Agentic AI's Financial Crime Reality Check

In August 2025, McKinsey made a bold case: agentic AI could change how banks fight financial crime by handing entire tasks, not just individual steps, to teams of AI agents, with humans reserved for validation, exceptions, and coaching. The firm floated a 20-fold productivity potential.

Fourteen months later, McKinsey's Risk & Resilience Practice has published two companion pieces on what actually happened. One, Agentic AI in financial-crime prevention: Lessons from winners, distills lessons from a year of deployments. The other, Agentic AI in transaction monitoring: How banks can scale AI in compliance, walks through a single use case in detail, anchored by an interview with a Commerzbank executive.

The headline finding is more grounded than the original pitch. Across McKinsey's engagements, productivity is now running at about twice baseline, at equal or better quality. That's real value, but it's the middle rung of the ladder McKinsey described in 2025, not the top. The authors say the fully supervised "digital factory" of agents remains untested.

The more interesting story is why the gap exists. It's not that the agents can't do the work. It's that proving they did it right, consistently and to a regulator's satisfaction, costs more than doing the work itself.

Why banks are doing this at all

The pressure is structural. McKinsey's research shows banks often assign 10 to 15 percent of employees to know-your-customer (KYC) and anti-money-laundering (AML) work. Its 2025 article, citing Interpol, noted the industry detects only about two percent of global financial crime flows despite years of rising compliance spend.

Meanwhile, the regulatory bar keeps climbing. The new EU Anti-Money Laundering Authority is raising expectations, EU sanctions fines have totaled roughly €480 million since 2017, and the number of designated persons and entities has grown nearly fivefold over the same period.

So, the demand for agents is not hype-driven. The question both reports tackle is how to deploy them without creating a new category of risk.

[RELATED: AI Agents in Bank Accounts: Banks Can't Tell Who's Driving]

Finding 1: Most banks are stuck at one use case

Hundreds of agentic use cases are in production across the industry. But McKinsey says many institutions are stalled at a single deployment, and only a few have built a second or third on the same foundation.

The timelines explain some of the drag. Platform builds typically take about 10 weeks. The first full use case takes four to six months to reach production. And first approvals through risk governance run six to eight months, often with ongoing monitoring still unresolved when the second use case shows up.

The banks that do compound their gains share one trait: they decided early what they were building to reuse. McKinsey distinguishes four layers, from individual agents up through packaged business knowledge, shared infrastructure, and finally, whole use cases. The compounding happens in the middle. Banks that standardized the platform, evaluation harness, guardrails, and delivery playbook found their second and third builds cheaper, not because the agents got better, but because everything around them already existed. In one case, new developers could contribute production agents within a week.

The most practical idea here is treating business knowledge as versioned "skills" separate from code: a report-writing skill that encodes templates and tone, a policy skill so every agent reads the same policy the same way, and a critic skill that defines "done" with a checklist. McKinsey's test for whether this is working is if a subject matter expert, not an engineer, can update the skill.

Finding 2: Don't use an agent when a rule will do

The most counterintuitive lesson is restraint. McKinsey recommends asking, for every step, whether a fixed rule can handle it, then whether a deterministic service can, and only then reaching for agent reasoning.

The evidence backs this up. In one onboarding build, rule-based question routing beat agent-selected follow-up questions, and a structured third-party API beat agentic web search, on both speed and accuracy. In a source-of-wealth pipeline, deterministic code handled currency conversion, gap-filling for missing years, and aggregation, while agents were reserved for messy work like extracting from unstructured documents and reconciling conflicting evidence.

Every step pulled out of the agent layer is cheaper, easier to validate, and less likely to hallucinate. For security leaders, it also shrinks the surface where a model can be manipulated.

Finding 3: Accuracy isn't enough. Reproducibility is the gate

Agents are probabilistic. Run the same input twice and you may get two answers. A control that can't be reproduced can't be validated, and McKinsey calls this one of the most common gaps in otherwise solid pilots.

Leading banks test on two axes: factual accuracy against a known "golden truth," and consistency across repeated runs of the same input. The second is usually cheaper to build because it doesn't need labeled data, yet it's the one institutions most often skip.

One bank's sign-off thresholds offer a useful benchmark: at least 80% accuracy and 70% run-to-run consistency. Measured consistency across its evaluations ranged from 72 to 100 percent. On the weakest test, about one run in four returned a different answer.

The pattern in that variance is the real insight. Agents are nearly flawless at checkable facts, such as whether a company has a website or what sector it operates in. They are materially weaker at judgment calls: whether a wealth story is coherent, whether a behavior pattern is plausible, whether an adverse media hit is really the same person. The fastest path to production, McKinsey says, is to start where ground truth is checkable and keep interpretive steps behind a human gate.

Finding 4: Oversight is the real cost center

This is where the economics get uncomfortable. McKinsey's broader research on agentic economics finds that in a banking customer service task, tokens are only 20-25% of variable run costs; human oversight is 70-75%.

Automated quality control isn't free, either. At one large European bank, running a transaction monitoring case through the agent factory cost about €2.50 before optimization, and roughly half of that was the automated QA wrapped around the analysis, not the analysis itself. The transaction monitoring report reinforces the point: in mature deployments, 30-50% of the agent network is dedicated to quality assurance and traceability.

That's the gap between 2x and 20x. If a fixed share of cases always gets human review, oversight costs scale with volume and cap the gain. And regulators are noticing. McKinsey cites a June 2026 Financial Stability Board consultation pointing to "the impracticality of real-time human monitoring of agent decisions as their use scales."

The recommended answer is purposeful oversight rather than blanket review:

• Place human gates only where judgment is needed, with specific tasks at each one. In one source-of-wealth pipeline, roughly 60 subtasks run in 15 to 30 minutes with just three human checkpoints.

• Treat autonomy as a ladder, from "agent recommends, human decides" up to "agent acts alone," with each rung tied to a higher confidence threshold and a check on regulatory gating.

• Engineer the confidence gate. One bank grades source authority and entity-match strength into bands, consumes only the top band without review, and suppresses ungrounded answers instead of returning them with a caveat.

The transaction monitoring report centers on Commerzbank, which ran a proof of concept that became the foundation for a broader agentic program. Hans-Georg Beyer, the bank's chief credit risk officer and former group chief compliance officer, offers a practitioner's take.

Earlier analytics waves, he said, sharpened alert scoring but did little for the follow-up and judgment phase, which is where AI is now adding value by pulling together unstructured data across source systems. He described gains in both efficiency and report quality, and noted that deploying AI forced his team to define what "good" looks like.

His most pointed argument is about people, not platforms. Beyer calls talent the most critical enabler, and said the old split of business writing requirements while IT builds no longer holds in compliance. His subject matter experts had to become active participants in prompt engineering. On governance, he argues AI use cases must meet bankwide standards from day one to avoid accumulating what he calls "compliance debt."

The numbers McKinsey reports from transaction monitoring work are concrete. Banks have seen more than a 40% reduction in human processing time on investigations. In one proof of concept, agents reviewed full transaction histories for every alert, including customers with more than 15,000 transactions in the window, ran the same set of web checks on every case, and drafted follow-up questions where information was missing. McKinsey also says agent-written reports scored higher on completeness against a predefined checklist than analyst-written ones, with every claim sourced.

The workforce shift is significant. Traditionally, 60-70% of a transaction monitoring team works the process itself, often offshore or nearshore. With agents, McKinsey estimates process effort falls 30-50%, while IT staff pivot to enabling agents and QA staff pivot to monitoring and improving the system.

For CISOs, the most important section of the "lessons from winners" report is the one compliance teams may skim. McKinsey's control recommendations read like an agentic security baseline:

• Input controls – Screen for injected instructions and separate trusted configuration from untrusted content. McKinsey explicitly frames prompt injection as the agentic counterpart to SQL injection, and notes that an agent with tool or database access widens the blast radius.

• Data controls – Tag sources with sensitivity labels at ingest, block agents from unclassified sources, and measure when an agent exposes unnecessary personal data, including in its reasoning trace.

• Output controls – Check claims for hallucinations, require citations, and suppress unsupported answers.

• Access controls – Give each agent a tracked identity, tool-level allow lists, read-only scope by default, just-in-time privilege elevation, and an append-only audit trail across systems.

• Continuous testing – Including prompt-injection tests, hallucination tests, and replay tests confirming the agent used the right tools in the right order.

McKinsey also recommends an initial risk tier for each agentic use case based on four factors: how much the system can do without a human, the impact if it's wrong or manipulated, the sensitivity of its data, and the range of actions it can take. And it adopts a principle from its agentic-economics work: no autonomous system should run without a defined mandate, a budget, and a stopping rule.

This is identity and access management, data loss prevention, and application security applied to a new kind of workforce. Financial crime agents sit on some of the most sensitive data a bank holds and increasingly take actions, not just make recommendations. That makes the security team a co-owner of the program, not a reviewer at the end.

Both reports argue that waiting for clear rules is the wrong strategy, because supervisors expect validation without having said exactly how to do it.

The landscape McKinsey sketches is moving fast. The European Central Bank has signaled that generative and agentic systems introduce changes conventional controls may not address. Teams need to decide in the design phase whether a system falls under the EU AI Act's high-risk regime and its human-oversight mandate. Germany's BaFin has said it will scrutinize AI used directly in regulated activities, with high-risk obligations applying from December 2027. In the UK, the Financial Conduct Authority has eight firms live-testing agentic tools, including for AML and KYC, with an evaluation report expected in early 2027.

McKinsey also points to the Wolfsberg Group's August 2025 guidance, which argues that model risk should be weighed against financial-crime risk rather than treated as the only risk in the room. That's a useful framing for boards: an unvalidated agent is a risk, but so is a compliance function that can't keep pace.

Two caveats are worth keeping in view. First, the delivery figures come from McKinsey's own engagements, mostly with European banks in 2025 and 2026, and the institutions are anonymized. The "winners" are, in effect, McKinsey clients, and the reports double as a methodology pitch. Second, the 2x productivity figure is a meaningful step back from the 20-fold potential McKinsey floated last year. To the firm's credit, it says so plainly. That candor is the most useful thing in either report.

For financial crime, compliance, and security leaders weighing agentic AI, the two reports point to a clear playbook:

• Decide what you're reusing before you build. Shared platforms, evaluation harnesses, guardrails, and packaged business knowledge are where gains compound.

• Default to rules and deterministic code. Reserve agent reasoning for unstructured, interpretive steps.

• Put consistency next to accuracy in every sign-off gate. If you can't reproduce it, you can't validate it.

• Design oversight, don't just assert it. Specify who reviews what, at which step, against what evidence.

• Treat agents as identities. Scoped access, allow lists, audit trails, and prompt-injection testing belong in the first release, not the second.

• Build governance ahead of scale. The six-to-eight-month approval cycle is the bottleneck, and the second use case will hit it too.

• Invest in people as much as platforms. Subject matter experts who can write and refine prompts are the scarcest resource.

A year in, agentic AI in financial crime has moved from slideware to production faster than most expected, and the value is measurable. But the lesson from the leaders isn't about smarter agents; it's that assurance is the most expensive part of the pipeline, whether it's paid in analyst hours or tokens. The banks pulling ahead are the ones engineering trust as deliberately as they engineer automation.