Most of a KYC analyst's judgement is about evidence: is this document genuine, and does this person or company match it? Once an agent reads the documents and drafts the due diligence file, the analyst judges the agent's evidence instead. That is why KYC analysts should be certified before agents go live, not after the first backlog clears.
Which parts of KYC does an agent take on?
Customer due diligence is repetitive and document-heavy. The analyst collects identity documents, proof of address, company registration details and ownership structures. They screen names against sanctions and politically exposed person lists. They assess risk, ask about source of funds where needed, and decide whether to onboard, decline or escalate. Periodic reviews repeat much of this for existing customers.
A governed agent fits most of the repetition. At depth 1 it reads uploaded documents, registry data and screening results. At depth 2 it drafts the due diligence file, the risk rating and any questions to the customer. In some deployments it may clear a narrow class of screening alerts at depth 3, for example where a name hit has a different date of birth and nationality, once Attest has proven it does this correctly on the firm's own history. Onboarding decisions on higher-risk customers, every probable sanctions match and every decline stay held for a named analyst.
Why is provenance the centre of KYC review?
KYC is the place where the Pryme Context Protocol's classes matter most. A passport image uploaded by the customer is declared: it states something, but nobody has vouched for it. A company registry extract retrieved directly from the registry may be signed, because an identifiable party answers for it. A document forwarded by email from a third-party introducer is external.
The agent records the class of every fact in the file. But a finished file looks complete whatever mix of classes sits beneath it. An analyst reviewing it must ask, for each critical fact, how strong the evidence actually is. Is the ownership chart built from signed registry data, or from a diagram the customer drew? Is the source of funds declared in a form, or supported by a statement the bank itself holds?
A certified analyst asks that by habit. An uncertified one reads the risk rating at the top and checks it seems reasonable.
What should an analyst never let the agent decide?
Some decisions sit outside any sensible depth for an onboarding agent:
- A probable sanctions match. Discounting a real hit is a serious failure, so every probable match goes to a person.
- A decision to decline or exit. The firm must be able to explain it, and in many cases it touches financial inclusion.
- Acceptance of a higher-risk customer. Enhanced due diligence and senior sign-off are human decisions.
- Anything resting only on declared or external evidence where the firm's policy needs more.
The agent will hold these. The analyst must understand that the hold is the agent doing its job, and that it is their job to decide, not to clear the queue.
What should KYC certification prove?
For this role, the certificate should demonstrate that the analyst can trace each key fact in a file to its source and class, find the gaps an agent's draft cannot show (a missing director, an expired document, a beneficial owner who appears only in a footnote), read the reason a case was held, and record their own reasoning for every acceptance of a higher-risk customer.
The practicum is where this becomes visible. Two weeks of real onboarding decisions, scored by an assessor, show whether the analyst opens the evidence or trusts the summary. The practicum log template for KYC analysts gives a structure for recording each decision and the evidence checked.
On whether a certificate should be a condition of approving onboarding, see whether KYC analysts need a certificate to approve agent actions. A firm can adopt that practice capability by capability, so that only certified analysts approve held onboarding cases.
What is the trade-off?
Onboarding backlogs cost revenue and frustrate customers, and they are often the reason a firm buys an agent. Delaying go-live to certify analysts prolongs the backlog.
The answer is sequencing. Let the agent read and draft from the first day: assembling files at depth 2 already saves most of the time. Analysts review every draft, which is itself practice on real cases. Allow the narrow depth 3 screening clearances only once the analysts who sample those clearances are certified.
There is also the matter of scale. KYC teams can be large and include contractors. Certifying everyone takes organisation. But KYC failures are visible to supervisors and expensive to remediate, often requiring a lookback over thousands of files. A short delay at launch is cheaper than a lookback.
And the record will show which analyst approved each customer. The question of whether KYC analysts are accountable for an agent's mistakes is easier to answer for analysts who were trained to see what the agent could not.
How does KYC certification fit with fraud and credit?
Onboarding is upstream of most financial crime and credit risk. A weak KYC decision becomes a fraud case for fraud analysts or a bad application for credit analysts. Certifying all three creates consistent judgement at each handover, and makes it easier to trace where a problem entered.
What should a head of onboarding do now?
Write analyst certification into the go-live plan. Keep probable sanctions matches, declines and higher-risk acceptances held for certified analysts. Train specifically on provenance classes using the firm's own document mix. Keep certificates and practicum logs where a supervisor can review them. The guide to AI literacy and certification for people who work with agents explains how the levels fit together.
Questions people ask
Can an agent verify an identity document on its own?
It can check a document's features and compare it with other evidence, and record the result with its provenance class. Whether that is enough to onboard depends on the firm's policy and the customer's risk, and higher-risk cases stay with a person.
Should periodic reviews be handled differently from onboarding?
The same skills apply, but periodic reviews add the question of what has changed. Analysts should check whether the agent compared the current file with the previous one, not just rebuilt it.
What happens to held onboarding cases if few analysts are certified?
They wait, and the queue grows. Plan certification capacity before go-live so that the number of certified analysts matches the volume of held cases you expect.