Yes, most of the work. An AI agent can collect identity documents, check them against each other and against trusted data, run screening, trace ownership and assemble the file. It must stop at judgement: accepting a high-risk customer, clearing a screening match, judging source of wealth and refusing a relationship stay with a named person.
What does KYC actually involve?
Know your customer is the process of confirming who a customer is, understanding what they will do with the account and assessing the risk they pose. Under the FATF Recommendations it sits within customer due diligence, applied on a risk-based approach: more checks for higher risk, fewer for lower. The basics are set out in what KYC is.
Most of the time goes on evidence. Collecting documents, chasing missing ones, reading them, comparing names and dates, searching registers, screening against sanctions and political exposure lists, and writing it up. The judgement at the end is often short. That is why the KYC bottleneck is evidence gathering, and agents can carry it.
What may the agent do with the customer's data?
| Task | The agent | Where it stops |
|---|---|---|
| Collecting documents | Requests, receives and chases them | Nothing routine |
| Checking identity documents | Reads them, compares details and checks against trusted data | Deciding a document is genuine when checks conflict |
| Screening | Runs sanctions, political exposure and adverse media screening | Clearing a possible match |
| Ownership and control | Traces ownership through registers and documents | Deciding who controls the company when records disagree |
| Source of funds and wealth | Gathers evidence and summarises it | Judging whether it is credible |
| Risk rating | Applies the approved risk model and shows the inputs | Overriding the rating; approving high-risk customers |
| Onboarding decision | Prepares the file | Accepting or refusing |
| Periodic review | Runs the refresh and highlights changes | Decisions on changed risk |
The customer's data is used for due diligence and kept under the bank's retention rules. The agent does not use it for anything else, and it does not share screening results with the customer where that would amount to tipping off.
A worked example
Take a business bank onboarding a small import company with two directors.
The agent collects the certificate of incorporation, the register of members and the directors' identity documents. It traces ownership: one director holds 60 shares, a holding company holds 40. It searches the register for the holding company, finds that it is owned by a trust, and requests the trust deed.
Screening returns a possible match for one director against a list of politically exposed persons. The agent compares date of birth, nationality and middle name; two of three match. It does not clear or confirm the match. It writes up both sets of details and holds the case.
The compliance analyst reviews the file, confirms the director is the brother of a local official, and applies enhanced due diligence under the bank's policy. The agent then gathers the extra evidence the analyst requests. A senior manager approves the relationship.
What controls make it safe?
- Judgement points are held. Possible matches, conflicting documents, high-risk ratings and refusals all go to a person.
- Source marking. Each fact in the file is marked with where it came from: a government register, a document the customer supplied, or an unverified external source.
- The approved risk model. The agent applies it; it does not invent its own weighting.
- Refresh with the same discipline. Periodic reviews follow the same rules; see KYC refresh with an agent: what stays with a person and the KYC refresh checklist for agent-assisted reviews.
- A complete file. Every check, including those that found nothing, is recorded, so an examiner can see what was done.
The wider limits for agents in banks are set out in AI agents in banking: what they may and may not do.
Where Pryme fits
In Pryme, each KYC task is a separate capability: collecting documents, screening, tracing ownership, drafting the file. Each is certified on the bank's own past onboarding cases through Attest. Clearing a match or approving a high-risk customer sits outside the agent's bounds, so those actions are held for a named person, and the verdict is filed.
Questions people ask
Can the agent onboard low-risk customers without a person?
Where the bank's policy allows simplified checks for low-risk customers, and every check passes cleanly, the agent can complete onboarding within those rules. Any exception sends the case to a person.
Can the agent refuse a customer who fails KYC?
No. Refusing or exiting a customer has consequences for them and may raise reporting duties. The agent prepares the file and a person decides.
Does the agent replace the money laundering reporting officer?
No. Reporting decisions and the accountability that comes with them stay with the designated person. The agent makes their evidence more complete.