I'm sure you're all hearing questions about AI from your examiners and auditors. It seems to be the buzzword lately. We've been investigating what options are available out there and what (if anything) we really need. From what I can tell, only the largest banks are actively utilizing AI for BSA/AML monitoring purposes, so far. I haven't met with any vendors yet, but I think I've found about 5 so far and don't really know where to start.

Has anyone else in a mid-size bank done any research on this? Visited with vendors? Seen a demo? Actually contracted? What are your experiences?

I'm nervous that this segment of the industry is still so new that the vendors just don't have the experience yet to have a solid product worth jumping into this early in the game. Thoughts?

Haven't had a BSA exam since November 2017 and it didn't come up then. But you have piqued my curiosity.

BTW, any vendor discussions are reserved for the private forums. A mod can move it to the private threads for you.

Can you just imagine the kinds of questions that will come up with model validation if you have AI as part of the model?

Many of the top vendors in the AML space are already (and have been) utilizing AI and machine learning. We are having our model verified right now. We use a vendor that most of you would know.

Since the algorithms are proprietary, they can't be tested. You can only test to see if the criteria for SAR scenarios and risk model work.

And yeah, have fun trying to explain AI to your examiners. It's "woo woo" stuff. You can't really know if it's doing what it's supposed to be doing. They are having a real hard time with it. They are so used to "rules-based" and "behavior-based" monitoring. They can't get their heads wrapped around this.

I encourage you to demo at least three vendors. Their systems are all a little different. So it's good to compare to figure out what might be best for your situation. This is a project that will likely take a few months; there is a lot to consider. It will become more evident as you meet with each vendor to see their demo. This is a big decision that will have a huge impact on your program, so you will want to be very thoughtful about it so you don't get stuck with something you don't like.

In my role doing audits and AML model validations, I've only heard this question in passing from a few clients here and there. I haven't heard of an examiner focus in this area. Thankfully. I say thankfully for a reason - the technology is misunderstood. What vendors refer to as "AI" is just capitalizing on the buzzword - but I'll acknowledge that the largest of institutions are likely experimenting with those vendors would think of as "AI", which may have been the reason for the interagency "Joint Statement on Innovative Efforts."

I put AI in quotes because it's a moving target. There's a saying, Tesler's Theorem - "AI is whatever hasn't been done yet." Why is that an important quote? Because folks in BSA/AML are getting sold on the concept that they don't already have AI, when that's not the case. All AML and OFAC systems - from the worst to the best - have "AI".

Think about an AML system "learning" the expected activity of a customer by computing the average over a long timeframe, then creating an alert for a deviation from what the system has "learned" is "normal." And doing that for all customers overnight. Pretty standard, right? Then imagine doing the same thing in the 1970's. Tell me that's not AI!

When asked this question, I respond with another question. Forget what "AI" means for a second and also forget your current system constraints - what would you like to have a "Robot AML Investigator" do for you that's not being done already? How many of those things do you think you'd get criticized for not doing or having a human do? And what's the cost-benefit? Those are the questions you need to ask when you consider what you really need from the slick marketing of certain programs or vendors touting "AI."

Here are a few "AI" functions that I predict could realistically be in place at small to mid-sized FI's within the next 20 years:

- Negative news/media search (nightly - entire customer and transaction counterparty base)

- Private ATM and MSB licensing checks (nightly - entire customer)

- SAR narrative and form initial completion (will still need human review/approval)

- EDD narrative and form initial completion (will still need human review/approval)

- Using natural language processing, big data, and machine learning to generate *more* alerts with a focus on qualitative data (who, what, and why) instead of the mostly quantitative models we have right now

I don't foresee there being some magical program that does these functions without having tangible documented algorithms. They'll just be possible because there will be more data, better data, and more creative applications of data science to the existing AML space.

I validate alot of systems, and none of them are doing those things yet. One area that I think is further off, is alert and SAR decision-making. The problem is that, with machine learning, someone has to "train" the AI Agent. Bad training equals bad results - see what happened with Microsoft and Tay if you want a real-life example of what I mean.

Some of the larger FI's are looking into AI for AML purposes, however from what I've seen the costs are not really where they need to be for smaller to mid-sized FI's. This will probably change as the technology is better developed.