Can AI help with client due diligence and money laundering checks?

AI can take some of the reading and summarising work out of client due diligence: pulling names, dates and ownership structures out of the papers a client sends, building a timeline from bank statements, and finding the official guidance on a process point. It cannot verify anyone's identity, run sanctions or politically exposed person screening, or decide how risky a client is. Those steps need a maintained dataset or human judgement, and in a firm they sit with the fee earner and the money laundering reporting officer.

Where AI genuinely helps

The useful work is document work, and there is often a lot of it.

• Reading a pile of onboarding material and listing what is actually there: which documents, dated when, covering which period, with anything missing called out.
• Turning a corporate structure chart, a set of filings or a trust deed into a plain list of who owns what and who controls what, with a page reference against each line so you can check it rather than trust it.
• Building a chronology of movements from bank statements the client has supplied, so you can see the shape of the money before you form a view on it.
• Reading official guidance on a process question at the source, rather than relying on a half remembered summary or a forum post.
• Drafting the narrative part of a file note or risk assessment for the MLRO to review, based on what the papers say.

None of that is the decision. It is the preparation that makes the decision quicker and better evidenced.

What AI must not be used for

Be blunt about the limits with everyone in the firm, because the temptation here is obvious and the consequences are serious.

• It is not an identity verification service. Confirming that a document is genuine and that the person in front of you matches it is a different exercise with different tools.
• It is not a screening database. Asking a general purpose chatbot whether someone appears on a sanctions list, or is a politically exposed person, or has adverse media coverage, is not a check. A screening provider maintains dated, sourced lists and tells you when they were last updated. A conversational assistant does not.
• It does not set the risk rating. Client risk, matter risk and geographic risk are judgements your firm makes and records, and your policy sets out who makes them.
• It cannot tell you whether something is suspicious. Suspicion is a human state of mind, and the reporting obligations that follow from it belong to named people in the firm.
• It does not certify copies, witness anything, or replace meeting the client.

If someone asks an AI tool to "check this client" and treats a confident sounding answer as a check, that is a file failure waiting to be found on audit.

Source of funds and source of wealth

This is where the reading burden usually bites: months of statements, several accounts, a property sale, a gift from a relative, a company distribution. A document assistant can list the large credits, show which statements are missing from a sequence, and set out what the papers do and do not explain.

Two cautions. First, insist on page level citations. A summary of a bank statement without a pointer back to the page is something you have to re-read anyway, so you have saved nothing. Second, insist that the tool says when the papers are silent. If nothing in the file explains where a deposit came from, the right answer is that nothing in the file explains it, not a plausible guess. A gap identified early becomes a question to the client. A gap papered over becomes a problem at audit or worse.

The adequacy of the evidence is still a judgement. The tool can tell you what is on the page. It cannot tell you whether that is enough.

Confidentiality, records and retention

Due diligence files hold some of the most sensitive material a firm ever takes in: identity documents, bank statements, explanations of family wealth, sometimes information about people who are not your client at all. Before any of it goes near an AI tool, be sure you know where the data is held, who can see it, whether it is used to train anything, and how long it is kept.

Inside the firm, access should follow the matter, not the job title. A due diligence conversation about a sensitive client should not be visible to everyone with a login.

Retention needs a moment's thought too. Your policy sets a retention period for due diligence records. An AI conversation that contains copies of the same passports and statements is another copy of that material, and it should be accounted for in the same way rather than sitting somewhere outside your retention schedule.

Finally, record what was done. If an assistant produced a chronology or a draft risk note, say so on the file, say who reviewed it, and keep the reviewed version as the record.

Where Alesis fits

Alesis answers questions about a matter from that matter's own papers and names the page each answer came from; where the papers do not say, it says so rather than guessing. Documents are read page by page, so citations point at pages, and any page it could not read is flagged rather than skipped. It reads official guidance at the source, with every point naming where it came from. The firm's information is held in the UK and processed only in the UK and the EU, kept apart from every other firm, never used to train anything for anyone else, and inside a firm people see only the matters they are on. Alesis assists qualified professionals and does not replace them, and it does not provide legal advice.