Agentic AML Is Shipping

How do you know if an AI agent is actually good at investigating financial crime, or just fast at closing alerts?

Every AML vendor in 2026 has a number: Bretton AI says 1.2 million investigations. Unit21 says 1.5 million alert reviews. Sardine says 6,000 sanctions decisions with zero missed true positives. The numbers describe three different things measured in three different ways, and none of them answer the question compliance officers actually care about.

I covered the landscape back in October, when eight companies were using "agentic" to mean four different architectures. Six weeks later, three of those companies have shipped enough production data to compare. What they built, how it performs, and where it breaks tells you more about the state of AML automation than the funding announcements did.

What actually shipped

Bretton AI, formerly Greenlite AI, raised $75 million in February 2026 and rebranded around a single bet: AI agents that conduct Level 1 and Level 2 financial crime investigations inside existing compliance infrastructure. The agents browse internal and external data sources, pull records, cross-reference findings, and produce investigation reports. A human approves every consequential decision.

Bretton reports 1.2 million completed investigations and 195,000 manual analyst hours eliminated. In July 2026, they launched a managed services model that bundles the AI platform with a US-based operations team. The pitch to mid-size banks is straightforward: replace the headcount bottleneck with agents supervised by Bretton's own compliance staff.

Unit21 took a different path. They rebuilt their existing platform around agents in March 2026, then shipped the Agentic Task Builder in July. The Task Builder lets compliance teams describe investigation logic in plain English. A team can write "check this entity and connected businesses for adverse media or sanctions exposure" and the system generates the workflow, drawing on transaction histories, counterparty data, and external sources already in Unit21's environment.

Their customer Nexo automated 57% of alert reviews with a target of 80% and reports 93% fewer false positives. Underdog cut alert volume by 72%. Unit21 says SAR prep dropped from roughly a week to under 30 minutes.

Sardine shipped agents for sanctions and PEP screening that went live at a regulated US bank in April 2026. After four months, the agent decisions 100% of sanctions and PEP alerts in real time, auto-resolving the roughly 89% that are clear false positives and escalating the rest. Manual reviews dropped about 95% for sanctions and 90% for PEP. Across more than 6,000 live decisions, no confirmed sanctions or PEP match has been auto-cleared.

Each measures "production" differently.

The denominator problem

A 93% false positive reduction sounds decisive, but the denominator matters more than the percentage.

The industry baseline matters. Rule-based transaction monitoring systems produce false positive rates above 90% at most institutions. Some exceed 95%. That means 9 or more out of every 10 alerts are legitimate customer activity that an analyst investigates and closes.

A 50% reduction in false positives against a 95% baseline gets you to a 47.5% false positive rate. Still roughly half of all alerts going nowhere. A 93% reduction against the same baseline gets you to about 6.7%. That's genuinely transformative, if the baseline was actually 95% and the measurement methodology holds.

But the baselines aren't standard. One institution's "false positive" might be an alert closed at L1 triage in 20 minutes. Another's might be an alert that went through full investigation before being cleared. A screening vendor's false positive is a name match against a sanctions list that turned out to be a different person. These are different problems with different difficulty levels.

Unit21's 93% number comes from Nexo, a crypto finance platform. Sardine's 89% auto-resolution comes from sanctions and PEP screening at a US bank. Bretton's 1.2 million investigations span KYC, AML, and sanctions across multiple institutions. Comparing these percentages without accounting for the denominator is like comparing batting averages across different leagues.

The number that matters more than any percentage is the miss rate. How many true positives did the agent clear that it shouldn't have? Sardine's zero-miss claim across 6,000 decisions is the most specific answer any vendor has given. But 6,000 decisions is a small sample for a statistical claim, and the scope is limited to sanctions and PEP screening, which is more deterministic than transaction monitoring.

Context is the bottleneck

GPT-4 can read a transaction history and write a plausible investigation summary. Giving the model the right context to reason about is where the engineering gets difficult.

Sardine's engineering team wrote about this directly. Most compliance teams aren't short on data. They're short on context.

An AML alert fires because a customer's transaction pattern crossed a threshold. The alert contains a customer ID, a rule name, and a score. An analyst turns that into a decision by pulling account history, checking prior investigations, reading the customer's KYC file, reviewing counterparty data, and applying policy.

The agent needs all of that context too. A naive implementation feeds the agent the alert and asks for a decision. The agent hallucinates, inventing transaction details that aren't in the data, confusing customers, or reasoning from insufficient evidence.

Sardine calls this the hallucinating investigator, and they say it's the most common failure mode.

Narrower agents with more structured context solve this, not a better model. Instead of one agent that handles the full investigation, you build separate agents for each task: one for sanctions screening, one for transaction pattern analysis, one for adverse media search, one for narrative drafting. Each agent gets exactly the data it needs and nothing else.

Sardine calls these atomic agents. Unit21's Task Builder follows the same principle by letting teams define exactly what data each task accesses. Bretton plugs into existing compliance infrastructure rather than rebuilding it, which means the agent inherits the context boundaries the institution already established.

The tradeoff is orchestration complexity. Ten narrow agents that each do one thing well still need to pass context between them. The sanctions agent's finding needs to reach the investigation agent, which needs to inform the narrative agent. Losing information at any handoff degrades the final output.

Three failure modes

Sardine documented three ways production agents fail, and the taxonomy applies across vendors.

The hallucinating investigator fabricates evidence. Given broad context and open-ended instructions, the agent invents transaction amounts, creates counterparty relationships that don't exist, or cites policy sections that were never written. In a compliance context, a fabricated detail in a SAR narrative is a regulatory liability, not just an error. I covered this specific risk in the narrative bottleneck piece: Hummingbird found that general-purpose LLMs fabricated transaction details when asked to draft SARs from raw data.

The over-suspicious agent escalates everything. Without enough grounding in what normal looks like for a specific customer, the agent flags large foreign transactions, round-dollar amounts, new counterparties. It applies generic risk heuristics instead of customer-specific baselines. The false positive rate goes up, not down.

The black box agent produces decisions that auditors can't examine. A compliance examiner needs to understand why a specific alert was closed. "The AI decided" is not an acceptable answer.

Production agents need to log every data source consulted, every intermediate reasoning step, and every policy provision applied. Sardine's Agentic Oversight Framework requires a four-eyes review model where the agent's reasoning chain is auditable at every step.

All three share a root cause: insufficient or unstructured context. The model is capable enough, but the engineering problem is building the pipeline that feeds it.

The regulatory window

FinCEN opened a door in April 2026. Their proposed rule would restructure AML programs around an effectiveness standard rather than procedural compliance. Instead of proving you ran the right steps, you'd need to demonstrate your program actually detects and reports illicit activity.

The rule doesn't require AI adoption. But it explicitly encourages it. FinCEN stated that institutions that responsibly adopt innovative technologies, including machine learning and generative AI, will not face increased supervisory or enforcement risk solely for doing so. The comment period closed June 9. Analysts expect a final rule in late 2026 or early 2027.

This matters because the previous regulatory posture was ambiguous. Banks that automated compliance workflows risked examiner pushback on the methodology, even if outcomes improved. An effectiveness standard creates space for tools that produce better results through different methods.

But the regulatory picture isn't uniform. The OCC, Federal Reserve, and FDIC revised their model risk management framework in 2026 and explicitly excluded agentic AI from the revised scope. There's no standardized supervisory expectation for how banks should validate, monitor, and govern agentic compliance systems. FinCEN says use AI if it works, but the prudential regulators haven't said how to prove it works.

Vendors treat this gap as a feature, while compliance officers absorb it as risk. You're adopting technology that one regulator encourages and another hasn't figured out how to examine.

What "human in the loop" means now

Every vendor says human review is mandatory. In practice, the human's role is changing.

Sardine moved from 100% human review to 10% over four months at one institution. The agent now handles 100% of sanctions and PEP screening decisions. It auto-resolves 89% as clear false positives and escalates 11% to human reviewers. The human reviews the escalated cases plus a random sample of auto-resolved cases for quality assurance.

That's a different job than reviewing every alert. The analyst goes from triage worker to auditor. Instead of deciding whether each alert is suspicious, they're evaluating whether the agent's decisions are consistently correct.

A compliance team that was 15 people reviewing 300 SARs a month might become 3 people auditing 300 agent-generated SARs and investigating the cases the agent flagged as genuinely suspicious. The work changes from "investigate everything" to "verify the machine and investigate the hard cases."

But the liability doesn't change. When a SAR contains a factual error, the institution is responsible, not the vendor. When a sanctions match gets auto-cleared and turns out to be real, the compliance officer signed off on the system that made the call. The agent eliminates the labor but not the accountability.

Where this goes

Bretton's 1.2 million investigations, Unit21's 1.5 million alert reviews, and Sardine's 6,000 sanctions decisions are the first real production numbers for agentic AML. They're vendor-reported, scope-limited, measured against different baselines, and none have been independently audited.

But they're also not demos. These are agents running in production at regulated institutions, making real decisions about real customer activity, under real regulatory oversight. The question now is how to validate that the AI is doing compliance work correctly.

That validation question is the next bottleneck. The agents ship faster than the governance frameworks. FinCEN encourages adoption, but the prudential regulators haven't standardized examination, and nobody has published a methodology for auditing agent investigation quality at scale, even as vendors claim zero miss rates on small samples.

The compliance teams adopting these tools now are building their own validation frameworks from scratch. That's where the real engineering is happening, and it's not the kind of work that fits in a product demo.