Yes, for standard customers. An AI agent can carry out most of customer due diligence: identity checks, address and business verification, ownership tracing, screening and the risk rating under your model. Accepting a high-risk customer, overriding a rating, applying enhanced measures and declining a relationship stay with a person, because the firm's risk appetite rests on them.
What does customer due diligence involve?
Customer due diligence is the set of checks a firm runs to know who it is dealing with. Under the FATF Recommendations, and the national laws built on them, that means identifying the customer and verifying their identity, identifying beneficial owners, understanding the purpose and intended nature of the relationship, and monitoring it on an ongoing basis. The depth of the checks follows the risk.
Most of the work is evidence handling: requesting documents, checking them against each other and against independent sources, filling the gaps and recording the result. For a typical retail or small business customer, that work is routine and rule-bound. That is where the agent is most useful.
What evidence does the agent assemble?
- Identity: identity document checks, liveness or biometric results where used, and data matches against independent sources.
- Address and existence: proof of address for individuals; registry records, trading address and activity evidence for businesses.
- Ownership and control: beneficial owners traced and verified.
- Purpose and expected activity: what the customer says they will use the account for, checked for plausibility against their occupation or business.
- Screening: sanctions, PEP and adverse media results, with match resolution.
- Risk rating: inputs scored through your approved risk model, with each factor shown.
- Gaps and inconsistencies: anything missing, expired or contradictory.
For business customers the work is heavier, and the method is set out in how to run business customer due diligence with an AI agent.
What decision does a person keep?
| Outcome | Who decides |
|---|---|
| Standard customer, complete evidence, low or medium rating | The agent completes the file under policy; a person reviews by sample |
| Missing or inconsistent evidence | The agent requests it; a person decides if alternative evidence is acceptable |
| High-risk rating | A person decides whether to accept, and on what terms |
| Rating override, up or down | A person, with reasons |
| PEP or adverse media confirmed | A compliance officer |
| Enhanced due diligence | A person sets the measures and reviews the result |
| Decline or exit | A person |
Where the risk rating comes out high, enhanced due diligence applies, with more evidence, more scrutiny and senior approval. The agent can gather the extra evidence, using the enhanced due diligence checklist as its brief. It cannot make the decision the extra evidence exists to inform.
What does a CDD file look like?
Take a business bank onboarding a small online retailer. The director applies online.
The agent verifies the director's identity, confirms the company on the registry, and finds the registered address is a formation agent's address. It asks for a trading address and gets a warehouse unit lease. It traces ownership to the director and her husband, each at half. Screening is clear. The stated expected turnover is modest, consistent with the website's product range and the company's first-year accounts. The risk model rates the customer low.
The agent completes the file and opens the account under policy, with the formation agent address noted. A month later, a sample review by a person agrees with the file. Had the model rated the customer high, for example because the products shipped to high-risk countries, the file would have gone to a person for a decision before any account was opened.
Which controls make agent CDD acceptable?
- The model is approved, not improvised. The risk rating comes from your validated model. The agent does not invent factors.
- Evidence provenance is visible. Documents the customer uploaded are distinguished from data confirmed with an issuer or registry.
- Thresholds are policy. Which cases the agent may complete, and which go to a person, are written down and enforced.
- Samples are reviewed. A person checks a sample of agent-completed files, including low-risk ones.
- Refresh is triggered by events. The agent re-runs due diligence when something material changes, not only on a fixed cycle.
How these map to the international standard is in FATF customer due diligence with AI agents. The general principle is in our guide to AI compliance agents.
Questions people ask
Can the agent decline an applicant whose identity fails verification?
It can stop the application and explain what is needed. A final decline, especially where the person may be genuine but has unusual documents, should be made by a person.
Does the agent need to see the documents, or just the results?
It needs enough to check consistency, such as names, dates and addresses. Full images can stay with the verification service unless a person needs them.
How does ongoing due diligence work with an agent?
The agent watches for triggers such as changes in activity, ownership or screening results, and refreshes the file. Material changes go to a person.