Customer risk decides who approves what in an onboarding approver authority matrix. An AI agent may open simple, low-risk accounts at depth 3 within tight bounds; medium-risk accounts need a KYC analyst; high-risk customers, politically exposed persons, document waivers and rejections need seniors or the onboarding manager, often with a second approver.
Why organise onboarding approvals by risk?
Because customer due diligence is risk-based. The FATF Recommendations expect firms to apply more scrutiny to higher-risk customers, and most firms already rate customers at onboarding. The approver matrix follows the rating: the higher the risk, the more senior the approver and the less the agent does on its own.
The agent's work is mostly evidence. It reads the application at depth 1, compares documents and checks at depth 1, drafts requests for missing information and a risk rating at depth 2, and in many firms opens accounts for simple, low-risk customers at depth 3. That last step is the one the matrix must bound most carefully: what counts as low risk, which evidence must be signed or sealed rather than declared, and what forces a hold.
How do you fill it in?
- Copy your customer risk rating scale into the rows.
- Add rows for the decisions that cut across risk levels: waivers, rejections, exits during onboarding.
- Set the agent's depth for each.
- Name the approver and second approver.
- State the minimum evidence: which facts must be signed or sealed before approval.
- Record the certificate approvers must hold, if your firm ties approval rights to certification.
The template
| Onboarding decision | Agent depth | Approver | Second approver when | Minimum evidence | Always held if | Certificate |
|---|---|---|---|---|---|---|
| Open low-risk account | ||||||
| Open medium-risk account | ||||||
| Open high-risk account | ||||||
| Approve politically exposed person | ||||||
| Sign off enhanced due diligence | ||||||
| Waive a document requirement | ||||||
| Reject an application | ||||||
| Close during onboarding |
A worked example
A hypothetical e-money firm onboarding personal and small business customers: fifteen KYC analysts, four seniors, an onboarding manager and a reporting officer.
| Decision | Agent depth | Approver | Second approver when | Minimum evidence | Always held if | Certificate |
|---|---|---|---|---|---|---|
| Low-risk account | 3 | None; daily sample by analyst | n/a | Identity verified by a signed check | Any screening hit | n/a |
| Medium-risk account | 2 | KYC analyst | Business with complex ownership, senior | Identity signed; address signed or sealed | Adverse media | Operator |
| High-risk account | 2 | Senior analyst | Always, onboarding manager | Source of funds evidenced | n/a | Operator |
| Politically exposed person | 2 | Onboarding manager | Always, a senior manager | Source of wealth evidenced | n/a | Operator |
| EDD sign-off | 2 | Senior analyst | High risk, manager | All EDD questions answered with evidence | n/a | Operator |
| Document waiver | 1 | Onboarding manager | None | Alternative evidence named | n/a | Operator |
| Rejection | 2 | KYC analyst | Suspicion indicated, reporting officer | Reason recorded | n/a | Operator |
| Close during onboarding | 2 | Senior analyst | None | Reason recorded | Suspicion indicated | Operator |
Low-risk openings at depth 3 require identity verified by a signed check, from an identity provider that answers for its result. A passport photo uploaded by the applicant alone is declared and does not meet the bar; the agent holds those for an analyst.
If the opening agent's certificate lapses after 90 days, every low-risk application becomes a held item for analysts until it is recertified. The reviewer rota for the onboarding team should show lapse dates and extra cover.
Rejections where suspicion is indicated go to the reporting officer as well as the analyst. The rejection message the agent drafts must not reveal why, so the analyst reads it for tipping-off risk before sending.
Second-line oversight of these limits sits in the approver authority matrix for the risk team. Detailed thresholds belong in the approver rule for the onboarding team. The concept of an authority matrix is general; onboarding's version is driven by customer risk.
Where the Academy fits
Pryme Intelligence Academy's Operator track trains KYC analysts and seniors to decide held onboarding cases on the real product, with tests set in their own industry and role. Its practicum requires no missed red line across two weeks of real decisions. The public register lets an auditor confirm each approver was certified on the date they approved.
Questions people ask
Can the agent approve a politically exposed person if the evidence is strong?
No. These customers always go to the onboarding manager and a second senior person, whatever the evidence. The agent assembles the file. The skills each role needs are in AI agent skills by role.
Who samples the agent's low-risk openings?
A KYC analyst each day, with results reviewed weekly by a senior. Errors in the sample should trigger a review of the agent's bounds.
What if a customer complains about a rejection?
A senior who did not make the original decision reviews it, using the record of what the agent drafted and who approved it.