$940M in AML Penalties Last Year. Run This AI Compliance Audit Before It's You.

Start with one question. Of every 100 alerts your anti-money laundering (AML) system generates, how many lead to something that actually matters? An escalation, a suspicious activity report (SAR) filing, a case an examiner would recognize as real detection work.

Most teams we work with answer somewhere between two and five. A FinCrime Frontier survey of institutions across North America and EMEA put the industry number on it:

The full argument for why this gap exists across financial services AI operations is in the opening piece of this series. These six checks are the audit.

The program is running. That is not the same as working. We covered why that gap exists across financial services operations in the opening piece of this series. These six checks tell you where your compliance program specifically sits. On April 7, 2026, FinCEN proposed a rule that makes this distinction regulatory. The shift is from process-based to effectiveness-based compliance. The question is no longer whether the institution ran its program. It is whether the program produced outcomes.

Six checks. Each runs on data already in your systems. Together they tell you exactly which side of that line your operation is on.

1. Does Your Risk Assessment Actually Drive Your Monitoring?

Most risk assessments are thorough when written and disconnected from the program within 18 months. Products launch. Customer profiles shift. The document stays.

FinCEN’s proposed rule codifies risk assessment as a legal obligation, aligned with FinCEN’s National AML and countering the financing of terrorism (CFT) Priorities, updated whenever the institution’s risk profile materially changes. It must drive real monitoring decisions, not sit in a compliance folder.

How to run it:

• Pull your most recent AML risk assessment
• List every monitoring scenario, alert threshold, and calibration it generated
• Compare that list against every product, customer segment, and geography your institution operates today
• Count the gaps

 

Any product active for more than 90 days without a scenario traceable to the risk assessment is a documented gap under the new FinCEN effectiveness framework.

 

What it tells you: a risk assessment that does not drive monitoring rules is a compliance document, not a compliance program. If the list of gaps runs long, the assessment needs to be reconnected to operations before any AI layer is added on top of it.

2. Is Alert Volume Outgrowing Your Team’s Capacity to Act?

This is the check that most directly predicts regulatory exposure. The math is simple and most compliance leaders have never run it.

How to run it:

• Pull total alert volume for the trailing 12 months and the prior 12
• Pull analyst headcount over the same two periods
• Calculate the year-over-year growth rate for each
• Subtract analyst headcount growth from alert volume growth

 

If alert volume is growing more than 15% faster than analyst capacity year over year, the program is on a structural exposure trajectory.

 

The cost of getting this wrong is specific.

• Mid-market institutions generating 50,000 alerts per year spend $25 to $50 per investigation
• At 95% false positives, that is roughly $2.4M annually generating documentation, not detecting crime
• Under 31 CFR 1020.320, a suspicious activity report must be filed within 30 calendar days of detection. A backlog that pushes triage past Day 30 is a Bank Secrecy Act (BSA) violation, independent of whether the underlying activity was suspicious

 

What it tells you: if alert volume is growing faster than the team, the program will breach the 30-day filing window before the next examination cycle. This is the most predictable enforcement trajectory in financial services compliance.

3. Can Your AI System Explain the Decisions It Assisted?


Pull ten recent alert dispositions where AI contributed to the outcome. For each one, ask a single question.

Can this system produce a specific, policy-mapped reason for the decision? Not a confidence score. A specific explanation: this alert was cleared because the transaction matched the behavioral baseline for this customer segment, cleared sanctions screening at the documented threshold, and fell within the risk-tier limit for this product category.

How to run it:

• Select 10 recent AI-assisted dispositions at random
• For each, request the documented reason in the language of your risk policy
• Count the ones that cannot produce a specific, policy-traceable explanation

 

More than three out of ten failing this test means the AI is not built around your compliance framework. It is running alongside it.

 

Supervisory Letter 26-2 (SR 26-2), issued in April 2026 by the Federal Reserve, the Office of the Comptroller of the Currency (OCC), and the Federal Deposit Insurance Corporation (FDIC), excludes generative and agentic AI from its scope, creating a governance gap. Institutions building explainability now are building the audit trail that will matter when further guidance arrives. Enforcement through 2025 and 2026 has increasingly pursued compliance officers personally. An AI system that cannot explain its decisions does not protect the officer who relied on it.

4. Are You Measuring Activity or Outcomes?

Most compliance programs track what is easy to count: alerts reviewed, SARs filed, cases opened and closed. The FinCEN proposed rule asks a harder question. What did all of that activity produce?

Three outcome metrics. Your program should be able to produce all three, for the trailing 12 months, in under an hour.

• False positive rate for your transaction monitoring system
• Average investigation time per alert from trigger to disposition
• Percentage of SARs filed that generated law enforcement follow-up (industry median: 4%)

 

If you cannot produce all three on request, the program is tracking activity. The FinCEN effectiveness framework requires the other thing.

 

The Wolfsberg Group named the underlying problem in July 2025: many programs remain risk-based in name only. Tracking alerts reviewed without tracking what proportion produced outcomes is the operational definition of that phrase.

5. Does Your Monitoring Cover the Payment Rails Running Right Now?

This is the check most compliance audits have not caught up to yet. The payment infrastructure changed faster than the monitoring programs covering it.

• The EU Instant Payments Regulation came into force October 2025: transactions settle in under ten seconds, around the clock
• FedNow adoption is projected at 80% of US financial institutions by end of 2026
• Batch monitoring systems were calibrated for end-of-day processing. Real-time rails do not have an end of day.

How to run it:

• List every payment rail your institution operates: wire, ACH, real-time payments, card networks
• For each, identify the monitoring system and its processing frequency
• Flag any rail that settles faster than the monitoring refreshes

 

Any real-time or near-real-time payment rail covered by a batch monitoring system is an unreviewed window for financial crime.

 

What it tells you: if your institution operates FedNow or processes under the EU Instant Payments Regulation and monitoring runs on overnight batches, the compliance program has a structural blind spot it has not yet named.

6. Can the Program Survive the Departure of Its Two Most Experienced People?

Name your two most experienced compliance analysts or your BSA officer. Then run this exercise.

How to run it:

• List five workflows each person owns that nobody else fully understands
• For each workflow: is the decision logic documented somewhere accessible?
• For each workflow: is there a cross-trained backup who has independently run it?

 

More than two workflows failing both questions is a single point of failure that now carries regulatory consequences.

 

FinCEN’s proposed rule requires a designated compliance officer based in the United States and accessible to regulators. Underneath that requirement is a continuity obligation. Individual enforcement actions through 2025 and 2026 have made personal liability real for senior compliance staff.

When the senior analyst leaves, the AI system tuned to her patterns inherits nothing. The new hire reaches full capability in three to six months. During that window, the judgment layer your SAR narratives depend on is either absent or underqualified. Examiners reviewing trailing SAR quality over time will notice. They always do.

What These Six Checks Actually Reveal

A program that passes all six was designed around outcomes. The risk assessment drives monitoring logic. Monitoring covers every product and payment rail active today. The AI that assists decisions can explain them. Outcomes are measured, not just activity. The program survives personnel change.

Most programs were designed to satisfy a process framework. The FinCEN proposed rule and the Wolfsberg Group’s July 2025 warning carry the same message from different directions: activity is not effectiveness. The $940 million in AML penalties issued in 2025 is the endpoint of the gap between them.

If these checks surface something structural, the question is what to build on top of your existing operation to close it. Let’s talk.