Aged AML Alert Backlog and an AI Triage Proposal
A mid-sized retail and SME bank generates 138,000 transaction-monitoring alerts a year against 1.4m customers. Ninety-one percent are closed with no suspicious activity report. The team has 41 investigators producing a median of 4.2 closures per day against a target of 6. The aged backlog is 9,600 alerts over 90 days old, including 210 linked to high-risk jurisdictions. The regulator has issued two findings: insufficient resources and inadequate alert-quality documentation. A vendor offers an AI triage tool claiming a 55% reduction in alerts, with a six-week pilot on 15% of the flow showing 61% precision against a 34% human baseline, but a 4.2% false-negative rate on the vendor's own synthetic test set. Full rollout would cost €1.1m a year and require sending masked customer data to a cloud environment in another jurisdiction. The board wants the backlog cleared within one quarter.
1. Recommend a 90-day plan to clear the aged backlog and remediate the regulator's findings, ranking actions by risk.
Read the worked answer
Risk-ranked plan, not a queue-clearing exercise.
Tier 1 (days 1–14): risk, not age. Re-screen the 9,600 aged alerts against typology risk. The 210 high-risk-jurisdiction alerts, any PEP or sanctions-adjacent matches, and any alert on accounts with prior SARs go to a dedicated senior team of six. These must be closed or escalated within 14 days. FIFO clearance would leave the highest-risk cases at the back of the queue and is exactly what the regulator would criticise.
Tier 2 (days 15–45): capacity and documentation. Backfill with 12 contract investigators, with a named accountable manager and daily quality sampling of 10% of closures. Rewrite closure rationale templates so each disposition records the typology considered, the data reviewed and the reason for no SAR. That closes finding two without waiting for the AI tool.
Tier 3 (days 46–90): root cause. The 91% closure rate is the real metric. Run a threshold and scenario review on the top five rules; expect to retire or re-parameterise rules generating the highest false-positive volume. Document every change with before/after volumes and a validation sign-off.
Sequencing rationale: the bank cannot tune or automate its way out of a backlog it has not risk-ranked. Capacity comes before tooling; documentation comes before any threshold change, because tuning without a baseline destroys the audit trail.
Board reporting: weekly aged-alert count by risk tier, SAR conversion rate, and quality-sample failure rate. Do not report a single clearance number.
2. The vendor's AI triage tool is proposed for full deployment. Set out the validation and governance conditions you would require before scaling, and how you would measure post-deployment performance.
Read the worked answer
Conditions before scaling:
- Independent validation, not vendor validation. The 4.2% false-negative rate is on a synthetic set chosen by the vendor. Require a test on at least 12 months of the bank's own labelled alerts, with the false-negative rate measured specifically on confirmed-SAR cases. A triage tool that suppresses alerts is a model risk decision, not a productivity one.
- Role limitation. The tool may prioritise and route; it may not auto-close. Human disposition remains mandatory, with the AI score visible and overridable, and overrides logged.
- Explainability and audit trail. Each suppression must record the features driving it, in a form an examiner can read. Black-box routing will not survive a finding.
- Data and outsourcing clearance. Cross-border transfer of masked customer data requires a transfer impact assessment, a processing agreement with audit and termination rights, and regulator notification under outsourcing rules. If the vendor refuses audit rights or change notice, no deployment.
- Model governance. Register it in the model inventory, assign an owner, set tolerance thresholds, and define change control, including silent vendor updates.
Post-deployment metrics: precision and recall on a monthly holdout; SAR conversion rate by AI-prioritised versus human-prioritised cohorts; false-negative rate from sampled closed alerts; time-to-disposition; and a quarterly independent quality review. Set a kill switch: if recall on confirmed-SAR cases drops below the human baseline by more than 5%, suspend and revert. Report all of this to the board risk committee, not just the alert reduction.