How to Buy AI for AML 

Every AML vendor is now an AI vendor. Check the websites: the same platforms that were "rules-driven" in 2019 and "machine-learning-powered" in 2022 are "agentic" today. 

Meanwhile, you - the MLRO, the COO, the head of compliance - are being asked by your board why the firm isn't "using AI," while being held personally accountable for what happens if the AI you buy gets it wrong. It's an uncomfortable seat, and vendors know it.

So here's an attempt at a practical service: how to tell real AI-first compliance systems from theatre, from someone who builds one and has watched a lot of demos from the other side of the table.

The distinction that actually matters

Ignore the model names and the buzzwords. There is exactly one architectural question: was this system designed around AI doing the work, or is AI decorating a system where humans still do the work?

The bolt-on pattern is easy to spot: a legacy workflow platform - queues, checklists, forms - with a chatbot in the corner and a "summarize this case" button. The AI summarises, suggests, drafts. A human still reads every document, chases every gap, makes every routine decision. The vendor demos the summary button; your unit economics don't move. It was the reading, checking, and chasing - and that's still manual.

An AI-first system inverts it: the machine reads the documents, extracts the data, runs the checks, assembles the evidence, and completes the routine cases end to end; humans supervise, set risk appetite, and judge the cases that deserve judgement. The difference shows up in one number - how much human time a routine file consumes. In a bolt-on, slightly less than before. In an AI-first system, close to none.

Everything else in this guide is ways of surfacing that difference before you've signed.

The questions that cut through demos

"Run my ugliest file."

Not the demo file. Your file - the Cayman-Lux-trust structure with the ninety-page deed and the registry extract in German. Every vendor's AI handles the clean case. The ugly case reveals whether the system reads documents or performs reading. If they need to take it away and come back next week, you've learned what you needed.

"Show me the evidence trail for a decision."

Pick any automated conclusion - a cleared screening alert, an extracted UBO chain - and ask to walk the reasoning: what was read, what was compared, why the conclusion followed. This is the question your regulator will ask you, so ask it first. "The model determined..." is not an answer you can put in front of an examiner.

"What happens when it's unsure?"

The honest answer involves confidence thresholds, escalation to humans, and your ability to tune where that line sits. An AI system's handling of uncertainty is its real safety architecture - a system that guesses confidently is more dangerous than one that escalates humbly.

"Who controls the risk appetite - you or me?"

Your risk appetite is yours. If risk thresholds and escalation logic live in the vendor's release cycle rather than your configuration, you've outsourced the one thing a compliance officer can never outsource. This is a deal-breaker dressed as a settings page.

"What did your customers' numbers actually do?"

Not testimonials - numbers. Hours per file before and after. False-positive rates. Onboarding cycle time. A vendor whose product genuinely works is drowning in this data and delighted to show it. A vendor who pivots to vision slides is telling you the data doesn't exist.

The two failure modes to price in

You pay for transformation, deploy a chatbot, and eighteen months later your cost per file is unchanged and your board thinks AI failed. Your competitors who bought real systems spent those eighteen months compounding.

Buying a black box. The system works, but nobody can explain it,  and the first serious regulatory examination turns your efficiency story into a governance finding. In compliance, an unexplainable right answer is a wrong answer with better luck.

Both failure modes trace back to skipping the questions above. 

A note on timing, since everyone asks

"Shouldn't we wait until the technology settles?" I hear this monthly, and I understand it; caution is the professional instinct of good compliance people, and the consequences of tooling mistakes in this field are personal in a way SaaS categories never are.

But notice what waiting actually buys. The technology is already past the threshold where it does this work reliably; what's settling is the vendor landscape. And the cost of waiting isn't neutral: every quarter is another quarter of files done at manual cost, backlog accumulating, and regulators - AMLA in Europe, FinCEN's adviser rule looming in the US - raising the bar in the meantime. The risk-managed move is a rigorous purchase: hard questions, a real pilot on your own files, measured results, expansion on evidence.

Where Steward sits in this

Steward is an AI-first system in exactly the sense this guide means: the AI does the reading, checking and evidencing; your team owns the judgement, the risk appetite and the audit trail. And because we built it that way, every test in this article is one we're happy to take - ugly file first.

If you're evaluating this category, run these questions on everyone. Including us, and buy the system that shows its work. In this business, that was always the requirement.