How an AI employee reviews PEP and adverse media alerts at a US bank: false positives, news relevance, dispositions and EDD escalation & citations.
Most PEP and adverse media alerts at a US bank turn out to be the wrong person, an old story, or a source nobody would rely on. The work is not finding the hit. It is deciding, alert by alert, whether the person is who the screening tool says, whether the news matters now, and writing down why. This guide covers how an AI employee does that review, where the US rules sit, and which decisions stay with your analysts.
US rules are narrower than many vendor marketing pages imply, and the difference shapes how you set up screening.
Adverse media is different again. No US regulation names "adverse media screening" as a requirement. Banks do it as part of a risk-based customer due diligence program, because negative news can change a customer risk rating, inform ongoing monitoring under 31 CFR 1020.210(a)(2)(v)(B), and support a suspicious activity decision. Your policy defines scope, and your examiners will test you against your own policy.
For the definition of the screening itself, see the glossary entry on PEP screening. For the sanctions side of the same name-matching problem, see OFAC sanctions screening automation.
Three causes account for most of the noise, and each one has a check a reviewer can run.
Cause | Example | What the reviewer checks |
|---|---|---|
Common or transliterated names | "Mohammed Ali" matches dozens of public figures | Date of birth, nationality, country of residence, occupation, address |
Role and relationship drift | A customer's former colleague was a minister | Whether the link is documented, current, and a close association rather than a shared employer |
Name overlap in news | A story about a different company or person with the same name | Full article context, employer, location, age, identifiers in the text |
An AI employee handles this by pulling the customer file and the candidate profile side by side and comparing every identifier available. It records which fields matched, which conflicted and which were missing. A match with conflicting date of birth and nationality is closed as a false positive with the evidence attached. A match with several corroborating identifiers, or one where identifiers are missing, goes forward.
Missing data is the case to watch. If your file has no date of birth for a customer, the agent should not guess. It should mark the alert as unresolved, state which identifier would settle it, and queue it for an analyst or a customer information request.
A hit is only useful if the story is about the right person, concerns conduct that matters to your risk policy, and is recent and credible enough to act on. Reviewers should apply the same four tests every time.
The AI employee applies these tests to every article, summarizes each in a few sentences, and cites the passage that supports its conclusion. It also checks whether several hits are one story syndicated across many sites. Your policy sets the thresholds, such as a look-back window by category. The agent applies them consistently, which is hard to maintain across a team working a large queue on a Friday afternoon.
Your examiner, your auditor and the next analyst all need to understand the decision without asking the original reviewer. A usable disposition record holds:
Hold the record for as long as your retention policy and BSA recordkeeping rules require. If the review feeds a suspicious activity report, SAR rules apply: 31 CFR 1020.320 requires filing within 30 calendar days of initial detection of facts that may constitute a basis for filing (60 days if no suspect is identified), and SAR confidentiality rules limit who can see the filing and how you refer to it in shared case notes. See suspicious activity report (SAR) for the filing basics.
A confirmed PEP or credible adverse media does not automatically mean EDD or an exit. The joint statement is explicit that risk varies. Your program should define triggers, and a typical set looks like this:
EDD steps usually include senior management approval, verification of source of wealth and source of funds, a review of the relationship and expected activity, and a shorter periodic review cycle. The AI employee prepares the EDD file: it assembles the evidence, pulls the account history, drafts the questions for the relationship manager and tracks the open items. A person decides whether to accept, restrict, monitor more closely or exit the relationship, and whether to file a SAR.
Step | AI employee | Person |
|---|---|---|
Alert intake | Pulls the alert, customer file and candidate profile | Sets screening scope and thresholds |
Name resolution | Compares identifiers, flags conflicts and gaps | Resolves ambiguous cases |
Media review | Reads articles, tests relevance, recency and source | Accepts or overrides the assessment |
Documentation | Drafts the disposition with citations | Approves and signs |
EDD | Builds the file and tracks open items | Judges risk, approves or exits the relationship |
SAR | Assembles facts for the narrative | Decides whether to file and files |
Tuning | Reports false-positive rates and drift | Changes policy and models |
For the wider picture, see how AML automation works, AI agents for financial crime investigations and the AI compliance analyst.
The hard part of this queue is judgment nobody writes down: this "Mohammed Ali" is a namesake, that outlet repeats wire copy, this PEP link is a former colleague. In Zamp's model that judgment goes into the Company Brain and the AOP as reviewed, scoped precedent, rather than staying in an analyst's head.
The AOP for this job would carry your PEP categories, your look-back window per adverse media category, the four relevance tests, and the identifiers that settle a name match. The agent's identity can read the screening tool's alerts and the customer file. It cannot change screening scope or thresholds, mark a relationship for exit, or file anything.
Precedent stays narrow by design. Say a reviewer clears a hit because the customer's date of birth conflicts with the public figure's. That is recorded against this customer and this profile, not as a rule that the name is safe. If the same pattern recurs, your process owner decides whether it becomes policy. The agent's own theory about why the reviewer decided is kept apart from the reviewer's actual reasoning.
Needs Attention fires on the cases this post warns about: a missing date of birth, hits with some identifiers matching and some absent, one story syndicated across sites with unclear origin, and any confirmed foreign PEP or credible recent media that meets your EDD triggers. Each lands with the comparison and citations assembled and the missing identifier named.
Before an alert closes, the validate step checks that every article has a citation, the relevance and credibility call is written, the list sources and versions are recorded, and the outcome matches one of your four allowed dispositions. The reasoning goes into your case-management system, the way the biopharma agent wrote its reasoning into SAP Ariba, so the next analyst reads it without a separate console.
Corrections are how this improves. An analyst overrides a relevance call, the change is made on a branch, tested against a golden set of past dispositions, reviewed and merged. Identity and approval controls are in Zamp Trust & Security, and the biopharma case study shows the review-rate curve. Banks usually pick BYOC or on-premises for customer data.
Start with one queue, such as adverse media on onboarding. Run the AI employee in shadow mode against past dispositions for a few weeks, and compare its decisions to your analysts' decisions on the same alerts. Have your model risk and compliance teams review the comparison before it touches live alerts. Then move to assisted review, where analysts approve every disposition, and only later consider auto-closing a defined class of low-risk false positives, with sampling by QA. Document each stage in your written procedures so the program reads consistently to an examiner.
