The wire room, twelve months out.

Wire operations are one of the few places in a bank where speed, fraud loss and regulatory exposure meet in a single queue. A wire that leaves is hard to recall. A wire that waits misses its cut-off. Most wire rooms still manage that tension with skilled people rekeying requests, clearing alerts and placing callbacks by hand. That model is reaching its limit, and the tools to change it are now practical.

Why now

Three forces make this the moment to build agent capability into the wire room.

The risk is rising. The FBI's Internet Crime Complaint Center recorded $2.77 billion in losses to business email compromise in 2024. Fake payment instructions are the attack, and the wire is how the money leaves.

The noise is overwhelming. Industry reporting puts the false-positive rate on cross-border sanctions alerts as high as 99%. Analysts spend most of the day proving that a match is not a match, often starting from zero each time.

The data has improved. Fedwire moved to ISO 20022 on 14 July 2025. Payment messages now carry rich, structured fields for parties, purpose and remittance detail. Software can read every field reliably, which was not true of the old free-text formats.

Taken together, these changes mean agents can now read every wire, reduce alert noise and help stop fraud before money moves.

Start with the wire, not the model

A wire passes through seven stages: intake, repair, authentication, fraud and BEC review, sanctions screening, release and reconciliation. In most banks a person touches all seven. Requests arrive by email, PDF and fax and are rekeyed. Repairs loop back. Callbacks are set up manually. Alerts are worked from scratch. Breaks are found the next day.

The goal is not to remove people from the process. It is to change what they do. By month twelve, a clean wire should need a person at one stage only: release. Agents read, check and package the work at the other six. Exceptions go to a person with the evidence already assembled.

Begin with a stage-by-stage map of the current workflow: who touches each wire, how long it takes, where rework occurs and which errors cost the most. That baseline makes every later claim measurable.

Where agents add the most

Expected impact differs by stage. We assess each one on volume, rework, loss exposure and how easily an agent's output can be checked.

• Intake (high). Agents read requests from email, PDF and fax and draft the ISO 20022 message. The target is no rekeying of digital requests.
• Repair (medium). Agents check routing details and BICs and correct formatting before a person sees the item, reducing repair loops.
• Authentication (medium). Agents flag payee changes and prepare the callback, with the number taken from the bank's records rather than the request. The target is a logged callback for every high-risk wire.
• Fraud and BEC (high). Agents score payee history, amount and timing against the customer's normal pattern, so a compromised instruction is caught before release.
• Sanctions (high). Agents pre-review each alert and write a rationale an analyst can accept, amend or reject. The target is half as many alerts reaching an analyst.
• Release (people). Release authority stays with people. Agents ensure the release queue is complete and ordered by cut-off.
• Reconciliation (medium). Agents match activity to the ledger and work recalls, so breaks are flagged the same day.

Impact levels are assessed, not measured. They tell you where to start; the pilot tells you what is real.

What peers already show

Published results from banks and regulators suggest the targets are realistic. A Nordic bank reported 83% fewer false positives in payment-sanctions filtering (vendor case study). HSBC reported 60% fewer anti-money-laundering alerts while finding two to four times more suspicious activity. The FBI's Recovery Asset Team succeeded in freezing funds in 66% of the business email compromise transfers reported to it in 2024. The sooner a fraudulent instruction is caught, the better the odds of stopping or recovering the money.

Treat vendor-reported figures with care. Confirm each target against the bank's own data during discovery.

Build the capability in three stages

Each stage has a gate. Move forward only when the evidence from the previous stage supports it.

Months 0 to 3: Assist

Agents read and draft. People take every action. Run agents alongside the current process on live volume and compare their drafts with what operators actually did. This is where you learn how often the agent is right, where it fails and whether its failures are visible. Gate: draft accuracy and exception rates agreed with operations, compliance and model risk.

Months 3 to 6: Co-pilot

Agents build the work packet: the parsed request, routing checks, payee history, fraud score, sanctions rationale and prepared callback. People approve. Add fraud scoring and sanctions triage at this stage. Gate: measured reductions in handling time and alert volume, with no increase in missed fraud or sanctions escalations.

Months 6 to 12: Supervised

Clean, low-risk wires run through the agent stages to release. People release and review a sample of the agents' work. Exceptions, high-value wires and anything the agent is unsure about go to a person. Gate: sample-check results, monitoring thresholds and rollback procedures approved before scope widens.

Guardrails that do not move

Agents in payment operations need explicit boundaries from the first day. These four should not change at any stage.

• People release money. Agents prepare and recommend. They never release a wire.
• Dual control stays. Agent output never replaces the maker or the checker.
• Every step is logged. Inputs, rationale, decision and approver are kept for audit, so any wire can be reconstructed afterwards.
• Agents are governed like a model. Validation before use, ongoing monitoring, change control and least-privilege access to data and systems, under the bank's model risk management framework.

Measure what it returns

Set three month-twelve targets below published peer results and confirm them with the bank's data during discovery: one of seven stages touched by a person on a clean wire, 50% fewer sanctions alerts reaching an analyst, and a logged callback for every high-risk wire. Track the cost of the agents alongside the operating hours they free up and the losses they help avoid, and report cash savings and capacity separately. Without that record, a successful pilot is hard to defend and harder to expand.

Where to begin

Choose one stage with high volume and checkable output; intake or sanctions triage usually comes first. Map the current work, agree the baseline and run the agent in Assist mode on live volume. Within a quarter you will know whether the case holds, and you will have the evidence your risk, compliance and audit functions need to approve the next step.