and jurisdiction.

Make validation and human oversight practical

Governance needs evidence that fits the task. Discussion can consider whether testing uses relevant cases and defensible ground truth, covers expected and adverse conditions, and checks the effect of thresholds, data changes and downstream workflow. Explainability should be useful to the staff member who must assess an output: what information supports it, what limitations apply, and how can a person question or override it? A human approval step is meaningful only when the reviewer has sufficient information, authority, time and a clear route to challenge.

For agentic AI, scope can include tool access, permitted actions, transaction or case boundaries, logging, stop conditions, exception handling and the approval required before a consequential action. Governance also considers who may change prompts, rules, models or permissions, how changes are reviewed before release, and how performance and incidents are monitored afterwards. FATF's work on new technologies for AML/CFT describes potential benefits while stressing enabling conditions and the need to respect relevant privacy and data-protection frameworks.

• Purpose, users, affected decisions and prohibited or reserved actions
• Validation data, ground truth, limitations and performance measures
• Human review, override, escalation and audit-trail expectations
• Change approval, access permissions, monitoring and incident response

Set accountability and control boundaries

Advice can clarify decision rights, control questions and evidence gaps before an AI use case expands. The organisation remains accountable for its systems, regulatory decisions and deployment choices. Supplier selection is a separate question; governance applies whichever platform is chosen.

The March 2026 Transform Finance agenda listed sessions on agentic AI, data and financial crime control, and the opportunities and risks of self-learning AI. It names Trevor Barritt among event participants.