AML with a Gemini Enterprise agent: from alert to COAF report

Brazilian financial compliance has three heavy duties: KYC (covered in the mid-size bank case), transaction monitoring and COAF reporting. The latter two drown AML teams.

This post shows how agents help — and where they explicitly don't by regulatory requirement.

The problem: where time is lost

Mid-size Brazilian banks generate 5–15k AML alerts/day, from static rules, statistical models, and lists (PEP, sanctions, adverse media).

Compliance spends 70% of time on the 85% noise. That's where the agent enters.

What the agent does

1. Receives the alert from the rules engine.
2. Collects context: 12-month customer history, registration profile, current KYC, prior alerts and outcomes, business segment.
3. Applies rationale:
   • Operation within declared profile and history? → recommends archive with justification.
   • Atypical but with similar prior archived outcome? → escalates with precedent reference.
   • Atypical without clear precedent? → escalates with preliminary dossier.
   • Multi-account fragmentation? → priority escalation with diagram.
4. Builds dossier: timeline, accounts, amounts, patterns, KYC, score, regulatory references.
5. Suggests classification with numeric confidence.
6. For human-confirmed true positives: COAF report draft in Siscoaf format.

The agent never archives alone, never sends to COAF alone. Final decision always belongs to the compliance officer.

Architecture

• Gemini Enterprise Plus + Vertex AI Agent Builder.
• Vertex AI Search: COAF typology base, case law, BACEN manuals, anonymized internal decisions.
• Core banking connector via Apigee (transactions, accounts, profile).
• Tools: customer 360° lookup, alert history, sanctions + PEP lists, adverse media, Siscoaf draft generation.
• Dedicated review panel for the compliance officer with full dossier.
• BigQuery: mandatory auditable log.

Typical results (60–90 days)

The most valuable gain isn't cost reduction — it's freeing the compliance officer for complex cases (structured schemes, money mules, internal fraud). Only humans detect those in depth.

What BACEN/COAF expect

What the agent does NOT do (by design)

• Does not send COAF reports. Drafts — human sends.
• Does not block accounts. Recommends escalation to risk area.
• Does not classify the customer-bank relationship. Risk rating stays with the regulatory engine.
• Does not archive alone. Recommends; compliance officer approves.

These limits are by design, not technical limitations. Crossing them would create unacceptable regulatory exposure.

Common project mistakes

1. Trying to replace the rules engine

The rule-based engine is required by regulation. The agent complements, doesn't replace.

2. No precedent base

Without anonymized precedents, the agent recommends in the dark. We always invest in curation of 200–500 resolved cases.

3. Underestimating team change

Compliance officers may see the agent as a threat. The right framing: "the agent filters so you have time to investigate deeply".

4. Missing explicit uncertainty prompt

Without instruction, the agent sounds overconfident. Mandatory prompt: "if there is no clear evidence, classify as 'requires human review' — don't invent".

Typical cost

• Gemini Enterprise Plus: 15–25 licenses × US$ 39 = US$ 585–975/month.
• Vertex AI: ~R$ 6,000–12,000/month by volume.
• Connectors and Apigee: ~R$ 8,000–15,000/month.
• Lists, adverse media, PEP: variable.
• Autenticare implementation: R$ 280k–450k (60–90 days).

Typical payback at mid-size banks: 6–10 weeks after go-live, given the loaded compliance officer salary (R$ 18–30k/month).

Also read

• Intelligent KYC: mid-size bank case
• DPIA for Gemini Enterprise projects
• Corporate RAG with Vertex AI Search