The Next Generation of AFC Needs Workflow Intelligence, Not Just Another AI Tool

AI is not replacing financial crime teams, but it is changing how they can search, investigate and act on risk signals.

The more useful question is not, ‘Can AI decide? It is, ‘Where in our workflow is effort being wasted, and can AI reduce that work without breaking auditability?’

Much of the current vendor conversation around AI centres on autonomous decisioning - agents that triage, resolve, and close without human review. That may sound efficient, but most firms are not yet able to explain that governance story to regulators.

The next generation of anti-financial crime (AFC) is not autonomous compliance. It's a workflow intelligence - copilots, agents, and natural-language search - sitting inside human-led workflows, governed by the same controls as everything else.

‍

Where does analyst time get lost today?

‍

Let’s take a typical transaction monitoring (TM) analyst reviewing an alert on an newly onboarded merchant with a sudden increase in cross-border payments. The four time sinks are familiar:

1. Context assembly

The analyst needs to pull KYC information, expected activity, transaction history, prior alerts, linked entities and case notes from multiple systems. None of those data points is useful in isolation. The value comes from seeing them together.

This is where time disappears. The analyst becomes the integration layer between systems that do not talk to each other.

2. Summarisation

Once the context is gathered, the analyst still must make sense of it. That may mean reviewing 200+ transactions, comparing current activity against onboarding data, and reducing the key facts into a clear investigation rationale.

The work is not just administrative. A poor summary can hide the real risk, overstate the issue, or make a defensible decision look weak.

3. Pattern recall

The analyst then must ask: Have we seen this before? Has a similar payment pattern appeared in the same corridor? Was it discounted, escalated or reported? In many firms, that knowledge is buried in closed cases, analyst memory and informal team conversations.

Lessons from past investigations do not reliably feed into current decisions.

4. Narrative drafting

Finally, the analyst has to document the outcome in a way that stands up to QA, audit or regulatory review. That may mean case notes, escalations suspicious activity reports (SAR) narratives or outreach to the customer.

This is judgement-adjacent work. It follows a pattern, but it still needs human review. The problem is that analysts often spend too much time writing and formatting the narrative, and not enough time testing whether the rationale is complete, consistent and defensible.

This is where copilots, agents and ChatGPT-style search become useful, but only if they are embedded inside governed AFC workflows rather than bolted on as another interface.

‍

Copilots - investigation quality and consistency

‍

A copilot is an assistant that surfaces relevant context, suggests next steps and helps analysts work through a case more systematically, without making decisions on their behalf.

Let’s return to the TM analyst example.

Instead of manually checking five systems, the copilot assembles a structured investigation view:

- customer profile and expected activity

- prior alerts and previous dispositions

- linked accounts, beneficiaries and counterparties

- unusual payment changes in the last 30 days

- relevant typology indicators

- a draft case summary with reference back to source records.

The analyst still validates the information, applies judgement and decides the outcome. The copilot simply reduces the manual effort required to get to an informed decision.

This is especially useful for consistency. A senior investigator may instinctively know which questions to ask but a newer analyst may not. A well-designed copilot can bring those prompts into the case flow so that every analyst is guided through the same investigation standard.

The boundary is important

✅ A copilot can: surface context, suggest questions, summarise information and draft investigation notes.

❌ It should not: complete workflow actions, submit outcomes, close alerts or make final risk decisions.

Copilots work best when grounded in institutional data rather than generic public knowledge. Retrieval-augmented generation, where responses are anchored to internal case data helps reduce hallucination risk and makes outputs more reviewable.

The practical test: can the analyst see what the copilot used, what it produced and what they changed before making the final decision?

‍

Agents - repeatable workflows with governance

‍

Agents are workflow actors that carry out bounded, repeatable tasks across systems under defined rules, permissions and review points. Unlike a copilot, which helps the analyst think through the case, an agent performs a specific step in the workflow and hands it back for human review.

Let’s take the same TM analyst example. The analyst wants to file a SAR on the merchant.

Instead of starting from a blank page, an agent can assemble the investigative story from structured case data, including:

- customer background

- transaction chronology

- behavioural indicators

- linked entities;

- prior alerts and case history

- rationale for suspicion

- supporting evidence.

‍

It can then produce a first draft aligned to the reporting template.

The analyst still makes the decision. They review, edit, validate and approve the final narrative.

The agent has simply done the legwork.

This is where agents are most useful in AFC. They are not there to replace judgement. They are there to handle judgement-adjacent work: tasks that are repetitive enough to support with automation, but sensitive enough to require human review.

‍

The boundary is important

✅ An agent can: gather evidence, populate fields, prepare review packs, draft SAR narratives and run checklist-based tasks.

❌ It should not: file SARs, close alerts, block customers, exit relationships or change thresholds without sign-off.

The governance requirement is simple: every agent action should be logged, attributed, explainable and reversible by a human reviewer.

The practical test: can the firm show what the agent accessed, what it produced, who reviewed it and what decision was made?

‍

ChatGPT-style search - finding signals across fragmented systems

‍

ChatGPT-style search or natural language querying means asking operational AFC questions in plain English and getting structured, evidenced answers without writing SQL, raising a data ticket or exporting half the case into Excel.

Let’s take the same TM analyst example. They want to know whether this newly onboarded merchant’s cross-border payment pattern has appeared before in other customers.

Instead of searching manually across cases, raising a data query or not looking at all, they ask:

‘Are there other customers with a similar transaction profile to this case’

A useful system should return:

- similar cases

- linked typologies

- relevant case notes

- related entities

- previous dispositions

- the evidence used in prior decisions.

‍

The analyst can then ask follow-up questions:

‍

‘Filter to the same corridor’

‘What outcomes were decided?’

‘What evidence did reviewers require in comparable cases?”

This matters because search friction changes behaviour. If a question is hard to answer, analysts often stop asking it. They work the queue in front of them rather than the risk behind it.

The boundary is important

✅ Search can: retrieve, connect, summarise and evidence information across systems.

❌ It should not: create answers that cannot be traced back to source data, operate on one silo only, or become another isolated assistant outside the AFC workflow.

ChatGPT-style search is not just a better interface; it compresses the time between a question and the evidence needed to answer it. Connected to your transaction data, case management system, control library, and evidence trail - it becomes an operational capability.

The practical test: can the search reach the data, cases, controls, investigations, governance records and evidence needed to support the answer?

‍

The line AI cannot cross - regulatory defensibility

‍

The accountability principle is straightforward: every AFC decision that carries regulatory consequence needs a human who can explain it, evidence it and own it.

The evidence trail needs to show what the AI produced, what the human reviewed, what decision was made and why. If that chain is missing, the AI output is not a controlled capability; it is an uncontrolled variable.

AI outputs without an evidence trail are a finding waiting to happen.

‍

From speed to quality: the control outcome question

‍

Faster investigation is useful, but speed is not the end goal. The question that matters is whether AI improves decision quality and control effectiveness. That means measuring more than time-per-case.

‍

Vendors will pitch productivity, but you should ask harder questions:

- Are QA pass rates higher on AI-assisted cases?

- Is disposition rationale more consistent across analysts?

- Are SAR narratives clearer, better evidenced and less likely to require rework?

- Can the firm identify control gaps earlier?

- Can every AI-assisted decision be defended to the regulator from start to finish?

- The strongest AI use cases in AFC are not just about removing work. They are about raising the quality floor across the team, making hidden context easier to find and reducing rework.

‍

How Fortify helps

‍

AFC teams do not need another AI point tool. They need an intelligence layer that connects data, controls, investigations, governance and evidence into one workflow.

Fortify brings copilots, governed agents and natural-language search into the AFC operating model, helping teams move from signal to understanding faster while keeping decisions reviewable and defensible.

See here how Fortify connects AI to your AFC workflow.

‍