Outdated records, powers of attorney for older customers and PEP screening are where Brazilian retail bank KYC analysts meet AI agents. Training covers provenance, held verdicts and calibrated judgement. Accepting a representative, restricting or exiting a customer stay with the analyst. Banco Central do Brasil, the LGPD and the ANPD shape oversight.
What does a KYC analyst at a Brazilian retail bank work on?
Large retail banks carry very large numbers of relationships built over decades, many with records that were last updated long ago. A large share of KYC work is refresh: updating addresses, income, occupation and contact details, and reclassifying risk when something has changed. Analysts work the cases that automated refresh cannot settle, such as customers who no longer answer or whose new information conflicts with the old.
Older customers bring particular risks. Retirees and pensioners are targeted for fraud through fake representatives, and many accounts are operated under powers of attorney. Analysts verify that a representative is genuine and the instrument is valid before accepting instructions. Screening for politically exposed persons and their relatives, and reviewing accounts flagged by monitoring, complete the workload.
Where do agents help, and at what depth?
Agents gather and draft. Each use runs at a depth proven on the bank's own past files.
- Record refresh campaigns (depth 3 within limits). The agent contacts customers through authenticated channels to confirm details and updates low-risk fields such as a changed email confirmed in the app.
- Power of attorney verification (depth 1). It reads the instrument, checks the notary's details and the validity dates, and lists anything the analyst must confirm.
- PEP screening notes (depth 2). It compares a hit with the customer's data and drafts a note. The analyst decides.
- Risk reclassification drafts (depth 2). When new information changes a customer's profile, it drafts the reclassification with reasons for the analyst to approve.
Our guide to what KYC analysts should learn before working with AI agents covers the basics behind these uses.
What must analysts learn, and what stays with them?
Provenance is the core skill. A change of address confirmed by the customer inside the authenticated app is signed by an identified customer. A power of attorney presented at a branch is declared until the notary's record is checked. A phone call from someone claiming to be a customer's child is external, and an external claim cannot authorise a change to the account. Analysts must read those stamps and apply them, because fraud against older customers often starts with exactly that call.
Calibration is the second. Analysts across regions and teams make different calls on borderline PEP hits and on whether a representative's documents are good enough. Regular calibration sessions for KYC analysts on anonymised cases keep decisions consistent, which matters because the agent learns from what analysts approve.
Correction is the third. When the agent misreads a type of notarial document, the fix should be banked against that source. Our guide on teaching KYC analysts to bank corrections explains the method. Pryme Intelligence Academy's Operator track covers the same skill in its module on teaching the agent.
What stays with the analyst: accepting a representative, high-risk reclassification, PEP decisions, restricting or exiting a customer, and escalating suspicious activity. Our piece on whether AI agents will replace KYC analysts explains why.
Which Brazilian rules shape oversight and literacy?
Banco Central do Brasil supervises banks and sets requirements on customer identification and record maintenance, AML and counter-terrorist financing, and internal controls. Banks must keep customer records current, and they report customer relationships to a central bank register. When agents run refresh campaigns or draft reclassifications, they operate inside those controls, and the bank stays accountable.
The LGPD governs customer data, with the ANPD supervising. It requires a legal basis and purpose for processing, data accuracy, and security, and lets customers request review of decisions made solely by automated processing that affect their interests. For older customers, the bank should also consider their vulnerability in how it communicates.
AML obligations follow the FATF Recommendations, with suspicious transactions reported to Brazil's financial intelligence unit. Pix matters for KYC too, since fraudsters target refreshed contact details to redirect Pix authentication.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What does a 90-day training plan look like?
Weeks 1 to 4. The KYC team learns depth, the minimum chain, provenance and the four verdicts. First use: power of attorney verification at depth 1.
Weeks 5 to 8. Three analysts review PEP screening notes in parallel with their own decisions and bank corrections. They rehearse a scenario where a caller claims to act for an older customer.
Weeks 9 to 13. Hold the first calibration session, sign the approver list, and decide whether refresh campaigns at depth 3 can be proven on the bank's own cases.
Questions people ask
Can an agent update a customer's phone number?
Only when the customer confirms it through an authenticated channel. A request from any other channel should be held for an analyst.
Who should check powers of attorney?
The agent can read and list checks at depth 1. Accepting the representative stays with an analyst.
What should analysts do when an older customer seems to be under pressure?
Pause the instruction, contact the customer directly through a channel already on file, and escalate if concerns remain. The agent can flag the signs; the conversation is a person's job. Our piece on why KYC analysts are the real control and the guide to AI agent skills by role say more.