Governance is most of the product
An agent that clears alerts is easy to build. One that a BSA officer, a model risk team and an examiner will accept has to produce its own evidence. This page lists what Assay records, what it refuses to do, and what it does not have yet.
Why this matters now
In April 2026 the Federal Reserve, OCC and FDIC replaced their 2011 model risk guidance, including the 2021 statement on BSA/AML models. The new guidance says: “Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance.” Banks are told to govern those tools under their own risk management.1 In practice that means the tool has to arrive with the governance evidence built in.
The same month, FinCEN proposed a rule under which examiners would consider whether a bank employs “innovative tools such as artificial intelligence.” As of the last check it was still a proposal.2
What it will never do
- Filing or deciding not to file a SAR
- Clearing a sanctions or watchlist match
- Contacting a customer about an alert
- Changing its own policy or thresholds
These are not settings that can be switched on. The code has no path for the agent to take these actions.
Autonomy is earned, per alert type
| L0 Shadow | Agent runs, but its recommendation stays hidden until the analyst decides. Used to measure agreement. |
|---|---|
| L1 Recommend | Agent recommends with cited rationale. The analyst decides every alert. |
| L2 Batch approve | High-confidence closes can be approved in a batch. A QA sample is drawn from every batch. |
| L3 Auto-close | Named alert types close without a click, after 98% agreement on 2,000 QA-reviewed alerts and written sign-off. |
What gets recorded
- Every run: agent identity, model, policy version, the full investigation trace, claims with citations, policy rules that fired, validation results, tokens and cost.
- Every decision: who, when, what the agent recommended, whether the person agreed, and a reason code for overrides.
- Every policy change: a new version number with the before and after values. Past runs keep the version they ran under.
- One audit log of all of the above, hash-chained with SHA-256 so an edit or deletion anywhere is detectable. The workbench re-verifies the chain on every view and exports it as CSV or JSON.
Two clocks, kept separate
The FFIEC manual says the 30-day SAR period does not start when a transaction is flagged; it starts when review determines the activity is suspicious, with 60 days when no suspect is identified.3 Assay shows your internal review deadline in the queue and starts the SAR clock only when an investigator records that determination.
Documenting decisions not to file
FinCEN's October 2025 FAQ states there is “no requirement or expectation” under the BSA to document a decision not to file a SAR. The FFIEC manual still says banks should.4 Assay keeps the full cited rationale by default and lets your policy set the depth.
Mapped to Microsoft's Responsible AI Standard
| Accountability | Each workspace's agent runs under a named identity, and humans own every disposition. A SAR decision can only be recorded by a signed-in person. |
|---|---|
| Transparency | Every recommendation shows its claims, the record behind each claim, the policy rules that fired, the model, and the policy version. |
| Reliability and safety | Deterministic checks before and after the model, abstention on thin files, confidence floors, and autonomy that has to be earned with QA data. |
| Privacy and security | Customer-supplied text is treated as untrusted. API keys are stored as hashes. Enterprise runs in your own Azure subscription with your own model endpoint. |
| Fairness | Protected attributes are not inputs. Disposition and override rates can be compared across customer segments from the decision log. |
| Inclusiveness | Words plus colour for every status, keyboard-reachable controls, and visible focus throughout the workbench. |
What does not exist yet
- No SOC 2 report. No audit has started.
- No independent model validation or third-party penetration test.
- No customer production data has been processed. The public demo uses synthetic data only.
Design partners get the full control documentation and source access for their model risk review.