AML Investigation Process: A Step-by-Step Guide
How to run an AML investigation: intake, L1 triage, L2 escalation, evidence, 314(b), typology analysis, the SAR decision, QA, and continuing review.
TL;DR: Choosing outsourced vs in-house AML compliance is a decision about who does the work, never about who answers for it. The 2023 interagency third-party guidance says using a vendor "does not diminish or remove" a bank's responsibilities, and labor is already the largest line in financial crime compliance budgets at 42% of cost, according to LexisNexis Risk Solutions. The model that holds up is the one that keeps decisions documented and inspectable while taking the repetitive work off analysts, whether that work runs in-house, at a BPO, or through AI agents.
Accountability Does Not Move With the Work
Every AML staffing model starts from the same legal fact: the institution owns the outcome. Outsourcing moves the hands that touch the alert. It does not move the obligation to clear it correctly, file on time, or explain the decision to an examiner.
US regulators have said this plainly and more than once. The 2023 Interagency Guidance on Third-Party Relationships from the Federal Reserve, FDIC, and OCC states that the use of third parties does not diminish or remove a banking organization's responsibility to operate safely and in compliance with applicable law. The agencies went further in their July 2024 joint statement on third-party deposit arrangements, naming suspicious activity monitoring, CIP, CDD, and sanctions compliance as functions a third party may perform, and adding that the bank remains responsible for any failure to comply regardless of how the functions are shared.
The FFIEC BSA/AML Examination Manual frames the same point from inside the program. The BSA officer may delegate duties to staff but remains responsible for overseeing day-to-day compliance, and the board is ultimately responsible for the program. An examiner reviewing a SAR decision does not care whose payroll the analyst sat on. The examiner wants to see the evidence, the reasoning, and the control that would have caught a bad call.
That reframes the whole debate. The useful question is not "outsource or keep it in-house." The useful question is which model gives you the most control over decision quality per dollar spent, and which one you can defend when someone asks to see the work.
Four Ways to Staff the Work
Most compliance teams end up choosing among four models. Each one solves a real problem, and each one fails in a predictable way.
In-house analysts
An in-house AML team gives a compliance officer the most direct control. Analysts learn the customer base, the products, and the quirks of the monitoring system, and that context makes them better at the hard cases. The weakness is that headcount is a step function. Alert volume grows with the business every month, while hiring happens in batches after a backlog has already formed. The analysts you do have spend most of their day on alerts that close as false positives, which is exactly the work that drives the attrition we wrote about in how to reduce compliance officer burnout.
Traditional BPO and managed services
A traditional BPO adds people quickly, which is why banks call one when a consent order or a six-month backlog lands. For a defined project with a clear end date, such as a lookback, that can be the right call. The tradeoffs show up in steady state. Outsourced analysts rotate, often lack context on the institution's customers, and write narratives to a template rather than to the facts. Pricing is still per seat or per hour, so the cost curve is the same line as hiring, just rented. And because the bank keeps full accountability, it also keeps the job of sampling, reviewing, and correcting the vendor's work, which is QA overhead that rarely shows up in the vendor quote.
AI agents
AI agents change the cost shape. An agent that gathers evidence, checks lists, and drafts a disposition does not get tired on the four-hundredth near-identical screening hit. That is where agents are strongest: repetitive, bounded, well-documented work. They are weaker on cases with thin or contradictory data, on new typologies the procedures do not yet describe, and on any decision where the institution needs a named human to own the call. An agent that cannot show its reasoning is a liability, not a cost saving, because the examiner will still ask how the decision was made.
AI-native BPO and hybrid models
A hybrid model puts the repetitive work on agents and the judgment on people, either your own analysts or an outside team. An AI-native BPO is one version of this where the vendor supplies both, works inside the institution's existing systems, and treats every analyst correction as input that improves the next case. This model inherits the strengths of the other three, and one of their weaknesses: it still does not take the accountability off your books.
Where the Money Actually Goes
Labor is the largest single cost in financial crime compliance. The LexisNexis Risk Solutions True Cost of Financial Crime Compliance Study for the US and Canada, conducted by Forrester Consulting, put total annual spend at $61 billion and found compliance costs had increased for 99% of financial institutions. In the full study, respondents attributed 42% of financial crime compliance cost to labor, 32% to technology, 14% to infrastructure, and 12% to outsourcing.
The same study found the pressure lands differently by size. 78% of small institutions, under $10 billion in assets, reported higher labor cost increases, compared with 63% of mid-size and large institutions. Larger institutions were more likely to report rising outsourcing costs, at 79%.
Those numbers explain why moving headcount from payroll to a vendor rarely changes the economics much. A traditional BPO converts salary into a service fee, and both scale with the number of people reviewing alerts. The cost line only bends when fewer human hours are needed per case. That means removing the repetitive steps, not relocating them. We go deeper on this in how to reduce compliance costs in fintech.
What We Built, and Where It Falls Short
We built Sphinx Frontline because the customers we talk to kept describing the same bind. Their in-house team was underwater, a traditional BPO would add people without changing the math, and an AI tool on its own did not give them someone to own the queue. Frontline embeds Sphinx compliance analysts in the institution's workflow, on the systems it already uses, and pairs them with agents that handle evidence gathering, triage, and documentation. When an analyst overrides an agent, that correction is logged and feeds the next version of the workflow.
The pricing follows the same logic. Frontline is paid when cases close, not by seats or hours, so the cost tracks the work cleared rather than the number of people assigned to it. In production we see case review time cut by more than 80% and SAR drafting time fall from around two hours to under ten minutes. Conduit described the result this way: "With Sphinx's AI compliance agents, we went from a six-month alert review backlog to a clean queue in two days." The full design is in our Frontline launch post.
We want to be direct about the limits, because the accountability point applies to us too.
- Frontline does not replace the BSA officer or the decision to file. Policy, risk appetite, and final SAR decisions stay with the institution.
- Agents are only as good as the procedures and data behind them. Weak SOPs or missing KYC data produce weak dispositions faster, which is why every case keeps a reviewable trail.
- Novel typologies and cases with conflicting evidence still go to people. The goal is fewer human hours on routine work, not zero humans.
- Using any outside provider, us included, means the bank's third-party risk management obligations apply: due diligence, ongoing monitoring, and the right to audit.
Traditional BPO has honest uses too. A one-time lookback with a fixed scope and end date can be a reasonable fit for a staffing firm. The problem is using a temporary model to run a permanent workload.
How to Choose a Model
The right staffing model depends less on ideology and more on four practical questions. Answer them honestly before signing anything.
- Where does volume come from? Steady, high-volume, repetitive alerts favor agents and hybrid models. A one-off spike tied to a lookback can justify a short BPO engagement.
- Can you see every decision? Whatever model you choose, each disposition should carry its evidence and reasoning in a form your QA team and examiners can read. Our guide to AML quality assurance programs covers what that sampling should look like.
- How does cost scale? If the price rises one-for-one with alert volume, you have rented headcount, not changed the economics.
- Who owns judgment? Keep policy, escalations, and SAR decisions with named people inside the institution, and size your in-house team for that work rather than for clearing routine alerts.
For most institutions, the answer ends up as a hybrid. A small in-house team owns policy, judgment, and accountability. Agents and an embedded outside team handle the volume. The work moves between them like a handoff in a relay, and the handoff only works when the institution can still see every step.
Frequently Asked Questions
Can a bank outsource its AML compliance program?
A bank can outsource AML functions such as alert review, screening, CDD, and case documentation, but it cannot outsource responsibility for the program. The 2023 interagency third-party guidance and the 2024 joint statement from the Federal Reserve, FDIC, and OCC both state the bank remains responsible for compliance. The board must still designate a qualified BSA officer who oversees the program.
Is outsourcing AML compliance cheaper than hiring in-house?
Outsourcing to a traditional BPO is often cheaper per hour than hiring, but the cost still scales with the number of people reviewing alerts. Labor makes up 42% of financial crime compliance cost according to the LexisNexis Risk Solutions study. Real savings come from reducing human hours per case, not from moving the same hours to a vendor.
What AML work should stay in-house?
Policy, risk appetite, escalated investigations, and final SAR decisions should stay with named people inside the institution. These are the decisions examiners expect the BSA officer and board to own. Routine alert triage, evidence gathering, and documentation are the strongest candidates for outsourcing or automation.
What is an AI-native BPO for financial crime compliance?
An AI-native BPO combines outside compliance analysts with AI agents that handle repetitive steps such as evidence gathering, triage, and case documentation. The analysts make the judgment calls, and their corrections improve the agents over time. Sphinx Frontline is one example, and it is priced on cases closed rather than seats or hours.
How do examiners view AI agents in AML operations?
Examiners apply the same expectations to AI-assisted decisions as to human ones: the institution must be able to show the evidence, the reasoning, and the controls behind each disposition. That makes explainability and audit trails a requirement, not a feature. Agents used in production should also fall under the institution's model risk and third-party risk management processes.
