Yes, once a KYC analyst's approval lets an agent's work count: clearing a screening hit, accepting a document, or setting a customer's risk rating. The deciding factor is what the approval releases. If the analyst only reads agent summaries, literacy is enough. If their sign-off turns a draft into a due diligence decision, they need a current certificate.
When does a KYC analyst's approval need a certificate?
Know-your-customer work sits under the FATF risk-based approach: due diligence is proportionate to risk, and the firm must be able to show why a customer was accepted. When an agent assembles the file, the analyst's approval is the moment the firm adopts that reasoning as its own.
Three conditions make a certificate worth requiring:
- The agent works at depth 2 or above, so it drafts dispositions or risk ratings that a person confirms.
- The analyst approves alone, without a second reviewer on routine cases.
- The approval changes a customer's status: onboarded, refreshed, restricted or exited.
If none of these holds, for example the agent only reads registry data and the analyst writes every decision themselves, training on the agent's limits is enough. The guide to AI literacy and certification sets out where that line usually falls.
What may the agent do, and what stays with the analyst?
| Task | Agent | Analyst |
|---|---|---|
| Collect and match identity documents | Depth 1 to 2: reads, extracts, flags mismatches | Accepts or rejects the document |
| Screen against sanctions and PEP lists | Depth 2: drafts a disposition for each hit | Clears or escalates every potential match |
| Propose a risk rating | Depth 2: drafts the rating with the factors used | Confirms or overrides, with a reason |
| Request missing information | Depth 3 within bounds: sends a templated request | Sets the template and the bounds |
| Exit or restrict a customer | Refused | Decides, with the MLRO where policy requires |
There is a provenance problem particular to KYC. A utility bill uploaded by the customer is declared. A registry extract is signed by the registry. A result from the firm's own identity check may be sealed. An analyst who cannot tell these apart will approve a file that rests on the customer's own word.
What should the certificate prove?
A certificate for a KYC approver should show four things, and attendance is not one of them.
- They can read the decision chain. Given a held disposition, they can say which bound held it: role scope, the agent's certificate, the sources, the firm's limits or the platform guardrails.
- They weigh sources by provenance. They know a declared address is not a verified one.
- They have practised on real decisions. A supervised period of live review, scored, with no missed red line such as clearing a true sanctions match.
- It is current and checkable. It carries an expiry date and a number anyone can verify at source.
For how neighbouring roles compare, see the same question answered for credit analysts and for fraud analysts.
What does this look like on a real case?
Take a mid-sized bank onboarding a small trading company. The agent extracts the directors from the registry, screens them and finds a partial name match on a sanctions list. It drafts a disposition, "likely false positive, date of birth differs", and a medium risk rating.
The certified analyst opens the hit and sees that the date of birth on the customer side is declared: typed by the applicant, not taken from a passport check. They hold the disposition, request the passport, and confirm the rating only after the match is cleared on verified data. An analyst approving fifty similar drafts a day without that habit would likely have accepted the agent's note.
Which controls make analyst approval safe?
- Approval rights tied to a current certificate. A firm can adopt the practice that only analysts with a current certificate approve depth 2 dispositions. When it lapses, their queue routes to a colleague.
- A structured practicum before solo approval. The guide to running a two-week practicum for KYC analysts gives a model, and the practicum log template for KYC analysts records each decision.
- Seeded cases. Occasional planted errors measure attention, not only throughput.
- Every approval filed. The record shows who approved, what the agent proposed and what the analyst changed.
Where the Academy fits
Pryme Intelligence Academy's Operator track is built for reviewers such as KYC analysts. It covers how a governed agent decides, human review and reading the workspace, with module tests set in the learner's own industry and role. Certified Pryme Operator needs a written exam and a two-week practicum of real review decisions with no missed red line, signed off by a Pryme assessor. It is valid for 12 months.
Questions people ask
Does the MLRO need the same certificate as the analysts?
Not necessarily. The MLRO sets policy, limits and escalation routes rather than working a queue, so training aimed at the people who design and own agents fits better. What matters is that the MLRO can explain the bounds the analysts work inside.
How often should KYC analysts be reassessed?
At least when the certificate expires, and sooner when the agent changes: new screening sources, a new depth or a new customer segment. The note on preparing KYC analysts for recertification covers what to refresh.
Can a contractor approve dispositions?
Only on the same terms as staff. Check their certificate at source before they get approval rights, and record that you checked.