Human-in-the-Loop Isn't a Control If the Human Is Drowning

Oct 26

Written By CMA

by Charles S. Assaf, MSc IT - Senior Advisor, Content and Business Development, Capital Markets Advisors LLC

Every AI tool sold into a regulated firm ships with a human approval step. Few firms check whether thehuman can keep up. When they can't, the control exists only on paper.
I've written before about AI deployments that remove the human entirely. The more common failure inregulated ﬁrms is quieter. Last time the question was whether the human was there. This time it's whetherthey can do the job they're there for.

The Promise Everyone Makes

The reassurance is always the same: a human approves the output. Alerts get dispositioned by an analyst. Draftreports get signed oB. Nothing reaches a client or a regulator without a person in the loop. That’s the right rule.

But every trigger that routes work to a human adds to that human's queue. Put the person back in the loop withoutsizing the queue, and you've swapped an AI that dead-ends the work for a person who can't keep up with it.

I’ve previously argued "the human loop is not optional. It is the point", and I maintain the same position here, withthe bill attached: the point costs hours, and somebody has to staB them.

There’s a mindset of “just let AI do it”, which is easy to say, and even easier to implement now. But if a model doesthe work, who signs oB on it? If all the humans are doing is agreeing, are they really signing oB? And why botherif it’s just a rubber stamp? On the other hand, enforcement of full and complete review means having a qualiﬁedhuman do the review, and if that person is not satisﬁed with the result, do they then do the original taskthemselves or hand it oB to yet another model (for subsequent review)?

We ﬁnd ourselves in a loop – something that is second nature for a system or AI, but which produces burnout andfrustration in a human. So, where does the promise of improved eBiciency, increased accuracy and lower costscome in? Give an overloaded human reviewer AI and they’ll use it to review the AI.

__________________________________________________________________________________________________________________________________________________________________________________________

What It Costs

In October 2024, TD Bank's US operations pleaded guilty to Bank Secrecy Act and money laundering conspiracycharges, part of coordinated penalties of about US$3.09 billion and a cap on the growth of its US business [1][2].

Between 2018 and 2024, the bank failed to monitor 92% of its US transaction volume [3]: more than 14.6 billiontransactions, worth over US$18.3 trillion [4][5].

FINTRAC fined TD C$9.185 million earlier in 2024 over missed suspicious transaction reports and inadequate ongoing monitoring [6].

The failure wasn't simply a matter of individual transactions being overlooked. FinCEN found a more systemicproblem. AML spending remained roughly flat while the bank's assets and risk grew. Its AML leaders had set outto run the programme "within a flat cost paradigm." Meanwhile, alert volumes rose while AML headcount fell [7].

__________________________________________________________________________________________________________________________________________________________________________________________

Do The Arithmetic

Take a scenario where your AI compliance monitoring flags 500 alerts a day. Each alert takes 8 minutes toproperly review. That’s about 67 hours of review a day - or around 9 full-time analysts doing nothing else butreviewing. Now, if that team has only 4 people, you are left with two outcomes: a perpetually growing backlog, or8 minutes becomes 3.6 minutes.

If the backlog is not allowed to grow, the accuracy of every review is going to be impacted, with the pressure tomeet quota increasing the risk of non-compliant transactions slipping through. The argument that “since the AIdid it, it must be right” is not sufficient when an incorrect decision from a probabilistic model may not beidentified as a real compliance issue in a shortened human review cycle. While such a practice does provide anaudit trail of hastily reviewed alerts, under examination that is a control failure with your signature on it.

At TD, the regulator found exactly this: more alerts, fewer people. TD’s failures predated today’s generative AIdeployments. The case illustrates what happens when monitoring obligations outgrow the resources assignedto them – not an AI-specific failure.

__________________________________________________________________________________________________________________________________________________________________________________________

Why AI Makes It Worse Before It Makes It Better

The use of AI can increase the load on reviewers, especially in the first few months. This is a foreseeableimplementation risk, not an inevitable outcome. During initial tuning, a new model may generate more alertsthan anticipated, while reviewers may also need additional time to assess both the underlying transaction andthe model’s reasoning. Every new tool introduces another approval queue for the same team. None of that additional humanworkload was factored into the vendor’s impressive demonstration.

AI doesn’t take jobs away, it changes them. The “doing” becomes verifying. Leavers and retirees aren’t replaced,because the worker “isn’t doing as much now.” The possible consequence: the increased workload goes home.People clear the queue after hours so that it’s done by morning and the dashboard is clear. This is not sustainableand ultimately leads to burnout, culminating in a situation that is worse than before using AI as you now have anexhausted workforce that is unable to review the AI’s work. The queue grows.

__________________________________________________________________________________________________________________________________________________________________________________________

Size The Loop Before You Close It

There are three ways to close the gap. Most firms need all three.

Tune the model: have it produce fewer, better alerts.

Tier the review: prioritise alerts by documented risk criteria, complete required dispositions, and usestatistical sampling for quality assurance.

FFIEC provides the BSA/AML Manual [8] which describes how to assess compliance with BSA regulatoryrequirements. It specifically refers to suspicious activity reporting and outlines what FinCEN and federalbanking agencies should examine with respect to a bank’s policies, procedures and processes that identify,evaluate and report suspicious activity with a focus on individual SAR filing decisions as a measure of banks’compliance and reporting procedures.

Similarly, FINTRAC provides Risk Assessment Guidance [9] that describes how to understand types of moneylaundering and terrorist financing risks and how to use a risk-based approach to conduct risk assessment ofbusiness activities and compliance.

Both of these support the principle that tiering is defensible when it’s a documented, risk-based method, andindefensible when it’s improvised under pressure. Such a documented, risk-based method is necessary for any bank operating in the United States or Canada for tiering their reviews.

Staff the queue to the real number: None of this can work, however, if there is not adequate staff to accomplishthis. Adding an AI here or an AI there to help is not the same as having enough resources. If volume × minutesexceeds available hours, the deployment isn't ready, however good the model is.

Before deployment, calculate expected review demand, available qualiﬁed capacity, acceptable backlog,escalation capacity and the conditions that trigger escalation, additional staBing or suspension of the newAI deployment without interrupting required monitoring.

Write down where the AI stops. It can triage and draft, but a person decides.

__________________________________________________________________________________________________________________________________________________________________________________________

The People Problem Underneath

The reviewers that you need are not generic analysts. These people must have both AML judgement and enoughAI literacy to know when the model is incorrect. And they are people, not machines, who cannot work 24/7.

That profile is not necessarily easy to come by. Outsourcing it offshore, for instance, loses the knowledge eachtime someone leaves. If AI clears the level-one alerts, where do the next decade’s investigators learn the trade?

Interim specialists can help clear a backlog, train a permanent team, and provide ongoing support as AI verification tools continue to evolve.

__________________________________________________________________________________________________________________________________________________________________________________________

The Payoff

A review process sized to its volume does what regulators assume it does. Backlogs stay flat. Seniorreviewers spend their time on the cases that carry risk. And when an examiner asks how a decision wasreached, there's a person who actually reached it. At TD, flat AML spending bought a ceiling on revenue.This is where the AI stops – it may support triage and drafting, but accountability and required humandecisions cannot be delegated merely by adding an approval button.

CMA places experienced compliance and AML specialists where the queue is, for a backlog or for the longterm, and supports AI-enabled review with people accountable for every decision. Tell us your volumes.

__________________________________________________________________________________________________________________________________________________________________________________________