Suspicion is an institutional act

An alert, a case, a recommendation and a report are different objects. An alert says that a configured detector observed a condition worth examining. A case defines the people, accounts, period, sources and questions authorised for investigation. A recommendation records an investigator's considered view. A reporting decision applies a legal and institutional test. A filing is an external effect with confidentiality, timeliness and record consequences.

Collapsing these objects creates a seductive shortcut. The system treats a detector score as a case conclusion, a case conclusion as suspicion, and suspicion as permission to file. Every collapse hides a change in meaning and decision rights. The data may be identical while the authority carried by the object changes completely.

The international standard itself does not supply one universal software rule. The FATF Recommendations, last updated in June 2026, establish a framework that countries adapt to their legal and operational circumstances.[1] Recommendation 20 concerns reporting suspicious transactions, and Recommendation 21 protects confidentiality and addresses tipping-off. The applicable test, reporter, deadline, channel and protected information still come from the jurisdiction and the institution's approved policy.

Official national material exposes the decision character. In the United States banking context, the FFIEC manual says the final decision maker should have authority, decisions should be documented, and filing is an inherently subjective judgement.[2] In the United Kingdom, the National Crime Agency describes SARs as intelligence reports rather than crime reports and directs uncertain reporters towards their regulator, supervisor, professional body or legal advice.[3] These are jurisdiction-specific examples, not interchangeable instructions. Their common architectural lesson is that a monitoring signal does not carry the reporting role inside itself.

This is why “human in the loop” is too weak. A person can be present yet act as a confirmation click after the model frames the facts and preselects the outcome. A hard boundary removes the model's protected capability, exposes the evidence for challenge and attributes the judgement to an authorised role.

The strongest competing baseline

A serious design cannot dismiss machine classification. A real-bank study of graph-enhanced alert triage reported an 80 per cent reduction in false positives while detecting more than 90 per cent of its positive cases.[9] The model sat after the rule system and supported suppression or prioritisation. That is operationally important evidence that learned ranking can reduce burden.

The label boundary matters. A transaction was positive when it appeared in a SAR, and account labels were derived from those records. The model learned historical institutional outcomes, not direct ground truth of money laundering. That still supports routing evaluation, but accuracy alone cannot confer authority, prove crime or settle a case under changed policy.

A model score is evidence about where attention may be valuable. It becomes one proposition in the case, with model version, population, threshold, feature lineage, calibration and known limitations. A high score may justify earlier review. A low score may support queue ordering when the suppression policy has been independently validated. Neither score is the institution's suspicion.

Build an evidence instrument

The useful unit of machine work is not the story. It is the evidence proposition: a bounded statement with a source, time, derivation and review status. “Payment T-17 posted for £29,500” can point to a ledger event. “T-17 was economically reversed” must point to a linked reversal and the rule used for netting. “Counterparties B and C share a controller” remains a candidate proposition until identifiers and effective dates support it.

That structure changes the agent's objective. Instead of maximising narrative completion, it seeks a packet from which several hypotheses can be tested. The packet remains useful when the preferred explanation changes. Every material sentence in a summary should be reconstructible from propositions, and every proposition should expose the transformation between source and claim.

A minimal worked example

Consider five synthetic records for Harbour Trade Services. The point is not to mimic a jurisdictional reporting threshold. It is to expose how one untyped summary can turn data mechanics into apparent intent.

A fluent summary can say that Harbour sent £44,300 to newly connected entities inconsistent with its profile. A deterministic reconciliation shows net outward value of £29,500 across these records because T-17 and R-17 cancel. An identity service shows two people share the director's name. A temporal check shows K-4 may be stale. The original sentence contained no invented number if it simply added visible payments, yet it combined unreconciled value, unresolved identity and a potentially obsolete profile into one implication.

The correct packet separates at least four statuses: observed, directly supported by an authoritative source; derived, produced by a named deterministic transformation; candidate, plausible but unresolved; and judgement, selected by an authorised investigator under policy. This vocabulary prevents uncertainty from being hidden inside grammatical confidence.

The branches need not be equally likely. The agent seeks discriminating evidence rather than manufactured balance: an invoice may support trade without proving delivery, a stable identifier may resolve the same-name branch, and a reversal changes economic value. Later customer evidence must not be inserted into an earlier decision as though it were known.

Three clocks prevent hindsight from masquerading as intelligence

Financial-crime evidence has at least three relevant times. Event time is when the transaction, ownership change or customer statement applied. Knowledge time is when the institution could first use the record. Decision time is when an authorised outcome was taken. A single timestamp cannot answer all three questions.

Provenance must survive transformation

Evidence seldom moves directly from source to reviewer. Payment data is normalised, documents are scanned, names are transliterated, entities are resolved, graphs are constructed and summaries are generated. A citation to the original document is not enough when the decisive error was introduced halfway through that chain.

W3C PROV-O supplies a useful general vocabulary: entities are used or generated by activities, and agents bear responsibility for activities or other agents' actions.[7] It does not define financial-crime evidence sufficiency. It does let the implementation express that proposition P-41 came from source S-8 through extraction X-3 and identity match M-9, with software and human reviewers recorded.

A material proposition carries its source and version, event or text span, transformation receipt, actor, relevant times and review status. Corrections append a superseding value rather than erase history. Copied allegations share a dependency edge so repetition is not mistaken for independent corroboration.

Negative control: when language intelligence adds nothing

Suppose every relevant transaction has a stable identifier, reversals carry explicit links, currencies are normalised, customer purpose is a coded field with effective dates and counterparty ownership comes from a complete identifier registry. The case question is limited to calculating net value, counting unique verified counterparties and checking a fixed policy condition.

In that environment, deterministic queries and a rules engine can produce the required packet with stronger reproducibility and lower operating risk. Adding a language model may only restate the table and introduce wording variance. The negative control is important because the preferred mechanism is evidence compilation, not compulsory use of an LLM. Use language models where sources are variable or relationships need bounded synthesis. Keep calculation, reconciliation, entitlement and policy transitions deterministic.

flowchart LR
  A["Three alerts, one persuasive<br/>mistake"] --> B["Suspicion is an institutional act"]
  B --> C["Build an evidence instrument"]
  C --> D["Put the boundary into state<br/>transitions"]
  D -. "re-test" .-> A
  classDef first fill:#0a1424,stroke:#087A98,stroke-width:2px,color:#e6f3ff
  classDef step fill:#0a1424,stroke:#3f7da0,stroke-width:1px,color:#e6f3ff
  class A first
  class B,C,D step

Put the boundary into state transitions

A policy sentence inside a prompt cannot enforce a protected boundary. The model may ignore it, a tool wrapper may misroute the call, or a later prompt may redefine the instruction. The prohibition must live where effects are authorised. The triage runtime receives no filing credential, no permission to set a reporting outcome and no ability to read filing status. A typed action contract exposes only the actions allowed for that identity, purpose and case scope.

The pattern has two different kinds of intelligence. The model proposes: link these alerts, retrieve this authorised source, test these hypotheses, summarise these supported propositions. The authority kernel decides mechanically whether that actor may request that action now. For a protected decision it checks the authenticated human role, current policy version, assigned case, reviewed evidence packet and required separation of duties. Stochastic reasoning may widen the search; deterministic control narrows the effect.

Ten control surfaces, not one agent permission

The hard boundary becomes inspectable when the system is read across ten distinct control surfaces. These are not ten names for the same log. Each answers a different question about a consequential action.

This separation prevents a storage mistake. Workflow state, enterprise knowledge, current world state, the evidence ledger and any episodic model memory have different authority, retention and entitlement. Calling all of them “memory” hides their distinct failure modes.

Confidentiality changes the data plane

SAR confidentiality cannot be an instruction to “avoid disclosure”. FinCEN's advisory, for the US context, says confidentiality applies to the SAR and information that would reveal its existence, and it names controls such as need-to-know access and access logging.[4] Its supporting-documentation guidance separately explains that records assisting a filing determination must be identified and maintained under the applicable requirements.[5] Other regimes require their own mapping.

Keep three domains separate: monitoring data for authorised triage, case-scoped investigative facts and a restricted reporting domain for a report's existence, content and status. Customer-service tools cannot query that status, and ordinary observability records execution without copying protected narrative.

NIST's zero-trust architecture offers a general principle rather than an AML rule: network location creates no implicit trust, and authentication and authorisation are discrete functions before access to a resource.[8] Applied here, the decision considers subject, resource, action, purpose, case, environment and time. The triage agent and reporting service use different identities, stores, tool registries and logging policies. Shared conversational memory would defeat the separation.

Unknown outcome is a first-class state

Even after a valid human decision, filing is not a single API call. The submission service can time out after the external system accepts the report. Blind retry risks a duplicate. Treating the timeout as failure risks an unrecorded filing. The state is unknown outcome until an independent readback or reconciliation establishes what happened.

The protected workflow should create two receipts. The decision receipt binds case, policy version, evidence packet, authorised actor and selected outcome. The effect receipt proves that the external filing channel accepted the intended report. A stable idempotency key derives from the case and immutable decision receipt. A retry returns the existing effect receipt instead of creating a second filing.

A production-shaped worked scenario

Return to Harbour's three alerts. A production-shaped case service ingests each alert without mutating it. The intake contract retains detector version, source health, observed conditions, score or threshold, event references and the exact reason for routing. A deterministic linker proposes one case because the alerts share a verified customer identifier and overlapping time window. An investigator can later split the case without erasing the original link proposal.

The context compiler selects entity, jurisdiction and policy version before retrieval. It grants case-scoped access to permitted records, with graph-hop and record budgets. A newly found account creates a scope-expansion proposal rather than an automatic bank-wide search.

The evidence builder nets T-17 against R-17, keeps the director unresolved and marks the profile as potentially stale. It states tests for H1 to H4 and drafts a factual summary whose claims remain beside their sources. The investigator rejects the bad match, confirms the reversal and still identifies a different unexplained pattern.

The investigator records a recommendation. The protected reporting application shows the evidence packet and the investigator's rationale, but requires the authorised reporting officer to select the outcome under the current policy. The agent has no tool in that application. If the officer selects FILE, the decision service emits an immutable receipt. The filing gateway submits exactly once and records the effect receipt after readback. The case stores reporting, account restriction, payment action and relationship exit as separate states because one does not automatically authorise another.

This scenario is a design exercise, not a disclosed deployment or a claim of measured productivity. Its purpose is to show the system boundary. Bounded autonomy applies to investigation work; the protected institutional act remains separately authorised and independently evidenced.

Evaluate where fluency is dangerous

An evaluation programme should reward the system for making evidence easier to inspect, not for sounding decisive. Final filing agreement is an important quality signal, but it is not a complete ground truth. Historical outcomes reflect the policy, data, staffing and judgement available at the time. A model can learn those regularities while also learning omissions, threshold choices and reviewer habits.

Graph learning still has real investigative value. The Elliptic2 cryptocurrency benchmark contains 122,000 labelled subgraphs within a much larger transaction graph. In one reported test, the GLASS model produced 245 true positives, 765 false positives, 46 false negatives and 11,125 true negatives.[10] That corresponds to strong ranking utility in an imbalanced task, with roughly one labelled positive among every four predicted positives at the selected threshold. It also leaves hundreds of predicted positives requiring corroboration.

Benchmark discipline is part of the control. A 2026 forensic audit of the original Elliptic Bitcoin dataset, distinct from Elliptic2, reported opaque feature construction and leakage across commonly used splits.[11] It would be incorrect to transfer that finding automatically to every later graph dataset. It is nonetheless a decisive warning: impressive metrics are not operating evidence unless features can be reconstructed, splits match the intended temporal use and the local pipeline can reproduce the claimed inputs.

Evaluation should follow the seams: detector coverage and calibration, alert linking, proposition support, replayed totals, hypothesis challenge, human process quality and independently verified filing effects. One end-to-end accuracy number cannot locate the failed layer.

Failure injection should be primary, not ceremonial

Ordinary test cases show that the happy path works. A consequential system must show how error propagates. Failure injection deliberately changes one control surface and observes whether the system exposes, contains or amplifies the fault.

These tests are more informative than asking whether the assistant “usually follows policy”. The protected actions should remain impossible under prompt injection, model substitution, tool failure and stale identity. If the test harness can make the triage agent file by changing natural-language instructions, the boundary never existed.

Human review must change the causal path

A hard credential boundary can still fail socially. Reviewers may accept the first coherent account, especially under queue pressure. Measuring the presence of a click or an edit does not prove judgement. Requiring arbitrary edits may even reward cosmetic changes.

The workflow should create decision-relevant independence. One option is to show the proposition ledger and hypothesis tests before revealing the model's recommendation. Another is to require the reviewer to identify the decisive propositions, unresolved gaps and applicable policy clause in structured fields. Material disagreement triggers a second review or a targeted evidence request. Quality assurance samples should include cases where the model is confidently wrong, not only typical cases.

Metrics must resist perverse optimisation. Fewer alerts may mean better triage or lost coverage; shorter handling may mean useful compression or shallow review. Combine coverage, proposition support, contradiction detection, entity error, reviewer challenge, confidentiality incidents, denied actions and verified outcomes.

FATF's technology report supports the positive side of this programme: new technologies can improve the speed, quality and efficiency of AML/CFT measures when implemented responsibly and with informed oversight.[6] That evidence supports investment in better detection, data pooling, analytics and investigation. It does not collapse the distinction between useful machine intelligence and the institution's reporting authority.

The explicit failure boundary

The hard-SAR mechanism ceases to help when the surrounding institution cannot supply real judgement or trustworthy evidence. If investigators lack time, competence or permission to challenge the model, the human step becomes a credential ceremony. If the monitoring system misses the activity entirely, evidence assembly never starts. If source systems are incomplete, provenance can faithfully document an inadequate case. If policy ownership is unclear, a deterministic kernel merely enforces ambiguity.

The boundary is a revisable governance choice. A jurisdiction or narrowly structured process may permit different decision rights. The claim would weaken if a system proved bounded performance under explicit authority, but the proof would still need confidentiality, contestability, temporal validity, independent effect verification and recovery, not accuracy alone.