Explainable AI in AML compliance: why a confidence score is not enough

Explainable AI in AML is the ability to say, after the fact and to a reviewer, why an automated decision was made. Why this customer was scored low-risk, why that alert was suppressed, why this identity passed. In a regulated program, that ability is not a feature of the model; it is the control that makes the model usable at all. Here is what it requires.

Why a confidence score is not an explanation

A model that returns a 94 percent confidence score has told you how certain it is. It has not told you what drove the certainty, which inputs mattered, or whether the reasoning would survive scrutiny. When FINTRAC asks how a decision was reached, "the model was 94 percent confident" is the same non-answer as "the system flagged it". Under the Bill C-12 standard, a program has to be effective, and a control whose reasoning cannot be reconstructed is hard to call effective. The point is covered more broadly in our AI governance framework guide.

Two audiences, one requirement

Explainability serves two people. The first is the analyst making the call right now, who needs to understand the model's output well enough to accept, override, or escalate it with judgment rather than blind trust. The second is the examiner, or the auditor, or the banking partner, reviewing the decision months later. They need to reconstruct the reasoning from the record alone. An explanation that lived only in the analyst's head at the moment of decision is not evidence. This is also why model risk management treats documentation as a first-class control.

Where explainability actually comes from

It is not one technique. It is a stack. Start with documented logic: a plain-language record of what the model does, what it uses, and what it is not designed to catch. Add recorded rationale: for each decision, the factors and signals that drove it, captured automatically rather than reconstructed later. Keep the human in the loop on the decisions that matter, so judgment and the override are part of the record. And favour models and rules whose behaviour can be traced over opaque ones for the highest-stakes calls. The combination, not any single method, is what makes a decision explainable.

Explainability as a by-product, not a project

The firms that struggle with explainability treat it as something to bolt on before an examination. The firms that do it well make it a by-product of how the system runs: every verification, screen, and score recorded with its rationale as it happens. That is the BriteBase model, and it is why the file that clears your fraud team is the file that satisfies a FINTRAC examiner. The supporting controls run through screening and AI governance, and the deepfake side of trustworthy inputs is covered in the deepfake detection guide.

FAQ