KYC analysts at Dutch payment and e-money institutions need training to review AI agents that verify merchants across EU markets, map ownership from trade register data and draft screening dispositions. Core skills: provenance, held verdicts and banking corrections. Onboarding, true-match and exit decisions stay with them. DNB, the AFM, GDPR, DORA and the EU AI Act frame oversight.
What does a KYC analyst at a Dutch payments firm do?
Many payment and e-money institutions licensed in the Netherlands serve merchants and consumers across the EU from one Dutch licence. A KYC analyst may review a German online shop in the morning and a Spanish marketplace seller after lunch, each with company documents in a different language and format. Analysts verify the business, identify ultimate beneficial owners, assess the business model and expected volumes, and decide what level of due diligence applies.
Dutch supervisors have pressed hard on the integrity side of payments, and institutions have invested in customer due diligence and transaction monitoring accordingly. Analysts refresh files for higher-risk merchants, respond to monitoring escalations, and handle screening hits against sanctions and politically exposed persons lists.
Where do agents help, and at what depth?
Agents take the gathering and first drafting. Each use runs at a depth proven on the institution's own past files.
- Cross-border company verification (depth 1). The agent retrieves company data from the relevant official registers, translates key fields and compares them with the application.
- Ownership mapping (depth 1). It drafts an ownership chart from register extracts and shareholder documents, citing each source.
- Business model review (depth 1). It reads the merchant's website and terms and compares them with the declared activity and the institution's restricted list.
- Screening disposition drafting (depth 2). It drafts a note on each hit. The analyst decides.
Our guide on how KYC analysts review an AI agent's decisions shows how to work through these drafts efficiently.
What must analysts learn, and what stays with them?
Provenance across markets is the first skill. An extract retrieved from an official register is sealed. A shareholder list provided by the merchant is declared. A translation produced by the agent is a derived reading of a sealed source, and the analyst should check key fields against the original when they matter. Analysts who understand those distinctions can decide quickly where to spend their time.
Verdicts are the second. Every agent action meets five bounds, role scope, certificate, sources, the institution's limits and the platform guardrails, and the lowest wins. A held draft names the analyst and the bound that held it. Analysts should learn to read that name: "held on sources" means the evidence was not strong enough, which is a different problem from "held on limits".
Correction is the third. When the agent misreads a register format from one country, the fix should be banked against that source so it holds for every later merchant from that market. Our guide on teaching KYC analysts to bank corrections explains how. Pryme Intelligence Academy teaches this in its Operator track, in the module on teaching the agent.
What stays with the analyst: onboarding and declining higher-risk merchants, true-match decisions, exits, and escalation for reporting. Our piece on whether AI agents will replace KYC analysts explains why.
Which Dutch rules shape oversight and literacy?
De Nederlandsche Bank licenses and supervises payment and e-money institutions, including their integrity controls on AML and sanctions. The AFM supervises conduct. AML obligations come from EU law and the FATF Recommendations, and AMLA is being established in Frankfurt to strengthen EU-level supervision. When agents prepare KYC decisions, the institution stays accountable and analysts must be able to explain them.
GDPR governs personal data of merchants' owners and directors and of consumers. Article 22 restricts solely automated decisions with significant effects, such as refusing to onboard someone, and Article 35 requires impact assessments for high-risk processing. The Dutch data protection authority supervises. The EU AI Act requires AI literacy among staff operating AI systems under Article 4. DORA applies to payment institutions, covering ICT risk, incidents, testing and third-party risk, including the agent provider.
PSD2 strong customer authentication and the Instant Payments Regulation's payee name verification shape the payment side that KYC data feeds.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What does a 90-day training plan look like?
Days 1 to 30. The KYC team learns depth, the minimum chain, provenance and verdicts. First use: cross-border company verification at depth 1, starting with the three markets the institution onboards most from.
Days 31 to 60. Two or three analysts review screening dispositions in parallel with their own, logging disagreements and banking corrections. Completion is recorded as Article 4 evidence.
Days 61 to 90. Calibrate on anonymised merchant files, sign the approver list, and decide whether ownership mapping is ready to support more markets. The training plan template for KYC analysts gives the structure.
Questions people ask
Can an agent translate foreign company documents for KYC?
It can, and the translation is useful for triage. For decisive facts, such as who controls the company, analysts should check against the original or a certified source.
Does Article 22 stop agents from rejecting applicants?
It restricts rejections made solely by automated means. Keeping the decision with an analyst who reviews the evidence avoids that problem.
How should analysts handle a merchant from a market the agent has not seen?
Treat it as a new source: check the register output by hand, bank corrections, and keep the agent at depth 1 for that market until it is proven. Our piece on why KYC analysts are the real control and the guide to AI agent skills by role say more.