- About 40% of banks and 50% of credit unions saw higher fraud losses in 2025, and every $1 of fraud now costs US financial services firms $5.47.
- AI triage gathers context, ranks alerts and drafts a summary. Your BSA officer still decides whether to file a SAR.
- SAR deadlines have not changed: 30 calendar days from detection, plus up to 30 more to identify a suspect.
- In April 2026 the Fed, OCC and FDIC replaced the 2011 model risk guidance, and the new text leaves out generative and agentic AI, so your own written controls matter more.
- Published platform prices run from $699 a month to $10,000 a year, and a custom triage layer from Softpers starts from $3,000 and is usually live in 2 to 8 weeks.
Fraud teams at community institutions are small, and the alerts keep coming. This guide covers how AI triage works, which US rules still apply, and what it costs to buy or build.
Why fraud alerts pile up at community banks and credit unions
In Cornerstone Advisors' What's Going On in Banking 2026 report, a survey of 416 senior executives at banks and credit unions, roughly 40% of banks and 50% of credit unions reported higher fraud losses in 2025. Most expect losses to rise again in 2026, and about three-quarters are increasing fraud-prevention budgets.
The loss itself is only part of the bill. LexisNexis Risk Solutions' 2026 True Cost of Fraud study found that every $1 of fraud now costs US financial services firms $5.47 once fees, interest, replacement costs and other knock-on costs are counted.
A bigger budget does not shrink the daily workload. Every alert still needs someone to open it, pull the member's history from the core, compare it with what is normal for that member, and write down a conclusion. KYC refreshes and AML alerts follow the same pattern: repetitive work, context spread across several systems, and an audit trail built by hand. That is the work AI can take over. The judgment stays with your team.
How AI fraud detection works: alert triage step by step
- ReceiveThe alert arrives from your existing system, such as a transaction monitoring tool, a card fraud feed or a check-deposit screen.
- Gather contextThe agent reads the member's recent transactions, account age, past alerts and open cases, read-only.
- CompareIt checks the alert against the member's normal pattern and the rules your compliance team wrote.
- Rank and summarizeIt scores the alert and writes a plain-English summary: what triggered, what looks normal, what looks wrong, and which facts it used.
- RouteAlerts that meet your written low-risk criteria go to a quick human confirmation. Everything else goes to an analyst with the summary attached.
- LogEvery input, output and human decision is recorded, ready for an examiner or auditor.
Two limits are worth stating plainly. AI can be wrong, so a person reviews anything that matters. And it is only as good as the data it can read, which is why the first project is often about getting clean, read-only access to your core.
The US rules that still apply
| Area | What it says | What it means for AI triage |
|---|---|---|
| SAR filing (31 CFR 1020.320 for banks, 12 CFR 748.1(d) for credit unions) | File no later than 30 calendar days after initial detection, with up to 30 more days to identify a suspect. SARs and information that would reveal one are confidential. | The clock starts at detection, so faster triage helps. Keep SAR information out of any tool or log that is not locked down. |
| FinCEN SAR FAQs (October 2025) | No separate review of a customer is required after a SAR is filed, continuing-activity SARs are not required every 90 days, and there is no BSA requirement to document a decision not to file. | You choose how much to document. We still recommend logging the triage reasoning, since it costs nothing once automated. |
| Model risk guidance (April 17, 2026) | The Fed, OCC and FDIC replaced SR 11-7 and the 2021 BSA/AML model statement. The new guidance is aimed at organizations over $30 billion in assets and sets no enforceable standards. Per Orrick's summary, it excludes generative and agentic AI. | Most community banks are below that size, and credit unions are supervised by NCUA, not these three agencies. AI agents also fall outside the text, so your own testing, change control and human sign-off set the standard. Ask your examiner what they expect. |
| Third-party risk (2023 interagency guidance; NCUA 07-CU-13) | Scale oversight to each vendor's risk: due diligence, contracts, ongoing monitoring. | An AI vendor goes through your normal vendor review. Expect to supply security and data-handling documents. |
Customer data is also covered by your safeguarding duties under the Gramm-Leach-Bliley Act, so the tool should see only the data it needs.
What AI fraud detection costs
| Item | Published price | Notes |
|---|---|---|
| Fraud-check platform | $699 a month | SEON Starter: 2,500 checks a month and 10 users. Case management and AML sit in its custom-priced Premium plan. |
| Fraud and AML transaction monitoring | $10,000 for 12 months | Fraud.net Transaction AI on AWS Marketplace: up to 500,000 transactions, then $0.02 each. |
| Core-vendor and other platforms | Quote only | Ask for a written quote based on your asset size and alert volume. |
| Custom AI triage layer | From $3,000 | Softpers AI integration projects; most are fully live in 2 to 8 weeks. Your existing tools' fees still apply. |
| AI running cost | About 4 cents per alert | Illustration: 15,000 tokens read and 1,000 written on Claude Sonnet 5.5, listed at $2 and $10 per million tokens. |
| Compliance officer time | $80,730 a year (about $38.81 an hour) | US median wage, BLS May 2025, before benefits. |
These are list prices, not endorsements, and your quote will depend on volume. Whichever route you take, four things move the price:
- Core and data access. Jack Henry, Fiserv and FIS cores can differ in what data and interfaces they make available, and that sets how much integration work is needed.
- Alert volume and types. One alert type is a small project. Every channel is a large one.
- Security and vendor review. Documentation and contract work take real time on both sides.
- Schedule slips. In SEON's 2026 survey of 1,010 fraud and compliance leaders at digital-first organizations worldwide, 24% took four months or longer to go live, and 521 of the 1,010 (52%) said a delayed go-live had raised their operating costs. These are not community banks, so treat it as a rough guide.
A payback illustration, not a Softpers result: if two analysts each spend half their time on first-pass review, that is one full-time role, about $80,730 a year in wages. If triage removed a third of that time, the saving would be about $27,000 a year before benefits. Measure your own share in a pilot before you rely on it.
How Softpers builds it
- Discovery call (free, 30 minutes)We list your alert types with your BSA officer and look at how first-pass review works today. You get an estimate within 24 hours.
- Fixed-price pilot (1 to 2 weeks)We connect read-only to one alert type and run triage in shadow mode beside your analysts, so you can compare its recommendations with their decisions.
- Build and weekly demos (2 to 6 weeks)Your compliance team defines what counts as low risk, what must escalate and what each summary must contain. We encode your rules and add alert types, permissions and controls, with a demo every week.
- Launch and train (about 1 week)Analysts start working from ranked, summarized alerts. The system never files a SAR or closes a case without a person, and every integration is documented.
- 30-day warrantyWe watch usage and running costs and fix anything that comes up. Then it is yours, with 100% code ownership.
The AI runs in your own accounts and follows your existing permissions, models are not trained on your data, and NDAs and data processing agreements are standard. You also get a dashboard showing AI usage and running costs. These are our standard AI integration figures: core access and your vendor review can add time at a bank or credit union, and your estimate will say so.
Is your team ready for AI triage? 30 seconds
FAQs
Can AI file a SAR for us?
No. The filing duty sits with the institution and the decision belongs to your BSA officer. AI can gather facts and draft a summary, and a person reviews it. SARs are confidential, so access to any drafts must be locked down.
Does AI triage replace our existing fraud and monitoring tools?
No. It works on the alerts those tools produce. Changing monitoring vendors is a separate decision with a separate cost.
Do we need regulator approval before using it?
We found nothing in the guidance cited in this post that requires pre-approval. Examiners will still ask how it works, what data it sees and who signs off, so keep written answers ready and confirm expectations with your examiner. It also goes through your normal vendor review.
How much does AI fraud detection cost for a bank or credit union?
Published list prices for fraud monitoring platforms run from $699 a month (SEON Starter) to $10,000 a year (Fraud.net on AWS Marketplace) at small volumes, and many bank vendors only quote on request. A custom AI triage layer from Softpers starts from $3,000, and most projects are fully live in 2 to 8 weeks. Your existing tools' fees still apply.
Do the new model risk rules apply to AI agents?
The April 2026 guidance replaced SR 11-7 and, according to Orrick's summary, excludes generative and agentic AI. There is no specific federal text for these tools, so write down your own testing, monitoring and approval rules.
- What's going on in banking: 5 things that are top of mind in 2026 (AZ Big Media, 2026), reporting Cornerstone Advisors' What's Going On in Banking 2026
- What's Going On in Banking 2026 (Cornerstone Advisors, 2026)
- True Cost of Fraud Study 2026 North America: Financial Services and Lending (LexisNexis Risk Solutions, 2026)
- Frequently asked questions regarding suspicious activity reporting (FinCEN, 2025)
- FinCEN and banking agencies release updated SAR guidance (Davis Polk, 2025)
- 31 CFR 1020.320: Reports by banks of suspicious transactions (Cornell Legal Information Institute)
- 12 CFR 748.1: Filing of reports (Cornell Legal Information Institute)
- SR 26-2: Revised Guidance on Model Risk Management (Federal Reserve, 2026)
- Agencies overhaul model risk management guidance for banks (Orrick, 2026)
- SR 23-4: Interagency Guidance on Third-Party Relationships (Federal Reserve, 2023)
- Letter 07-CU-13: Evaluating Third Party Relationships (NCUA, 2007)
- Pricing (SEON, 2026)
- Transaction AI: Fraud & AML Monitoring (Fraud.net on AWS Marketplace, 2026)
- Claude API pricing (Anthropic, 2026)
- AI Reality Check: 2026 Fraud & AML Leaders Report (SEON, 2026)
- Occupational Outlook Handbook: Compliance Officers (U.S. Bureau of Labor Statistics, 2026)
