AI-assisted AML transaction monitoring
More
Recommended next steps
Highest-priority open actions
At a glance
- Owner
- Marcus O'Brien
- Sponsor
- Head of Financial Crime
- Business unit
- Financial Crime
- Lifecycle stage
- Design
- Architecture
- No amplifiers declared
Top risks driving the decision
- R-RG-01 AUSTRAC SMR content integrity
- T-AI-02 Hallucinated transaction detail in SMR
- R-DA-01 Cross-border transfer of customer data
Key conditions
- Analyst attests every SMR before lodgement
- Grounding verification live in production
- APP 8 compliant cross-border contract executed
- False-positive monitoring dashboard operational
What drives the score
GII points contributed by each CALIBRE factor (score 0 to 4 × weight)
Findings from each capability
- ARA Agentic Risk Analyst
- 12 findings
- CALIBRE Governance intensity
- 10 controls + GII summary
- Secure-RAG Evidence
- 0 citations
Decision narrative
Initiative SAMPLE-02 (AI-assisted AML monitoring) is assessed at ARA overall-residual Medium, CALIBRE band High (GII 63.75/100). The analyst-in-the-loop design materially reduces risk versus fully autonomous SMR lodgement.
The main remaining risks are (1) hallucinated content in SMR narratives, which the grounding-verification control directly mitigates, and (2) cross-border data transfer, which requires an APP 8 compliant contract before go-live.
Approve with conditions. Do not go live until the four listed conditions are satisfied and evidence uploaded against each.
Description
A Tier-2 Australian bank proposes to replace its rules-based AML transaction-monitoring engine with an LLM-based agent that reads payment memos, customer notes and adverse-media results to score suspicious-matter reports. The agent will draft the SMR narrative and auto-lodge to AUSTRAC once a compliance analyst clicks approve. Model hosted on a US cloud region.
How action status is reported
A control is reported as implemented in the attestation only when its action is Complete. Add a link to the evidence where possible.
CALIBRE sets the required controls by band, not by reading the description. If a control does not apply, mark it Waived and put the written justification (or a link to it) in the evidence field. The waiver is shown in the attestation.
| Priority | Action | Status |
|---|---|---|
| High | Implement Analyst approval gate before AUSTRAC lodgement SAMPLE-02-A-01
|
Open |
| High | Implement Grounding verification SAMPLE-02-A-02
|
Open |
| High | Execute Cross-border data-transfer contract with vendor SAMPLE-02-A-03
|
Open |
| Medium | Establish False-positive monitoring dashboard SAMPLE-02-A-04
|
Open |
| Medium | Update customer collection notice for cross-border transfer SAMPLE-02-A-05
|
Open |
No actions match
Change the filters to see more.
ARA R-RG-01AUSTRAC SMR content integrity
AI-drafted SMR narratives must accurately reflect the underlying transaction pattern.
ARA R-DA-01Cross-border transfer of customer data
Payment memos and customer notes sent to US-hosted model constitute cross-border transfer.
ARA R-OP-01False-positive rate impact
LLM scoring may produce more false positives than existing rules engine.
ARA CMP-01AUSTRAC AML/CTF (Australia) - applicable
SMR content, timeliness and record-keeping are directly governed by the AML/CTF Act.
ARA CMP-02Privacy Act 1988 (APPs) (Australia) - applicable
APP 8 applies to cross-border disclosure of customer data to the US-hosted model.
ARA CMP-03APRA CPS 234 (Australia) - applicable
Third-party information-security capability applies to the model vendor.
ARA T-AI-01Prompt Injection via customer notes
Free-text customer notes may contain adversarial payloads.
ARA T-AI-02Hallucinated transaction detail in SMR
Model may fabricate transaction context not present in source data.
ARA C-01Analyst approval gate before AUSTRAC lodgement
Every AI-drafted SMR requires compliance-analyst review and attestation before auto-lodgement.
ARA C-02Grounding verification
System verifies every claim in the narrative traces to source transaction data before analyst sees it.
ARA C-03Cross-border data-transfer contract
APP 8 compliant contract with model vendor covering data-protection standards.
ARA C-04False-positive monitoring dashboard
Track FP rate against existing rules-engine baseline; alert if exceeds 15% delta.
CALIBRE CAL-GII-HighGovernance Intensity Index = 63.75/100 (band: High)
CALIBRE band: High.
CALIBRE CAL-XAI-01XAI-01 - Explainability and transparency
CALIBRE core control, required from band High upward. Maps to NIST MEASURE-2.9 | ISO 42001 A.8.2 | EU AI Act Art.13; Art.50; Art.86.
CALIBRE CAL-HITL-01HITL-01 - Human oversight (human-in-the-loop)
CALIBRE core control, required from band High upward. Maps to NIST MAP-3.5 | ISO 42001 A.9.3 | EU AI Act Art.14; Art.26.
CALIBRE CAL-MON-01MON-01 - Runtime monitoring and drift detection
CALIBRE core control, required from band High upward. Maps to NIST MEASURE-2.4; MANAGE-4.1 | ISO 42001 A.6.2.6; A.6.2.8 | EU AI Act Art.72; Art.26.
CALIBRE CAL-ASR-01ASR-01 - Independent pre-deployment assurance
CALIBRE core control, required from band High upward. Maps to NIST MEASURE-1.3 | ISO 42001 A.6.2.4; A.6.2.5 | EU AI Act Art.17; Art.43.
CALIBRE CAL-GOV-02GOV-02 - AI impact and risk assessment
CALIBRE core control, required from band Moderate upward. Maps to NIST MAP-5.1 | ISO 42001 A.5.2; A.5.4 | EU AI Act Art.9; Art.27.
CALIBRE CAL-DATA-01DATA-01 - Data governance and PII protection
CALIBRE core control, required from band Moderate upward. Maps to NIST MEASURE-2.10 | ISO 42001 A.7.2; A.7.3; A.7.4; A.7.5 | EU AI Act Art.10.
CALIBRE CAL-SEC-01SEC-01 - AI security controls
CALIBRE core control, required from band Moderate upward. Maps to NIST MEASURE-2.7 | ISO 42001 A.6.2.3 | EU AI Act Art.15.
CALIBRE CAL-SUP-01SUP-01 - AI supply-chain and third-party assurance
CALIBRE core control, required from band Moderate upward. Maps to NIST GOVERN-6.1; MANAGE-3.1 | ISO 42001 A.10.2; A.10.3 | EU AI Act Art.25.
CALIBRE CAL-LIT-01LIT-01 - AI literacy and competence
CALIBRE core control, required from band Low upward. Maps to NIST GOVERN-2.2 | ISO 42001 7.2 | EU AI Act Art.4.
CALIBRE CAL-GOV-01GOV-01 - AI use-case registration
CALIBRE core control, required from band Low upward. Maps to NIST GOVERN-1.6 | ISO 42001 A.4.2 | EU AI Act Art.49.
No findings match
Change the filters to see more.
Runtime: operating envelope, control tests and authority checks
Operating envelope
No operating envelope
Push one from ARA. Until then every agent action is escalated.
Recent authority checks
Open authorityNo checks recorded for this initiative.
Agent gateways call POST /api/authority/check before acting. Secure-RAG reports control tests to POST /api/test-results.