Wolfsberg Effective Monitoring Statement Part II (2025): AI and Models

On 27 August 2025 the Wolfsberg Group, an association of global banks, published the second part of its Statement on Effective Monitoring for Suspicious Activity, titled "Transitioning to Innovation". Part I, from July 2024, argued that suspicious activity monitoring should produce useful information for law enforcement, not just generate alerts. Part II explains how a firm can move from traditional rules-based monitoring to machine learning, artificial intelligence and hybrid approaches without losing control. The statement is industry guidance rather than law, but it shows what banks are pressing regulators to accept. This guide summarises it. If you want the practical side of tuning alerts, our guide to transaction monitoring alert tuning is a good companion.

We read the Wolfsberg Group's announcement of the statement and the text of the statement itself, as published on a financial crime news site. We did not read the copy on the Wolfsberg website. The statement is marked 2025 and gives no publication day; the date above is from the Group's announcement.

Where Part II fits

Part I introduced three "Wolfsberg Factors": compliance with the law, providing useful information in priority areas, and risk-based controls. It also argued that monitoring covers more than transaction monitoring, because it includes customer behaviour and attributes. Part II builds on that by dealing with how to transition, validate, govern and explain new monitoring models. It says legacy approaches are becoming less effective and less efficient.

The three pillars

1. Transition and validation.
2. Balancing model risk with financial crime risk.
3. Explainability, meaning transparency about coverage and effectiveness.

The Group supports adopting automation, AI and machine learning in monitoring programmes provided they are deployed within this framework.

What counts as innovation

The statement includes supervised and unsupervised machine learning, large language models that can summarise what drove an alert and suggest next steps for an investigator, hybrid designs that combine rules with supervised and unsupervised methods, and the use of data beyond transactions, such as customer attributes and behaviour.

Transition and validation

The statement makes several points that differ from a conventional model validation mindset:

• Design the new approach for the outcomes you want, rather than judging it only against how the old system performed.
• Accept that the new approach may detect less overall but produce higher-quality leads, and explain any change in risk appetite to supervisors.
• Move away from "drag net" scenarios that generate low-quality filings.
• Measure performance using priority risk coverage, expanded risk indicator coverage, precision and recall, quality feedback on suspicious activity reports, and downstream integration so analysts can clarify activity with customers.
• Invest in upskilling investigators so they can interpret more complex alerts.

On testing, the statement says running the old and new systems side by side for a set period is often a product of weaker testing environments and high execution-risk concern, and may not suit machine learning transitions. It recommends proof-of-concept evaluations in test environments using historical data. Historical comparisons still have value; for example, a firm can look at the quality of reports the old approach found and the new one missed. Validation should be continuous, not a one-time event.

Model risk versus financial crime risk

The statement says financial crime models should be tiered separately from prudential or financial risk models in a firm's model risk policy. It asks firms to weigh the risk of running an imperfect model against the risk of not having it, noting that a model that detects crime beyond what would otherwise be caught can be worth running. Factors for materiality include detection effectiveness, products and services, transaction coverage, concentration, and business size and scale. It also reminds firms that no single model is the sole point of failure in a control framework.

Oversight and the three lines of defence

The Group says overlapping reviews by audit, assurance and model risk teams can delay new models by months. It proposes a clean split: second-line model risk management validates methodology, data and performance; second-line assurance checks control effectiveness against policies; and third-line audit assesses governance, alert handling and gaps in managing typologies. It also suggests limiting re-validation of long-established simple rules unless it would materially improve detection, validating a core model fully, and testing later rollouts only for what changes, such as data feeds.

Explainability

Firms should be able to explain the monitoring lifecycle through three lenses: risk coverage (mapping risk indicators and typologies to model features, grounded in a risk assessment and national priorities), model design, development and calibration (data selection, influential features, training data, algorithm choice and retraining), and model usage (helping analysts understand why an alert was generated). Because models produce probabilities, the statement says firms must set and explain a risk appetite for missed activity. Guardrails or pre-defined conditions can supplement model outputs and should be reviewed continuously. For a wider look at AI in this area, see our guide to AI in AML transaction monitoring.

What it says to regulators

The statement is mainly written for firms, but it points to a US interagency statement supporting efforts by banks to innovate and update their financial crime systems and models, notes that supervisors increasingly expect firms to show progress on law enforcement priorities, and says supervisors assess firms against their own policies, so governance documents should reflect the distinct nature of financial crime models. The Group says it will keep engaging supervisors worldwide and advocating for regulatory environments that support innovation. It sits well alongside the Group's June 2026 guidance on the risk-based approach.

What this means for smaller firms

The statement is written for large banks, so none of it is a requirement for an accountancy practice. These are our suggestions for firms using monitoring tools:

• Ask your vendor to explain what drives an alert in plain terms before you rely on it.
• Track whether alerts lead to useful reports, not only how many alerts you close.
• Record why you changed a rule or model, and what you expected to improve.
• Keep a human reviewer who understands the typologies the tool is meant to catch.

For training in this area, see the Learnsignal CPD courses.

What we could not confirm

We could not confirm the exact publication day from the statement text, and we did not read the copy on the Wolfsberg site. The statement does not mention network analytics, so we do not claim it covers it. We did not check how any regulator has responded.

Frequently asked questions

Is Part II binding?

No. It is a statement by an association of banks and not a rule.

Does it say to run old and new systems in parallel?

It says parallel running is often an artefact of weaker testing environments and may not suit machine learning transitions, and recommends proof-of-concept evaluations in test environments instead.

What are the three pillars?

Transition and validation, balancing model risk with financial crime risk, and explainability.

Does it say new models must detect more?

No. It accepts that a new approach may detect less overall but give higher-quality leads, as long as the change in risk appetite is explained.

Learnsignal publishes this guide for general education only. It is not legal or compliance advice.