We built a 5-agent AFC orchestration system over 12 weeks. (1) Transaction Monitoring Agent: replacing rule-based alerting with intelligent, contextual analysis. The agent: ingesting real-time transaction data across all products (consumer loans, BNPL transactions, account-to-account transfers — processing 850,000+ transactions monthly), applying ML-enhanced detection models trained on the neobank's historical true positives (3 years of investigation outcomes — 486 confirmed suspicious cases), contextualising each transaction against customer profile (BankID-verified identity, income declaration, employment status, typical transaction patterns, geographic patterns), cross-referencing against sanctions lists (EU Consolidated List, UN Security Council, OFAC SDN — with entity resolution handling Nordic name variations and transliterations), and producing risk-scored alerts with detailed rationale — each alert including the specific suspicious indicators and confidence level. Alert volume: reduced from 4,200/month to 1,100/month while maintaining detection rate (zero reduction in true positives). False positive rate: reduced from 96.
8% to 82% — meaning 18% of alerts now required genuine investigation (vs. 3.2% previously). (2) Investigation Agent: automating the investigation workflow for medium and low-risk alerts. The agent: compiling comprehensive customer dossiers (transaction history, KYC data, previous alerts and outcomes, peer group comparison), conducting automated investigations for lower-risk alerts (structured analysis following the same methodology as human analysts — transaction pattern analysis, counterparty identification, source-of-funds assessment), generating investigation reports in Finanspolisen-ready format, and escalating to human analysts only alerts requiring judgment — complex typologies, politically exposed persons (PEPs), or novel suspicious patterns. Of 1,100 monthly alerts: 380 auto-resolved by the Investigation Agent (with human spot-check review), 720 escalated to human analysts with pre-compiled dossiers — reducing per-investigation time from 45 minutes to 12 minutes. (3) KYC Agent: automating customer due diligence across Nordic markets.
The agent: performing automated KYC at onboarding (BankID verification for Sweden, BankID Norge for Norway, Finnish Trust Network for Finland — unified workflow despite different underlying identity providers), conducting ongoing KYC refresh (risk-based scheduling — high-risk customers annually, medium-risk every 2 years, low-risk every 5 years), monitoring for KYC trigger events (significant transaction pattern changes, adverse media mentions, sanctions list additions, PEP status changes), and generating Enhanced Due Diligence (EDD) packages for high-risk customers — pre-compiled dossiers that analysts review and approve. KYC onboarding time: reduced from 4-7 minutes to under 90 seconds for standard customers. Ongoing KYC backlog: eliminated within 6 weeks of deployment. (4) SAR Preparation Agent: automating Suspicious Activity Report generation.
The agent: compiling all relevant evidence (transactions, KYC data, investigation findings, sanctions screening results, adverse media), structuring the SAR narrative per Finanspolisen requirements (specific format requirements for Swedish SARs under Lag 2017:630), cross-referencing with prior SARs filed for the same customer or connected entities, and generating draft SARs for analyst review and submission. SAR preparation time: reduced from 4-8 hours to 45 minutes (analyst review of AI-generated draft). (5) Regulatory Reporting Agent: automating compliance reporting across three Nordic regulators. The agent: aggregating AFC statistics (alert volumes, investigation outcomes, SAR counts, KYC completion rates) across all three markets, generating quarterly reports in regulator-specific formats (Finansinspektionen, Finanstilsynet, Finanssivalvonta — each with different templates, metrics definitions, and submission requirements), producing internal board reports on AFC effectiveness (trends, benchmarks, resource utilisation), and maintaining audit trails for regulatory examinations. Quarterly reporting: automated from 2 weeks to 2 days (including human review).
The orchestrator coordinating agents with human gates for: SAR filing (analyst review and approval before submission to Finanspolisen), EDD decisions (analyst approval of risk classifications for high-risk customers), model performance review (monthly human review of detection model performance metrics), and regulatory report submission (compliance officer sign-off).