Compliance teams drown in volume, not in difficulty. Most alerts are false positives, most screening hits are name collisions, and most of an analyst’s day goes on assembling the evidence for a decision that takes a minute once the file is complete. That is exactly the work an agent should take. The decision itself is not.

Three lines, kept apart

Regulated firms organise control in three lines: the business runs the risk, compliance oversees it, and internal audit checks both. An agent that does first-line work cannot also be the second-line check on that work. In our model, a compliance agent sits in the second line, and its role can never move money or reach consumer messaging, so it can never release what it reviewed.

What a compliance agent does

• Alert triage preparation. For each transaction-monitoring alert, it assembles the customer profile, the pattern and the history, and drafts a finding with the rule that triggered it.
• Screening review. For sanctions and adverse-media hits, it compares the identifiers and writes why the hit is or is not a match.
• KYC file review. It checks files against the policy and lists exactly what is missing.
• Regulatory change. It reads new circulars and guidance, maps them to the policies they touch, and drafts the change for the policy owner.

What it does not do

Certified to draft, it does not file a suspicious transaction report, clear a sanctions hit, close an alert as a false positive on its own authority, or approve a customer. Each of those waits for the named officer whose decision it is. The agent’s draft makes that decision faster; it does not make it.

Every finding cites its source

A finding without a citation is an opinion. The agent cites the policy clause, the regulation or the data point behind each conclusion, and when no approved source covers a question it says so plainly. That gap is often the most useful thing it reports: it shows the policy owner where the policy has not caught up with the business.

Learning without retraining

We never update a model’s weights on a customer’s data. A compliance agent improves through qualification: it is scored against your own filed decisions, and a depth is granted when it meets the bar. That keeps your data yours and keeps the agent’s behaviour explainable.

Why the separation matters

The three lines exist because people marking their own work miss things. An agent is no different. If the agent that drafted a customer onboarding decision also reviews it for compliance, its errors are reviewed by the same reasoning that made them. Keeping the compliance agent out of the first line is not a technicality; it is the only way its review adds anything.

In our model part of this is enforced by role: a Compliance agent can never move money, whatever its configuration. The rest is the depth you certify it to.

What the record shows a regulator

For each alert the agent touched, the record holds:

• The alert, the data the agent read, and the sources it cited.
• The finding it drafted, word for word.
• The named officer who decided, what they decided, and when.
• Any case where the officer disagreed with the agent, which feeds the next round of qualification.

When a regulator asks how a decision was reached, the answer is a query against that record rather than a reconstruction from emails.

Model risk, applied to agents

Banks already manage models under model risk management guidance from their supervisors: validate before use, monitor in use, control changes. Agents fit that discipline if their authority is treated the same way. Certification is the validation, scored against the bank’s own cases. The record is the monitoring. A lapse date and re-certification are the change control. A compliance agent that cannot show all three should not be in the second line.

Where to start

Start with alert triage preparation for transaction monitoring, where volume is highest and every output is already reviewed by a person. Measure how often the officer accepts the agent’s draft unchanged, and how long each decision takes. Screening review and KYC file checks usually follow within a quarter.

Questions people ask