Financial Crime Prevention in the US 2026: Where Bank Compliance Spend Now Buys Earlier Catches and Fewer False Positives

An AML analyst at a top-25 US bank used to start her morning with 480 alerts and a coffee. By lunch she had cleared maybe 80, and the queue had refilled. The point of the work was not catching criminals, it was draining a bucket someone else was filling faster than she could empty it. That dynamic, more than any regulatory shift, is what AI-assisted triage has changed. Depository institutions in the US filed 2.6 million suspicious activity reports in fiscal year 2024, part of 4.7 million SARs in total, according to FinCEN’s published statistics. The volume keeps growing, but the analyst’s queue has stopped.

The reason is straightforward. Up to 95 percent of alerts generated by traditional rules-based monitoring systems were false positives. Banks have spent the last three years pointing machine-learning models at that 95 percent and demoting it before it reached a human. The economic effect is that compliance budgets, which grew at double-digit rates from 2019 through 2023, are now being asked to produce earlier detection rather than larger teams. The marginal dollar buys a model engineer, not a third-shift analyst.

What the SAR data actually shows

The 2024 FinCEN figures, summarized in the FinCEN Year in Review for FY 2024, tell a more textured story than the headline. Total SAR filings dipped 0.2 percent year over year, the first decline in five years, after a 51.8 percent climb from 2020 to 2024. Fraud-related SARs held steady at 52 percent of all reports. Cyber-event SARs jumped 12.4 percent. Synthetic-identity SARs grew 37 percent. The mix is shifting toward typologies that rules engines were never tuned for, which is why the largest banks have moved roughly a third of their detection logic onto supervised and semi-supervised models.

The law-enforcement side of the ledger is the part bank boards quote when they justify the spend. The FBI relied on BSA filings for between 16 and 40 percent of investigations into various financial crime categories in fiscal 2024, and more than 87 percent of IRS Criminal Investigation cases recommended for prosecution over the prior two years had a related BSA filing. Banks pay for the system. The return shows up in indictments, not in the bank’s earnings call.

That asymmetry matters because the compliance budget is the bank’s, and the credit goes to the prosecutor. Several large bank general counsels have argued for years that this is the single hardest line item to defend internally. The model investments that reduce false positives are the part of the budget that produces an internal-facing return, in the form of analyst hours saved and earlier case escalation, which the bank can measure on its own books.

The false-positive problem and the model layer that addresses it

Banks that have layered machine learning on top of legacy transaction monitoring report 60 to 90 percent reductions in false positives without a material change in true-positive catch rate. That number varies more than vendors admit, because it depends on how the bank labels training data. The institutions getting the cleanest results are the ones that funded a multi-year effort to backfill alert dispositions into structured training sets, then governed those sets through a model risk management program that satisfies SR 11-7.

The cost picture has not collapsed. LexisNexis Risk Solutions, in its True Cost of Financial Crime Compliance study, put the annual US and Canada total at $61 billion, with compliance costs rising for 99 percent of institutions. What the AI investment has bought is a different distribution of that spend: less on rote alert clearing, more on case-building, network analysis, and analyst training. Several large issuers report that the share of analyst time spent writing SAR narratives, rather than triaging noise, has roughly doubled.

Sanctions screening and the alert problem there

Sanctions screening has been an even harder target. Industry estimates put sanctions-alert false-positive rates at 99 percent, driven by name-match fuzziness and OFAC list expansion. The screening workload kept climbing through 2023 and 2024, with 83 percent of mid- and large-sized institutions and 87 percent of small institutions reporting more alerts. Banks have responded with entity-resolution engines that consolidate variant spellings, attach contextual data such as date of birth or known address, and demote low-confidence matches before they reach a queue.

The harder problem is governance. A model that demotes an alert is also a model that, if miscalibrated, can suppress a true match. Banks are now running parallel queues, where a sample of demoted alerts gets routed to human review specifically to validate the demotion logic, and the results feed back into the model. For more on how this connects to broader regulatory expectations, see TechBullion’s coverage of AML model governance at US banks.

OFAC’s enforcement posture matters here too. The agency has signaled that banks cannot use model-driven demotion as a defense if a sanctioned party slipped through the screen. The compliance program has to be able to show, in writing and with examples, that the demotion logic was reasonable, tested, and supervised. Banks that ran model demotions without that documentation in 2023 are rebuilding the program around explainability in 2026.

Where the spend goes in 2026

Three line items are absorbing the marginal dollar. Cloud-based case management platforms that unify KYC, transaction monitoring, and sanctions are replacing the federated stacks that grew up over the last decade. Entity-resolution tooling that lets analysts see a customer’s full network, including counterparties and known associates, is moving from the largest banks into the regional tier. And agentic case-build tooling, which drafts the SAR narrative from the alert payload, is in production at several G-SIBs and in pilot across roughly 30 mid-tier banks.

The internal politics matter. Compliance leaders who used to report into the general counsel are increasingly reporting into the chief operating officer, because the work is now operational throughput as much as legal defense. For analysis of that organizational shift, see TechBullion’s piece on compliance leadership in US bank org charts and our coverage of SAR narrative automation at US banks.

What earlier catches actually look like

The most concrete signal that the model layer is working is the time from first suspicious activity to SAR filing. Banks running mature entity-resolution and behavioral models report median time-to-detection windows of 11 to 18 days for elder-fraud cases, down from 45 to 70 days under the prior rules-only stack. Earlier filings mean law-enforcement can freeze assets while the trail is fresh. That is the metric examiners are starting to ask about.

The pattern repeats across typologies. Trade-based money laundering, historically one of the slowest typologies to detect, now surfaces in 30 to 45 days at banks that have invested in counterparty network analysis, against six months or more under legacy stacks. Romance-scam pig-butchering cases, which barely existed as a separate typology in 2021, now show median detection in under 21 days at banks with mature behavioral models.

The training data gap is the constraint. A bank that only has clean labeled outcomes for the last 18 months of alerts cannot train a model that generalizes to typologies the bank has not previously seen. Several large banks have entered data-sharing consortia where anonymized typology data circulates among members, with the explicit goal of giving each member’s models exposure to attack patterns the member’s own customer base has not yet produced. The FFIEC’s recently updated guidance on third-party risk management speaks to the governance these arrangements require.

The next pressure point is going to be the model audit trail. Examiners want to see why a particular alert was demoted, and they want it in a form they can read without a data scientist in the room. Banks that built explainability into the design will pass that exam. The ones that bolted models onto legacy stacks without it will spend 2026 retrofitting.