Alexandre Berkovic and Chrisjan Wüst · Sphinx Frameworks · 2026
TL;DR: A compliance agent is deployable when it is narrow, when every case is argued in public roles, and when the policy it applied can be named, versioned, and rolled back. A model that explains nothing, and a rule engine that flags everything, both fail that test.
Two tools that do not scale
Most compliance programs still run on one of two instruments. A rule engine publishes the threshold an adversary can read, and it flags the activity that crosses it. A model scores the rest and returns a number. Neither one produces a decision an examiner can replay. FinCEN's calendar 2025 statistics, reported by Forvis Mazars, show 4.105 million suspicious activity reports, up 7.99 percent on the year, with depository institutions filing 2.193 million of them, up 7.66 percent (Forvis Mazars, 2026). The volume is the symptom. The cause is that the queue in front of the analyst is not a set of cases. It is a set of scores.
False positives dominate that queue. Kim and Yang put the share above 90 percent in typical AML alert systems (Kim and Yang, 2024). One published program saw 1.1 million transactions produce 35,000 alerts, of which an analyst could work about 80 a day. The Bank of England and the FCA found in 2024 that 75 percent of UK financial-services firms use AI, 46 percent have only a partial understanding of the technologies they have deployed, 55 percent use some automated decision-making, and 2 percent describe a process as fully autonomous (Bank of England and FCA, 2024).
The Wolfsberg Group has argued that the point of financial-crime controls is the quality of the decision, not the volume of the filing. FATF's 2021 stocktake of new technologies makes the same demand of the tools themselves: a technique is useful in AML and CFT when the institution can show how it reached the outcome (FATF, 2021). An agent that cannot show its reasoning has not made a decision. It has made a guess. How that failure shows up across screening, monitoring, and documents is the subject of Financial Crime in the Age of AI.
Argue the case in roles
The workable unit is not a general assistant. It is a narrow agent with one job, one set of tools, and one output an analyst can read. This framework splits that job into three roles that cannot edit each other's work. The Prosecutor builds the case that the activity is suspicious. The Defender looks for the weak match, the stale attribute, and the fact that cuts the other way. The Judge applies a versioned rubric and returns a recommendation, an escalation, or a statement that the case is ambiguous. The three roles see the same inputs. They do not share a draft.
One case, three roles. The rubric is applied after both arguments exist, not before.
The split is a control, not a metaphor. A single agent that investigates and concludes can talk itself into the first story it finds. Separate roles force the disagreement into the record. Du and colleagues describe the same pressure in another form: a language model that is asked to be helpful, honest, and harmless at once has to trade those goals off inside one forward pass, and the tradeoff is invisible to the reader (Du et al., 2023). Putting the tradeoff in three named outputs makes it inspectable. Axelsen's survey of agentic systems reaches a related conclusion from the operations side: an agent is governable when its authority, its tools, and its stop conditions are explicit (Axelsen, 2025).
Narrowness is what makes the roles safe to run. A Prosecutor that can also send email, edit a policy, and query an unrelated system is not a control. It is an integration with no boundary. Each role gets the tools its job requires and nothing else. Screening lists and house rules belong to the Prosecutor. Mitigating evidence belongs to the Defender. The signed rubric belongs to the Judge. Sphinx AI agents are built on that constraint, and the review still happens in Frontline, where an analyst can see both arguments and the rubric version that was applied.
Bind the decision to a policy
A recommendation is auditable when it names the policy it used. The rubric is a versioned, signed document. The case record stores the version, the inputs, the two arguments, and the outcome. Change the rubric and you have a new version, not a silent edit to last quarter's decisions. An examiner who asks why a case was cleared in March can be shown the rubric that was in force in March.
A model card describes a system. A signed rubric is the instruction the system followed on a particular case. The OCC expects institutions to know which version of a tool made a decision and to be able to challenge it (OCC, bulletin 2026-13). FinCEN's proposed AML program rule points the same way: the program has to be risk-based, documented, and tested. The rubric is the document those expectations can attach to.
The same record is what makes a human review meaningful. If the analyst disagrees, the disagreement is a fact about the case, not a note in a side channel. Disagreements are how the rubric gets better. They are also how the institution shows that a person remained accountable for the filing decision. The agent recommends. The BSA officer or the MLRO decides. Nothing in the framework moves that line.
Put the agent where the work already is
An agent that lives in a separate console will not be used on the cases that matter. Analysts work in the system of record: the case manager, the screening queue, the transaction view. The agent has to read from those systems and write its arguments back into them, as a layer on top of the workflow rather than a replacement for it. A thin layer is easier to permission, easier to log, and easier to remove.
Removal matters. A regulated deployment needs a way to stop. Sandboxing keeps the agent inside the tools it was given. A checkpoint is a place where the run pauses for a person, or for a second system, before an action leaves the institution. Rollback is the ability to return to the last signed rubric and the last known-good configuration without a release. If a prompt, a tool, or a model version misbehaves, the institution turns that version off. It does not wait for a patch cycle to discover which cases were touched.
Prompt injection is why those controls are not optional. A case contains text the institution did not write: a payment reference, a news article, a PDF. OWASP lists prompt injection as the first risk for applications built on language models, because untrusted text can be treated as an instruction (OWASP, LLM01). The same class of attack can aim at the tool call rather than the reply (Zhan et al., 2025). The defense is a role that cannot call the tool, a sandbox that will not honor the instruction, and a checkpoint in front of anything that leaves the building. A name match is exactly the kind of ambiguous text an agent will over-read, which is why watchlist disposition and source-of-funds checks belong in the same review.
Graduate it, then keep testing it
A new agent does not go from a demo to a filing decision. It runs in shadow, on cases a person has already decided, until the institution can measure agreement, the kind of disagreement, and the rate at which a person overrides a critical recommendation. Sphinx treats two thresholds as a deployment convention, not as a regulatory requirement: agreement at or above 90 percent across 200 cases before the agent may recommend alongside a person, and agreement at or above 95 percent with critical overrides under 2 percent across 500 cases before it may clear low-risk work inside a checkpoint. A regulator does not impose those numbers. An institution that cannot state its own numbers does not have a graduation policy.
The public evaluation Sphinx reported in 2026 is one measurement of that kind of run, not a promise about the next one. On 10,000 cases, agreement with the human decision was 91.2 percent overall, from 96.1 percent on sanctions alerts to 85.7 percent on SAR-related cases. False positives fell 83.9 percent. Throughput was about ten times the manual baseline. A backlog fell 89 percent over 16 days. Every case in the exam sample passed, and a quality review of 6,300 cases agreed 91.6 percent of the time after 53 rubric refinements. Inter-rater reliability on the human side of that review was 0.89, using the chance-corrected measure described by McHugh. One hundred and eighty cases were disputed and resolved in the record. Those figures describe one evaluation. They are the kind of figure a program should be able to produce for its own book of business, at banks and elsewhere, every time the rubric or the model changes.
The same split applies when the question is not whether a rule fired, but whether this customer did something their own history does not explain. Those lenses are set out in behavioral transaction monitoring.
FAQ
Does this replace the analyst?
No. The agent prepares two arguments and a recommendation tied to a rubric version. The decision to file, to clear, or to escalate stays with the institution's investigators and its BSA officer or MLRO. Full autonomy is the exception in the 2024 Bank of England and FCA survey, not the design target.
What if the model vendor changes the model?
The case record stores the rubric version and the configuration that ran. A model change is a new configuration. It goes back through shadow review against the graduation thresholds before it is allowed to recommend on live cases. The previous configuration remains the one that can be restored.
How is this different from adding a chatbot to the case manager?
A chatbot answers questions in one voice and can use any tool it is given. The framework separates Prosecutor, Defender, and Judge, limits each role to its own tools, and refuses to treat the model's reply as the policy. The policy is the signed rubric. The reply is evidence that the rubric was applied.
Where should a program start?
Start on a queue where the human decision is already recorded, so agreement can be measured. Watchlist disposition and document review are narrower than a full SAR narrative and produce a cleaner first evaluation. Expand only after the institution can show the agreement, the overrides, and the rubric version for that queue.
The full framework, including the checkpoint design and the rollback procedure, is available here: Deploying Interpretable AI Agents in Compliance (PDF).
.png)