Human-in-the-loop AML

What the job actually looks like

Anti-money-laundering triage in a regulated wallet is, at its core, a pattern-matching task performed under time pressure: a compliance officer looks at a flagged transaction or account pattern, pulls together the relevant context — transaction history, account age, prior flags, the specific rule that triggered the review — and decides whether it’s routine, needs a follow-up question, or needs escalation. Done well, this is slow, careful reading. Done under volume, it’s the kind of task where fatigue produces both false clears and false escalations.

The place an LLM earns its keep here isn’t the decision. It’s the reading.

What the model does: draft, not decide

In the system we run, every flagged case is assembled into a structured packet — the transaction pattern, relevant account history, the specific rule triggered — with personal data redacted before it ever reaches the model. A self-hosted Falcon model reads that packet and drafts a triage summary: what pattern was detected, what in the account history is consistent or inconsistent with that pattern, and a suggested next action drawn from a fixed set (clear, request additional information, escalate).

interface TriageDraft {
  caseId: string;
  patternDetected: string;
  supportingFactors: string[];
  contradictingFactors: string[];
  suggestedAction: "clear" | "request_info" | "escalate";
  modelConfidence: "low" | "medium" | "high";
}

That draft goes to a human compliance officer as a starting point, not a verdict. The officer sees the same underlying case data the model saw, the model’s draft reasoning, and makes the actual decision. The system records whose decision it was, and it is never the model’s name in that field.

Why the decision can’t move to the model

Three reasons, and none of them are about the model being insufficiently capable today — they hold regardless of how good the model gets.

First, accountability. A regulator asking “why was this cleared” needs an answer that traces to a person who can be asked follow-up questions, held to a standard of judgment, and who understands the specific institution’s risk posture — not a model’s statistical tendency to associate certain patterns with low risk. An LLM has no license to compliance-officer, and no regulatory framework treats it as capable of holding one.

Second, adversarial pressure. AML patterns exist because someone is actively trying to obscure activity from detection. A model trained on historical patterns is, definitionally, behind whoever is trying something novel. A human reviewer applying judgment to a case that doesn’t fit the historical mold is exactly the check that catches what pattern-matching alone won’t.

Third, the cost of the two error types isn’t symmetric, and a model optimized for average performance doesn’t know that. A false clear on laundering activity is a materially worse outcome than a false escalation that costs a compliance officer ten extra minutes, and that asymmetry needs to be enforced by a human who can weigh the specific case, not by whatever threshold the model happened to learn.

Redaction before the model sees anything

Personal data — names, account numbers, anything directly identifying — is redacted from the packet before it reaches the model, replaced with stable references the human reviewer can resolve back to real identities through the case system, not through the model:

function redactForModel(caseData: RawCase): RedactedCase {
  return {
    ...caseData,
    accountRef: pseudonymize(caseData.accountId),
    name: undefined,
    rawAccountNumber: undefined,
    transactionPattern: caseData.transactionPattern, // shape, not identity
  };
}

This keeps the self-hosted model’s job scoped to pattern description, and means a compromised or misbehaving model has nothing identifying to leak in the first place — a smaller blast radius by construction, not by policy alone.

Measuring whether the draft is actually helping

The model’s suggested action is logged alongside the officer’s actual decision, and the two are compared on a rolling basis: not to grade the model against ground truth — there usually isn’t clean ground truth for this kind of judgment — but to catch systematic patterns, like a case type where the model’s draft consistently steers officers toward “clear” and officers consistently overrule it. That kind of signal is a prompt or context problem worth fixing, and it only surfaces if you’re logging both numbers side by side rather than just the final decision.

What this means for you

An LLM is a legitimate tool for a compliance workflow when its job is narrowed to something checkable — summarizing, drafting, surfacing supporting and contradicting evidence — and stops being one the moment its output becomes the decision a regulator would need explained by a person. Redact aggressively before the model sees anything, log the model’s suggestion next to the human’s actual call so drift is visible, and keep the accountable decision-maker a person whose name goes in the record every time.