Automating AML L1 Alert Review, With Analyst Sign-Off

Last updated: September 2026

AML L1 alert automation is defensible when an agent does the gathering and a named analyst still makes the call. Level 1 review is two jobs done by one person: assembling the evidence behind a transaction monitoring alert, and judging whether the activity is explained. The first job, and the first draft of the closure rationale, can be automated. The disposition, the escalation decision and the QC sample stay with people, and every disposition needs a record that lets someone reconstruct it months later.

TL;DR

• Level 1 (L1) review is the first look at a transaction monitoring alert: gather the evidence, decide whether the activity is explained, then close the alert with a rationale or escalate it.

• Much of an L1 analyst's time goes into gathering. An agent can pull the transactions, customer history, counterparties, adverse media and related entities into one view, and draft a recommendation with its reasoning.

• A named analyst keeps the disposition and the decision to escalate, and can always go back to the source. Any lighter review for a queue belongs in a written policy.

• A defensible disposition record shows what fired, what the reviewer saw, what was recommended and why, what was missing, and who decided.

• QC starts with full review of the agent's recommendations and moves to sampling once the agent has been validated. The sample covers both error directions.

• Agentic AI is outside the scope of the revised US model risk guidance (SR 26-2, OCC Bulletin 2026-13 and FDIC FIL-15-2026), so the institution's own governance sets the controls and its records have to show them.

What is AML L1 alert automation?

AML L1 alert automation is the use of software agents to prepare Level 1 review of transaction monitoring alerts while a named analyst still decides each one. Level 1 is the first stage of AML alert review: the analyst gathers the evidence, decides whether the activity is explained, and either closes the alert with a written rationale or escalates it. With L1 automation, the agent does the gathering and drafts the rationale, and the analyst makes the disposition.

The test of any AML automation is whether a decision can be reconstructed later. Months after the fact, an examiner should be able to see what the reviewer saw, what the agent recommended, who decided and why. The FFIEC's BSA/AML examination manual already expects investigators working alerts to document their conclusions, so the expectation predates any agent.

What does an L1 analyst actually spend time on?

An L1 analyst spends much of each review assembling evidence from several systems and writing routine rationale, and less of it on the judgment the role exists for. The FFIEC's examination manual describes suspicious activity monitoring as five interdependent components: identification or alert of unusual activity, managing alerts, SAR decision making, SAR completion and filing, and monitoring and SAR filing on continuing activity. L1 review sits inside managing alerts, between detection and the SAR decision.

The L1 part of the lifecycle runs like this:

1. The alert fires. A monitoring rule or model flags activity on an account. Whether a rule or a model should do the flagging is a design choice of its own, covered in an explainer on transaction monitoring rules versus machine learning.

2. Triage. AML alert triage starts with what the alert fired on, the customer it concerns and any prior alerts.

3. Gathering. The analyst assembles the alert's transactions, the customer's profile and expected activity, and the counterparties involved, often from several systems.

4. Judgment. The analyst decides whether the activity is explained.

5. Rationale. The reasons go in writing.

6. Disposition. The alert is closed, or escalated for AML investigation.

7. QC. A sample of closed and escalated alerts is checked later.

Gathering and writing up take most of the effort. An IT delivery manager at an asset manager described watching analysts work an alert: the first thing they did was leave the case tool and log into several other systems to get data it did not hold. A BSA manager at a credit union wanted the team to have time "to devote their precious brainpower onto the situations that really require it, as opposed to your level one alerts and filling in fields on CTRs and SARs."

Not every team has a backlog. An SVP and BSA officer at a community bank said the bank had no backlog of alerts, cases or SARs: "So, it's hard sometimes to make a case for us." For a team like that, the case for structured L1 preparation is consistency and a record that holds up at examination. A head of global screening operations at a large bank said: "The more important part is its consistency of execution."

Some of what slows L1 review starts upstream. A chief compliance officer at a payments company said the priority was "getting better alerts, getting rid of the false positives, which just take up extra time during the day." Reducing how many alerts fire in the first place is a tuning question, covered in a separate guide on reducing AML false positives. Hits from sanctions and watchlist screening sit outside this workflow too, and follow a review of their own that the guide to AI sanctions screening agents explains.

Which parts of L1 review can an agent take on, and which stay with the analyst?

An agent can take on the gathering and the first draft of the rationale, while the analyst keeps the disposition, the escalation decision and the right to investigate independently. The gathering covers the alert's transactions and the customer's history, counterparty lookups, adverse media checks, related entities and a comparison with the customer's expected behavior, and it ends in a drafted recommendation with its reasoning. What the agent hands over is a recommendation on how to disposition the alert. The disposition itself belongs to the analyst.

A BSA officer at a community bank said this was the point that mattered: "You said what I needed to hear is that it gives a recommendation. It's not physically like writing the disposition."

Everything in the middle column is preparation. Every decision is in the last column.

Some teams want the agent to go further. A BSA/AML manager at a regional bank asked whether an alert firing within a certain threshold could be cleared without an analyst ever looking at it. A BSA/AML officer at a regional bank rejected the idea: "There's no point in generating an alert and let the system clearing it."

The defensible answer is a written policy for each queue. The practical question is which alert types an analyst may clear on a recommendation with strong evidence behind it, and which always get full manual review whatever the agent recommends. The institution decides that queue by queue, writes down its reasons and can show them to an examiner. A default buried in a tool's configuration meets none of those tests.

The analyst also keeps the right to go back to the source. A director of compliance and BSA at a community bank said that, however much they like AI, they do not fully trust it, and need to be able to go back and do their own research on an alert. That only works when every recommendation carries the evidence behind it. Which role should hold which review right is the subject of a separate piece on human-in-the-loop in fraud and AML.

What does a defensible disposition record contain?

A defensible disposition record contains enough for someone else to reconstruct the decision months later: what fired, what the reviewer saw, what was concluded and who decided. The FFIEC's examination manual says that after thorough research and analysis, "investigators should document conclusions including any recommendation regarding whether or not to file a SAR." On SAR decisions, it tells examiners to "focus on whether the bank has an effective SAR decision-making process, not individual SAR decisions." Examiners test the process, so the record is what an L1 design is judged on.

A record with any of these rows empty cannot be reconstructed, however sound the decision was.

When a key fact is missing, the record should say so. It should show that the alert went to a person or that an information request went out, rather than a gap the reviewer guessed past. An agent built for L1 review should flag the specific gap, such as a missing date of birth or address, and recommend manual review instead of forcing a disposition.

A director of compliance, BSA and strategy at a community bank described the examiner's question: "I get an examiner will ask me like, how did you determine? Like how did the system determine this? And if I don't have it in writing, I won't be able to defend it."

When should an alert leave L1?

An alert should leave L1 when the reviewer cannot clear it with sufficient mitigants within the agreed time, including when an information request is still outstanding. A director of AML compliance at a regional bank described an outsourced L1 team that must clear or escalate each alert within a fixed window. If the team does not have sufficient mitigants to clear an alert by the end of that window, even while waiting on an information request, it escalates to an in-house investigator. Escalation becomes a rule that can be followed and audited.

Some teams have no formal flow at all. A chief compliance officer at a payments company said the company had no formal escalation structure from L1 alerts to cases or investigations, and no rule that sends an alert to a different queue. An agent cannot follow a rule nobody wrote, so automating L1 review forces the escalation criteria to be written down.

Automation must also leave room for referrals. A director of AML compliance at a regional bank wanted to keep a feature of human review: reviewers who come across activity that never alerted but looks wrong, and refer it for investigation. An agent works the alerts it is given, so that referral stays with people.

Escalated alerts become cases. Alert management decides which signals need attention and whether they can be closed or escalated, and case management carries the deeper AML investigation: it links alerts and entities, gathers further evidence, and records the rationale and the outcome. When an escalated case ends in a decision to file a SAR, drafting the narrative is its own job, and the guide to SAR narrative automation covers it.

How should dispositions be quality-checked when an agent prepared them?

Dispositions an agent prepared should be quality-checked in two stages: an analyst reviews every recommendation at first, and the team moves to sampled QC once the agent's reasoning has been validated against known outcomes. The pace of that shift is set by the institution's own validation and comfort, with no fixed timeline. The stored reasoning trail is what makes the shift defensible to an examiner.

Once sampling starts, an AML QC program for dispositions an agent prepared checks four things:

• Both directions. Sample alerts that were cleared and should have been escalated, and alerts that were escalated and should have been cleared. A director of AML compliance at a regional bank described QA over an L1 team that checks both. Over-escalation is a cost too.

• Every closure path. QC samples alerts cleared under a policy of lighter review as well as alerts a person worked in full. A compliance product manager at a payments company said its QC controls include a lot of checking of alerts closed both manually and automatically.

• The quality of the judgment. QC reviews whether the decision was right as well as whether the record is complete. A member of the AML and fraud operations team at a fintech said QA has to look at the quality of the L1 decisions.

• Findings fed back. What QC finds goes back into the agent's instructions, so the same miss does not repeat. An AML operations manager at a fintech described updating the AI's instructions from what QA finds.

Small teams can put the same control in place. A senior director of fraud management at a sponsor bank, whose small team does both L1 and L2 work, was writing procedures so that frontline L1 work would get a second set of eyes: four-eyes review.

Sampling also depends on a complete population. If the agent runs on every alert that enters a configured queue, and every action by an agent or an analyst is logged with its reasoning and a timestamp, no alert is silently skipped and the full record for any alert can be pulled on demand.

An analyst will sometimes disagree with the agent. A BSA/AML/OFAC technology systems manager at a sponsor bank asked what happens then: "If there's something that one of our analysts disagrees with, what... are next steps, how do they flag that as potentially an issue with the agent?" A disagreement is data, so record it with the analyst's reason and review it alongside the QC findings. How that feedback reaches the agent is explained in a separate piece on learning from analyst overrides.

How should you evaluate an L1 automation approach before relying on it?

Evaluate an L1 automation approach against your own analysts before relying on it: backtest it on historical alerts, run it in shadow mode on the live queue, then read out the results. A backtest runs the agent over past alerts and compares its recommendations with the dispositions your analysts actually made. Shadow mode runs the agent alongside the live queue while analysts work alerts as usual, so its recommendations are recorded but not acted on. The readout puts the results in front of the people who decide whether to rely on the agent.

Agreement with your own analysts is the metric that matters, because it measures the agent against the standard your program already defends. A bank in deployment is seeing 92% agent agreement with its analyst team on alert disposition, and 75% less time per review.

Read the disagreements behind the rate. When an agent is scored against past dispositions, disagreement measures the record as much as the agent. Where an analyst cleared or escalated an alert on knowledge that never reached the case file, such as what a business customer actually does, an agent reading the file will disagree and be right about the file. Some disagreements are agent errors, some are gaps in the data, and some are practice nobody wrote down.

Running a new approach alongside the existing process is also how the agencies describe testing innovation. The 2018 joint statement on innovative efforts to combat money laundering and terrorist financing, from FinCEN, the Federal Reserve, the FDIC, the NCUA and the OCC, says: "Pilot programs undertaken by banks, in conjunction with existing BSA/AML processes, are an important means of testing and validating the effectiveness of innovative approaches." It adds that pilots which expose gaps in a BSA/AML compliance program "will not necessarily result in supervisory action."

A BSA/AML/OFAC technology systems manager at a sponsor bank put the condition plainly: "It's only as good as the oversight, the management of the AI and who's working on that."

Where L1 automation designs go wrong

• Scoring the agreement rate alone. A headline rate without the disagreements behind it cannot tell an agent error from a gap in the case file.

• Letting lighter review become a default. Any queue that gets less than full review needs a written policy the institution can defend.

• Guessing past missing facts. A gap in the evidence should send the alert to a person or an information request.

• Automating before escalation criteria exist. An agent cannot follow escalation rules nobody wrote.

• Sampling in one direction. QC that checks only cleared alerts misses over-escalation, and QC that skips queues with lighter review misses the alerts no one worked in full.

• Recommendations the analyst cannot check. A summary without its evidence leaves the analyst unable to do their own research.

What do regulators say about agents in alert review?

US bank regulators have placed agentic AI outside their revised model risk guidance, so an institution's own governance sets the controls for an L1 agent. On 17 April 2026 the Federal Reserve, the OCC and the FDIC issued the revised guidance (SR 26-2, OCC Bulletin 2026-13 and FDIC FIL-15-2026). It replaced SR 11-7 and SR 21-8, the 2021 interagency statement on model risk management for BSA/AML systems.

The guidance states: "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance." A footnote adds that a banking organization's risk management and governance practices should guide the controls for any tools the guidance does not cover.

The agencies also said they "plan to issue in the near future a request for information" on model risk management that considers banks' use of AI, including agentic AI. As of September 2026 it has not been issued.

FinCEN has proposed a rule to reform AML/CFT programs. The proposal's preamble says that institutions which responsibly experiment with innovative technologies "will not incur any additional risk of being subject to a significant supervisory AML/CFT action or AML/CFT enforcement action solely based on the use of innovative technologies." It is still a proposal, and nothing in it is in force. The 2018 joint statement on innovation, which the proposal cites as longstanding guidance, remains in effect.

Being outside the model risk guidance does not put an L1 agent outside supervision. Examiners still test the SAR decision-making process, and the examination manual still expects documented conclusions from alert review. With no reference standard that names an L1 agent, the institution's own records are what an examiner will test.

How Oscilar approaches L1 review

Oscilar's agents prepare L1 review and leave every disposition with the analyst. The AML L1 agent in Oscilar's Agent Hub surfaces escalate or close recommendations. The analyst gets an alert summary and a recommended disposition with its reasoning, and confirms or changes it. Oscilar's Agent Hub page states the operating rule: "Agents never autonomously close or escalate alerts — every recommendation is reviewed and confirmed by a human analyst before any action is taken."

Every alert shows the input, the agent's reasoning and the final output, and every recommendation includes the reasoning, evidence and typologies used to reach it. That is a full audit trail per decision with stored reasoning, and a human in the loop by design. The institution still owns validation standards, approval authority and regulatory accountability.

The agents can run inside the full Oscilar platform or as a standalone layer on top of your existing stack, and can take alerts from the transaction monitoring system you already run. Before an agent goes live, Oscilar evaluates it with a backtest against your historical alerts followed by shadow mode on the live queue, with a readout at the end.

MoneyGram, a payments company, runs Oscilar agents in production. Its L1 AML alert reviews went from 30+ minutes to under 2 minutes with the same team and around 45% fewer false positives.

More detail on the agent itself is on the AML L1 review agent page.

Frequently asked questions

What is AML L1 alert automation?

AML L1 alert automation uses software agents to prepare Level 1 review of transaction monitoring alerts. The agent gathers the evidence, compares the activity with the customer's expected behavior and drafts a recommendation with its reasoning. A named analyst still makes each disposition and each escalation decision, and the record shows who decided and why.

Can an AI agent close an AML alert on its own?

In a defensible L1 design, no: the agent recommends a disposition and a named analyst confirms or changes it. If an institution decides that some alert types get lighter review, that decision belongs in a written policy for each queue, one the institution can defend to an examiner. QC then samples those alerts along with the rest.

What should an L1 closure rationale contain?

An L1 closure rationale should state what the alert fired on, the evidence reviewed, the typologies considered and why the activity is explained. It should also record anything that was missing and how that was resolved, and who made the disposition and when. A rationale written that way lets someone reconstruct the decision without the analyst in the room.

How should an institution quality-check dispositions an agent prepared?

An institution should start with an analyst reviewing every recommendation the agent prepares, then move to sampled QC once the agent's reasoning has been validated against known outcomes. The sample should cover both error directions, cleared alerts that should have been escalated and escalated alerts that should have been cleared, plus any alert cleared with lighter review. QC should judge the quality of each decision as well as the completeness of the record.

What evidence and audit trail should examiners expect from L1 automation?

Examiners should be able to see, for any alert, what fired, what the reviewer saw, the agent's recommendation and reasoning, what was missing, and who made the disposition and when. The FFIEC's examination manual expects documented conclusions from alert review, and examiners test the decision-making process as a whole. Because agentic AI is outside the revised model risk guidance, the institution's own governance sets the controls, and the record is where those controls show.

L1 automation pays off when it takes the gathering off the analyst's desk and leaves the judgment there. The agent prepares each review and a named analyst decides it. QC samples both directions, and the record lets anyone reconstruct the decision months later. To see how alert review, case management and an audit trail for every decision fit together in a bank's AML program, read about AML transaction monitoring for banks, or ask for a walkthrough on your own historical alerts.