UK business banks can give AI agents the evidence work: reconciling Companies House and PSC records, building due diligence files, triaging alerts on SME accounts and drafting suspicious activity reports and defence requests. The MLRO and analysts keep every decision to onboard, exit or report. The FCA, PRA, SM&CR and UK GDPR shape how far the agents go.
What occupies a UK business banking compliance team?
Small and medium businesses make up most of the book, and most of them are private limited companies on the Companies House register with a persons with significant control entry. The register is useful and imperfect. Analysts compare it with what the customer declares, report material discrepancies, and ask for more when a PSC entry looks like a placeholder.
Monitoring is where volume lives. SME accounts generate alerts for cash, third-party payments and rapid movement, and analysts read context across the core banking system, the relationship manager's notes and past alerts before closing or escalating.
When an analyst suspects proceeds of crime and the customer wants to make a payment, the bank may need a defence against money laundering from the UK financial intelligence unit before it proceeds. Those requests are time-critical and must be precise. Periodic reviews, customer exits and preparing the MLRO's annual report take the remaining time.
Where can an AI agent do useful work?
- Companies House and PSC reconciliation (depth 1). The agent compares the register, the PSC entry, filed accounts and the customer's declaration, and lists differences with sources. It flags signs that the register entry may be unreliable, such as frequent officer changes or a formation-agent address.
- Due diligence file drafting (depth 2). The agent drafts the file and the information request for an analyst to approve. Our playbook on running business customer due diligence with an AI agent covers the sequence.
- Alert triage (depth 2). The agent drafts a disposition with the evidence it relied on, and the analyst decides.
- SAR and defence request drafting (depth 2). The agent drafts the suspicious activity report or the defence request, setting out the property, the suspicion and the proposed transaction. The nominated officer's team edits and submits.
- Business-wide risk assessment inputs (depth 2). The agent drafts sections from portfolio data. See how to run the business-wide AML risk assessment with an AI agent.
Defence request drafting is the one to treat with most care. A vague request delays the customer and the bank; a precise one gets a decision. Certify it separately on past requests, and keep every draft held for the nominated officer.
What stays with people, and why?
The MLRO holds a senior management function under SM&CR, with personal accountability for the bank's AML systems. That accountability does not transfer to an agent. Filing a SAR, deciding not to file, requesting a defence and deciding whether to proceed while one is pending all stay with named people.
Tipping off is a criminal offence, so the agent must have no path to tell a customer anything about a pending report or defence request. Any customer message on an affected account is held for compliance, and an attempt to send one directly is refused and filed.
Exits stay human too. Closing an SME's accounts can stop it trading, and the bank needs to show a consistent, reasoned decision. Our view of AI compliance agents as second line, never the last word applies most strongly here.
Which UK rules apply?
The UK takes a principles-based, regulator-led approach to AI rather than a single AI law. The FCA supervises conduct and financial crime systems; the PRA, part of the Bank of England, supervises banks prudentially. SM&CR assigns named accountability, so each agent needs an accountable owner who is or reports to a senior manager. Our guide on who should own an AI agent in a business covers how to assign it.
PRA SS1/23 sets model risk management principles for banks. Treat an agent that drafts alert dispositions as a model: inventory it, validate it, monitor it and govern changes. The PSR oversees payment systems, including the reimbursement regime for authorised push payment fraud, which reaches micro-enterprise customers.
UK GDPR and the Data Protection Act 2018 apply to directors, PSCs and signatories, with the ICO as regulator. Keep the agent in your records of processing and assess whether a data protection impact assessment is needed. See how AI agents are regulated in the United Kingdom for the full picture.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What should the first 90 days cover?
First month: name the accountable owner under SM&CR, register the agent in the model inventory under SS1/23, and agree the data protection position.
Second month: run Companies House and PSC reconciliation at depth 1 on closed files, then compare against analysts' conclusions. Include files where a discrepancy report was made.
Third month: trial SAR and defence request drafting at depth 2 on historical cases, scored by experienced reporters before any live use. Alert triage can follow once those results are in.
Where Pryme fits
Pryme gives the MLRO a filed verdict for every agent action, naming the bound that decided it, which is the evidence SM&CR accountability needs. Attest certifies defence request drafting separately from alert triage, on the bank's own past cases. Certificates lapse after 90 days, so re-certification is built into the model monitoring cycle.
Questions people ask
Can an AI agent submit a SAR?
It should draft, not submit. The nominated officer decides whether a disclosure is required and what it says, and submission stays with that function.
Does the Consumer Duty apply to business banking compliance agents?
The Consumer Duty is about retail customers, so most business banking falls outside it, but some small business customers may be in scope depending on the product. Check scope with your compliance and legal teams.
How does the UK compare with the United States?
Both rely on existing regulators rather than an AI law, but the US model risk guidance and AML regime differ in detail. See our brief on compliance agents in US business banking.