Transaction monitoring, payee name checks and customer servicing are the Dutch retail banking processes where internal auditors must now audit AI agents. Key skills: testing the decision record, spotting prompt injection in customer-supplied text, and tracking agent recertification every 90 days. Their opinion stays independent. DNB, the AFM, GDPR, DORA and the EU AI Act set the frame.
What does internal audit cover at a Dutch retail bank?
Anti-money laundering has been the dominant theme. Dutch banks have invested heavily in customer due diligence and transaction monitoring under supervisory pressure, and internal audit tests whether alerts are handled consistently, whether customer files are complete and whether suspicious transactions are reported on time. With AMLA being established in Frankfurt, audit expects EU-level scrutiny to grow.
Payments are the second focus. Dutch customers pay almost everything by instant transfer, and authorised push payment fraud is a constant risk. Under the EU Instant Payments Regulation, payment service providers must verify the payee's name, and audit tests how mismatches are handled. Conduct topics such as complaints, debt collection and vulnerable customers, supervised by the AFM, complete the plan.
Where do agents enter the work?
Banks are putting agents into these flows. Each holds its own depth, earned on the bank's own past cases.
- Transaction monitoring alerts (depth 2). The agent gathers context and drafts a disposition. An analyst closes or escalates.
- Payee mismatch handling (depth 2). When a name check returns a mismatch, the agent drafts the warning to the customer and holds the payment for the customer's confirmation.
- Customer due diligence refresh (depth 2). It drafts requests for updated information and assembles responses for an analyst.
- Servicing via chat (depth 3 within limits). It answers routine questions and processes low-risk changes made in the authenticated app.
Audit can use its own agent at depth 1 to test full populations of alert dispositions from the append-only record.
What must auditors learn, and what stays with them?
Our guide on what internal auditors should learn before working with AI agents covers the foundations: depth, the minimum chain, the verdicts, the record. Two further skills are specific to this setting.
The first is prompt injection. Customers write free text into payment descriptions, chat messages and due diligence answers, and a fraudster can write text designed to steer an agent, such as an instruction to mark an alert as explained. Under the Pryme Context Protocol, that text arrives stamped as declared or external and cannot authorise anything, but auditors should still be able to recognise attempts in the record and test how the bank responded. Our guide on training internal auditors to spot prompt injection and pressure has exercises.
The second is recertification. Agent certificates lapse after 90 days, and a failed Attest run drops the agent to depth 1 the same day. For audit, that means every sample period may span several certificates. Our guide on keeping internal auditors ready for an AI agent's 90-day recertification explains how to build certificate checks into each engagement.
Which skills to prioritise depends on the team. Our ranking of which AI agent skills matter most for internal auditors helps decide.
What stays with the auditor: the plan, conclusions, ratings and reporting to the board's audit committee.
Which Dutch rules shape oversight and literacy?
De Nederlandsche Bank supervises prudential soundness and integrity, including AML controls, and the AFM supervises conduct. Significant banks are also under ECB banking supervision, and the EBA sets EU-wide guidelines. When agents operate AML or conduct controls, audit must be competent to test them.
The EU AI Act requires AI literacy among staff operating AI systems under Article 4, and lists creditworthiness assessment of individuals as high-risk in Annex III. GDPR governs customer data, with Article 22 on solely automated decisions and Article 35 impact assessments; the Dutch data protection authority supervises. DORA applies to banks and covers ICT risk, incident reporting, resilience testing and third-party risk.
For payments, PSD2 strong customer authentication and the Instant Payments Regulation's payee verification apply. AML follows the FATF Recommendations and EU law, with AMLA being established.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
A 90-day training plan
Weeks 1 to 4. All auditors learn the vocabulary. The head of audit maps each agent's capabilities, depth and certificate history.
Weeks 5 to 9. Pilot an audit of transaction monitoring dispositions. Test approvals, certificate currency across the period, and any injection attempts flagged in the record.
Weeks 10 to 13. Audit payee mismatch handling, write the standing programme, and record training in the training plan template for internal auditors.
Where the Academy fits
Pryme Intelligence Academy's free readiness assessment lets an audit team of up to 25 take the Foundations test set in retail banking; the report shows scores by concept and the gaps. Auditors who lead agent audits can then take the Operator track, whose module on keeping knowledge current covers how an agent's sources are maintained.
Questions people ask
Can an agent release a payment after a payee mismatch?
Only on the customer's own confirmation through an authenticated channel. The agent should never treat a message outside that channel as confirmation.
How often should audit test AML agents?
At least as often as the risk requires, and with certificate history checked across each sample period. Continuous testing from the record is practical.
Does the AI Act cover AML monitoring?
AML monitoring is not the creditworthiness use that Annex III lists, but Article 4 literacy applies to every agent the bank operates. The guide to AI agent skills by role shows who needs what.