US retail bank KYC analysts should train for review, not data entry. Agents can verify identity data, triage screening and draft due diligence notes; analysts must learn to judge those drafts, read held cases and record corrections. Suspicion, higher-risk approvals and account closures stay with them. Examiners will ask who decided, so a 90-day certification plan pays off.
What does KYC work look like at a US retail bank?
Account opening is mostly remote. A customer applies on a phone, the bank checks name, date of birth, address and taxpayer number against several data sources, and the analyst picks up the files where those sources disagree. Synthetic identities, built from a real number and invented details, are the persistent problem: each element looks plausible, and only the combination is wrong.
After opening, analysts handle sanctions screening alerts, beneficial ownership checks on the small business accounts that sit in many retail books, periodic reviews of higher-risk customers, and alerts from transaction monitoring that need a due diligence refresh. Each produces a file that an examiner may read years later.
Where can an agent help, and how far may it act?
- Identity discrepancy work, depth 1 then 2. The agent lines up the data sources, shows where they disagree and drafts a view on whether the pattern looks like a typo, a recent move or a synthetic identity. The analyst decides.
- Sanctions and screening triage, depth 2. For each alert the agent compares identifiers and drafts a disposition. Clear false positives can later move to depth 3 within narrow bounds, but only after the agent is certified on the bank's own alert history.
- Beneficial ownership on small business accounts, depth 2. The agent assembles ownership from state registry filings (signed by the registry) and the customer's certification (declared), and flags gaps.
- Refresh requests, depth 2. The agent drafts the outreach asking for updated information. A person sends it.
- Restrictions and closures, depth 4. Held every time. Closures are scrutinised, and the reasoning must be a person's.
Every verdict is filed in an append-only record, with the bound that decided it. For a bank that will be examined, that record is the point: it lets the analyst and the bank show exactly what the agent did and who approved it.
Why does the analyst remain the control?
Because the agent's output is only as good as the review behind it. An analyst who approves a drafted disposition without checking the identifiers has turned a control into a formality, and the examiner will find it. The argument is made fully in why KYC analysts are the real control in an AI agent deployment, and the review routine itself is in how KYC analysts review an AI agent's decisions.
What stays with the analyst is clear: the decision that activity is suspicious and the report that follows, approval of higher-risk customers, the judgement that an identity is synthetic, and any restriction or closure. Analysts must also keep the confidentiality around suspicion reports, which means the agent should never draft customer communications that hint at one. That and other red lines are listed in what KYC analysts should never let an AI agent do.
What should analysts learn?
Start with the vocabulary every reviewer needs: depth, the four verdicts, the five bounds and provenance. A taxpayer number confirmed by a trusted data source is not the same as one the customer typed in, and the agent's verdict will say which it relied on.
Then the review skills: reading a held case, agreeing with the reasoning rather than just the outcome, and spotting when the agent was right to hold under pressure from a branch or a customer. Finally, correction. A good correction says what was wrong and why, in a form the bank can use to adjust the agent's brief or sources; the method is in teaching KYC analysts to bank corrections.
Which US rules shape oversight and competence?
Federal anti-money-laundering rules require a customer identification programme, ongoing due diligence scaled to risk, beneficial ownership checks for legal entity customers and reporting of suspicious activity. The OCC, the Federal Reserve and the FDIC examine banks against them, and state regulators such as NYDFS do so for the banks they charter. Sanctions screening is a separate federal obligation.
Interagency model risk guidance SR 11-7 expects banks to validate models, understand their limits and govern their use. Banks should expect examiners to ask how it covers screening tools and agents, which makes certification on the bank's own cases and trained reviewers part of the answer. GLBA governs the privacy of customer financial information the agent reads, and state privacy laws such as California's CCPA as amended by the CPRA can apply too. The CFPB oversees how consumers are treated, including in account decisions.
Colorado has passed an AI act aimed at high-risk systems that make consequential decisions; a bank should check whether any of its account decisions fall within it. No single federal AI law exists.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
How should a US bank run the first 90 days?
Month one. Every analyst, team lead and the deputies of the bank's anti-money-laundering officer complete Foundations (about 4 hours). The agent runs at depth 1 alongside the team, and leads compare its discrepancy notes with analysts' own.
Month two. Analysts take the Operator modules on human review, teaching the agent and when something goes wrong. Screening dispositions move to depth 2. Leads sample twenty approvals a week and ask each analyst to name the bound that decided.
Month three. Analysts sit the written exam (40 questions in 60 minutes; 32 correct to pass) and complete the two-week practicum. The bank documents that only certified analysts approve held cases, which gives examiners a clear answer on competence. Use the training plan template for KYC analysts to record it, and see AI agent skills by role for the roles around the analyst.
Where the Academy fits
Pryme Intelligence Academy gives each analyst a Certified Pryme Operator certificate that anyone can check at source through VerifyDoc.ai, by number or QR code, with lapsed or revoked status shown on the same page. For a bank preparing for examination, that turns "our analysts are trained" into evidence. The certificate lasts 12 months and renews through an update module and a short quiz.
Questions people ask
Can an agent decide a customer's identity is synthetic?
It can flag the pattern and draft the reasoning. The conclusion, and what the bank does about it, should be an analyst's, because it often leads to a closure or a report.
Does SR 11-7 apply to an agent?
The guidance is about models used in banking decisions, and an agent that screens or rates customers relies on one. Banks should expect examiners to ask how it was validated and who reviews its output.
Should the anti-money-laundering officer take the Operator track?
The officer needs Foundations at least and usually Operator too, since they answer for the programme. If they also lead a multi-agent deployment, the Architect track fits.