Up to the decision. An AI agent can do most of the work of onboarding a business customer: collect documents, pull registry data, map ownership, screen directors and owners, and build the file. Accepting the business is a financial crime risk decision, so it stays with a named person, as do complex ownership and anything that does not add up.
Why is a business harder to onboard than a person?
A person is one identity. A business is a legal shell with people behind it, and the bank has to know who they are. Under the FATF Recommendations and the laws built on them, that means identifying the company, its directors, the people who ultimately own or control it, and what it actually does, then judging whether its expected activity makes sense.
Each of those steps can hide something. A director may be a nominee. An owner may be another company in another country, owned in turn by a trust. A business that says it sells furniture may have a website for something else. Our explainer on what KYB is covers the basic steps. The agent's value is in doing all of them, every time, and showing the person exactly where the gaps are.
What decides how far the agent goes?
The deciding factor is the risk the business presents and how clear the evidence is. A local partnership with two named partners, a plain trading address and expected activity that fits its sector is a simple file. A company owned through three layers of holding companies in different jurisdictions is not, however complete the paperwork.
The agent's job does not change with the risk. The depth of review does. For simple files, the person reviews a complete summary and approves. For complex ones, the agent's file is the start of an enhanced due diligence review.
What may the agent do, and what stays with a person?
| Step | The agent | Stays with a person |
|---|---|---|
| Collecting documents and application data | Requests and checks completeness, depth 2 | Accepting substitutes for required documents |
| Pulling registry records | Reads them and compares with the application | Explaining discrepancies |
| Mapping beneficial ownership | Builds the chain to the natural persons | Concluding who controls the business where the chain is unclear |
| Verifying directors and owners | Runs the identity checks | Overriding failed checks |
| Sanctions and politically exposed person screening | Runs screening and clears obvious false matches with reasons | True or possible matches |
| Checking the stated business activity | Compares with website, registry codes and expected volumes | Judging plausibility of unusual models |
| Risk rating | Proposes a rating with the factors | Setting the final rating |
| Accepting or declining | Never | A named person |
| Setting up signatories | Prepares the mandate from the board resolution | Confirming authority |
The same skills apply to merchants, where the risk is in card payments rather than deposits; see whether an AI agent can onboard merchants for a payments company.
An example: a simple-looking catering company
Take an application from a catering company with one director and a modest expected turnover. The application lists the director as the only owner.
The agent pulls the registry record. It shows the director, but the shares are held by a second company. That company's record shows two shareholders, one of whom is a person not mentioned in the application. The agent maps the chain, screens both people and finds no matches. It notes the gap between the application and the registry, requests a corrected ownership declaration, and holds the file.
The corrected declaration arrives and matches the registry. The agent updates the file and sends it to the onboarding analyst with a proposed rating of standard risk and the discrepancy history attached. The analyst approves. The record shows what the applicant first declared, what the registry showed and how the gap was closed.
What controls make it safe?
- Registry data as signed evidence. Company registry records outrank the applicant's declarations, which are recorded as declared.
- Ownership mapped to people. The file is incomplete until every route to control ends in a natural person or is explained.
- Screening decisions recorded. Each cleared match carries the reason it was cleared.
- No decision capability. The agent's role scope covers preparation; acceptance is held for a named person every time.
- Data about third parties handled carefully. Directors and owners are data subjects too; the agent collects only what due diligence needs.
The full process is set out in processing business account opening applications with an AI agent. Onboarding suppliers uses similar checks with a different purpose, covered in whether an AI agent can onboard new suppliers. The general limits are in AI agents in banking: what they may and may not do.
Questions people ask
Can the agent open the account once a person approves?
Yes. Setting up the account and mandate after approval is routine execution, at depth 3, from the approved file.
How does the agent handle trusts and foundations?
It identifies the settlor, trustees, beneficiaries and anyone with control, as the bank's policy requires. These structures nearly always go to enhanced review.
Can the agent decline an application with missing documents?
It can close an application the applicant has abandoned after the policy's reminder period. Declining a complete application on risk grounds is a person's decision.