Analysts in Dutch wealth management need to learn how an agent builds a KYC file, how to test its drafts and how to record why they disagree. The EU AI Act's literacy duty makes that training an obligation, not a courtesy. Agents map structures and draft narratives; analysts decide on control, credibility, acceptance and suspicion.
What does a wealth KYC analyst do at a Dutch firm?
Dutch wealth often sits in a personal holding company, sometimes with shares held through a trust office foundation that separates economic ownership from voting control. The analyst must work out who ultimately owns and who ultimately controls, which are not always the same person, and confirm both against the national register of ultimate beneficial owners and the client's own documents.
Clients are frequently cross-border: an entrepreneur who sold a business in Belgium, a family with property in Germany, an expatriate executive paid partly in shares. The analyst reads documents in Dutch, English and other languages, and must judge whether the source of wealth is credible across all of them.
Gatekeeping is taken seriously in the Dutch market. The analyst is expected to say no when the evidence does not support the story, and to record why.
Where do agents fit into the analyst's work?
- Structure mapping (depth 1). The agent reads the trade register extract, the beneficial ownership register entry and the client's chart, and draws the chain. Register data is signed by the registry; the client's chart is declared. Where the two disagree, the agent says so.
- Control analysis (depth 2). For foundation structures, the agent drafts a note on who holds voting rights and who holds economic interest. The analyst decides who counts as the controller.
- Source-of-wealth narrative (depth 2). The agent drafts the story of the wealth from sale agreements, tax assessments and annual accounts. The analyst tests it.
- Periodic review (depth 3 for stable, low-risk clients). Nothing material changed, so the agent completes the review within the firm's bounds. Any change in structure, residence or screening status is held.
- Declines and exits (depth 4). Always held for a named analyst.
What should never move to the agent?
The control judgement on a foundation structure, the credibility of a source-of-wealth story, acceptance of a politically exposed person, the decision that something is suspicious and any exit stay with the analyst. These are the calls a supervisor will attribute to a person, and the firm must be able to name that person and show they were trained. See what KYC analysts should never let an AI agent do.
There is a deeper reason too. An agent is consistent but literal; it will apply the brief it was given to every file. The analyst catches the case that does not fit, which is why KYC analysts remain the real control in an AI agent deployment.
What must the analyst learn?
How to review. Take a drafted narrative, check each statement against its cited document, look for the gap, decide. The method is in how KYC analysts review an AI agent's decisions.
How the agent decides. Depth, the four verdicts, the five bounds of the minimum chain, and why a withheld action is a platform decision that no firm setting changes.
How to correct. An override with a written reason can improve the agent's brief and sources; one without teaches nothing. See teaching KYC analysts to bank corrections.
How certification works. The agent is certified on the firm's own past files; that certificate lapses after 90 days, and a run that clears no depth drops the agent to depth 1 the same day.
Which rules apply in the Netherlands?
De Nederlandsche Bank supervises banks and other financial institutions, including their integrity and anti-money-laundering controls. The AFM supervises conduct and investment services, so the way an agent handles client communications and suitability-related information is within its reach. At EU level, the EBA and ESMA set guidelines, and the EU Anti-Money Laundering Authority (AMLA) is being established in Frankfurt.
The EU AI Act (Regulation (EU) 2024/1689) applies to deployers as well as providers. Article 4 requires them to take measures to ensure sufficient AI literacy among staff who operate and use AI systems, and Article 14 sets out human oversight for high-risk systems. Article 26 sets deployer obligations. For a KYC team, this means training analysts to understand the agent's capabilities and limits is part of compliance.
GDPR governs the personal data in the file. Article 22 restricts decisions based solely on automated processing with significant effects, which is one reason declines stay with a person, and Article 35 may require a data protection impact assessment. DORA applies to the firm's ICT risk management and third-party arrangements, including the agent platform. Dutch anti-money-laundering law, built on EU directives and the FATF Recommendations, requires due diligence scaled to risk and reporting of unusual transactions.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
How do you run the first 90 days?
| Weeks | Analysts | Agent | Evidence |
|---|---|---|---|
| 1 to 4 | Foundations, about 4 hours | Depth 1, shadowing | Completion records for the literacy file |
| 5 to 8 | Operator modules: human review, teaching the agent, keeping knowledge current | Narratives and control notes at depth 2 | Override log with reasons |
| 9 to 13 | Operator exam (pass at 32 of 40 questions) and two-week practicum | Low-risk reviews considered for depth 3 | Certificates and practicum sign-off |
A copyable version is the training plan template for KYC analysts. For the other roles in the firm, see AI agent skills by role.
Where the Academy fits
Pryme Intelligence Academy gives a Dutch firm evidence for its AI literacy file: Foundations badges stamped with the product version, Operator certificates valid for 12 months, and an admin view showing who holds what and when it expires. Each certificate can be checked at source through VerifyDoc.ai, and a lapsed one shows as lapsed on the same page.
Questions people ask
Is KYC a high-risk use under the EU AI Act?
KYC is not among the high-risk uses listed in Annex III, which does include credit scoring of natural persons. The literacy duty in Article 4 applies whatever the risk class, so training is needed either way.
Who counts as the controller of a trust office structure?
That is a judgement for the analyst under the firm's policy, based on voting rights, economic interest and actual influence. The agent can lay out the facts; it should not make the call.
Do relationship managers need training too?
They need Foundations, because they shape what reaches the agent and must understand why files are held. Certification is for those who approve held actions.