Financial crime investigators are hired to investigate. Yet much of their day can be consumed by something very different: searching systems, collecting data, assembling evidence, documenting findings and working through large volumes of alerts that ultimately prove non-suspicious.
That challenge spans both Transaction Monitoring (TM) and Fraud. Investigators may need to navigate numerous systems before they have enough information to make a decision. Meanwhile, growing alert volumes, tight deadlines and increasingly sophisticated financial crime put more pressure on already stretched teams.
AI offers an opportunity to change that operating model. But simply replacing manual work with Large Language Models (LLMs) isn’t necessarily the answer.
The better approach is to find the “just right” combination of AI, deterministic automation and human judgment—and orchestrate them across the investigation. That’s the idea behind Isaac, the AI Agent from WorkFusion, a UiPath company, for Transaction Monitoring and Fraud Investigations.
Move the work, not the responsibility
The goal isn’t to take investigators out of investigations. It’s to change where they spend their time.
Consider what happens after a TM alert is generated. An analyst may need to retrieve customer information, review transactions, research counterparties, examine case history, compare expected and actual activity, identify relationships and document everything that was found.
Fraud investigations create a similar challenge. An account takeover (ATO) alert can require evidence from fraud detection engines, transaction monitoring systems, authentication services, card networks, digital identity platforms, behavioral intelligence tools and third-party sources.
Isaac can perform much of this “hunter-gatherer” work automatically.
For Fraud Alert Review, Isaac integrates with existing fraud engines and other data sources, aggregates relevant context, analyzes transactions, produces a narrative report and routes the completed work to investigators for human-in-the-loop review.
In TM, the objective is similar: automate repeatable investigative work so potentially suspicious activity can be escalated earlier and investigators can spend more of their time on higher-value analysis.
Not every problem needs an LLM
This is where the Goldilocks principle becomes important.
Moving away from 100% manual investigations doesn’t mean moving to 100% LLMs. The strongest architecture uses different technologies for the work they are best suited to perform.
LLMs can provide tremendous value when investigators need to understand unstructured information. For structuring investigations, for example, an LLM can synthesize historic SAR narratives and case histories, reconcile prior dispositions against a current alert, and help interpret messy counterparty information.
But transaction arithmetic is different. Aggregation windows, velocity calculations, threshold proximity and peer comparisons should be calculated deterministically and provided to downstream AI as established facts—not generated by an LLM.
Isaac’s Fraud workflow demonstrates that combination. Parameter-based rules, thresholds and decision trees can assess transactions, while AI helps analyze broader context and assemble the investigation. When potentially fraudulent activity is identified, Isaac presents it to a human expert for review and approval.
LLMs where language and context matter. Rules and automation where consistency matters. People where judgment and accountability matter.
That’s the “just right” model.
Turn alert review into decision-ready work
The benefit isn’t simply faster processing. It’s giving an investigator a better starting point.
Instead of asking an analyst to find the information, organize it, analyze it, document it and then exercise judgment, Isaac can complete much of the preparation first.
The investigator becomes less of a hunter-gatherer and report writer and more of a reviewer and decision-maker.
That distinction matters when TM teams face regulatory timelines and unpredictable workloads. Human capacity isn’t perfectly elastic. Alert volumes spike. People take vacations. Complex cases take longer than expected. Backlogs develop, creating the familiar “day-30 scramble.”
AI Agents provide another source of capacity. Rather than waiting for an investigator to become available, Isaac can begin working alerts as they arrive—collecting information, applying defined processes and preparing results for review. WorkFusion positions this approach as a way to enable earlier and faster escalation of potentially suspicious alerts.
The same model applies to Fraud
Isaac’s expansion from TM into Fraud investigations is a natural one because the operational challenges are so similar.
Take account takeover. The relevant signal may not be one transaction. It could be unusual login geography followed by changes to account credentials and then atypical transactions. Isaac can aggregate data from multiple systems, identify contextual and transactional anomalies and prepare recommendations for human review.
At one financial institution using Isaac to support first-party fraud and ATO reviews, manual research time was reduced by more than 70%, while analysts were able to handle two to three times their previous case volume.
For TM, a regional bank using Isaac for structuring alerts reported approximately 10% of alerts auto-grouped, roughly 60% auto-closed and one to three hours saved on cases requiring investigation.
Give investigators the investigation back
AI conversations in financial crime often begin with the question: Can AI make the decision?
A more useful question may be: How much work can we intelligently automate before a person needs to make the decision?
That’s where Isaac changes the equation.
Let deterministic automation retrieve data and perform reproducible calculations. Let AI analyze complex information and surface relevant context. Let Isaac assemble and document the investigation. And keep people in control where human judgment and accountability matter most.
The future of Transaction Monitoring and Fraud isn’t 100% people, 100% LLMs or 100% rules. It’s finding the right combination of all three—and giving investigators more time to do what they were hired to do in the first place: investigate, exercise judgment and fight financial crime.
To learn more, download our newest whitepaper The Goldilocks Principle of AI for Transaction Monitoring and Fraud Investigations.