AI agents for compliance teams in business banking in Australia

Compliance teams in Australian business banking can use AI agents to map trust and company structures, assemble know-your-business files, triage transaction monitoring alerts and draft suspicious matter reports for review. People keep every decision to onboard, exit or report a customer. APRA's CPS 230, ASIC's conduct expectations and the Privacy Act 1988 frame how the agents run.

What does a business banking compliance team in Australia spend its time on?

Most of the week goes on business customers whose ownership is not obvious from the application. A plumbing firm may be run by a corporate trustee of a discretionary family trust, whose beneficiaries are described as a class rather than a list of names. Working out who controls it means reading the trust deed, the company extract and the ABN record, then reconciling all three.

The rest is ongoing due diligence and monitoring. Alerts on business accounts are noisy because legitimate businesses move money in irregular patterns: a builder paid in stage payments, a café banking takings daily, an importer paying overseas suppliers. Analysts clear most alerts after reading context spread across several systems, and write up the ones that need a suspicious matter report within the time the AML/CTF regime allows.

Periodic reviews, sanctions screening on trade payments, answering information requests from the financial intelligence agency and preparing evidence for internal audit fill the gaps.

Where can AI agents help?

Agents help where the work is reading, cross-checking and drafting. Each use below runs at a set depth, and that depth is earned on the bank's own past files rather than switched on.

• Trust and company structure mapping (depth 1). The agent reads the trust deed, company extract and ABN record and produces an ownership map with every source cited. It flags where the deed lets the trustee add beneficiaries, so the analyst knows the map is a snapshot, not a settled answer.
• Know-your-business file assembly (depth 2). The agent drafts the due diligence file and the request for missing documents. A person sends it. Our guide to running business customer due diligence with an AI agent sets out the steps.
• Alert triage (depth 1 to 2). The agent pulls account history, invoices on file and prior alerts, then drafts a disposition with its reasoning. The analyst closes or escalates.
• Suspicious matter report drafting (depth 2). The agent drafts the narrative and the grounds for suspicion. It never lodges a report.
• Periodic review chasing (depth 3). Within limits the bank sets, the agent sends standard document reminders on refresh cycles and logs replies. It cannot change a risk rating.

What stays with a person, and why?

Every decision with a legal consequence stays with a named person: onboarding a high-risk business, exiting a customer, lodging a suspicious matter report, and deciding not to lodge one. The reasoning matters as much as the outcome. A regulator reviewing a missed report will ask who decided, on what information, and when.

Tipping-off risk is a second reason. A business under suspicion must not be warned, so an agent that drafts customer messages needs a hard stop on anything touching a live investigation. That action is refused for the agent, and the attempt is filed so compliance can see it. This is the logic behind treating AI compliance agents as second line, never the last word.

Customer exits stay with people too. Closing a small business's accounts affects its ability to trade, and the bank needs a consistent reason it can defend, not a model output.

Which rules apply in Australia?

Australia has no single AI law. It relies on existing regimes, and the government has published a voluntary AI safety standard covering accountability, testing and human oversight. Our overview of how AI agents are regulated in Australia covers the wider picture.

For a bank, APRA's CPS 230 on operational risk management reaches the agent as part of a process and its supplier as a service provider. Expect to show which critical operations the agent touches, how it is monitored, and how you would keep operating if it were withdrawn.

ASIC supervises conduct, including the treatment of small business customers. The AML/CTF regime, supervised by the national financial intelligence agency, puts customer due diligence, ongoing monitoring and suspicious matter reporting on the bank, never on a tool it uses. FATF's risk-based approach sits behind it.

The Privacy Act 1988, overseen by the OAIC, applies to the directors, beneficial owners and signatories whose personal information the agent reads. Our piece on Australia's Privacy Act and AI agents covers collection, use and disclosure overseas.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

How should you start in the first 90 days?

Start with trust and company mapping at depth 1. It is read-only, the output can be checked against the deed, and it saves analyst hours on the hardest files. Take a sample of recent onboarding files, including discretionary trusts and multi-layer company groups, and compare the agent's map to what your analysts concluded.

By day 60, add alert triage at depth 1 on one high-volume, low-severity scenario, such as cash deposits by retail businesses. Measure agreement with analysts and record every disagreement and its cause.

By day 90, decide whether drafting at depth 2 is earned for due diligence files, with the CPS 230 documentation written: the agent as a process, its supplier as a service provider, the fallback if it is withdrawn. Name the senior owner before the agent goes live, not after.

Where Pryme fits

In Pryme, each agent is certified by Attest against the bank's own past files, so trust mapping can run at depth 1 while alert drafting is still being proven. Certificates lapse after 90 days, and a run that clears no depth drops the agent to depth 1 the same day. Every verdict, including refused attempts near a live investigation, is filed in an append-only record.