KYC and onboarding agents gather documents, check identities and recommend whether to accept customers. Article 14 of the EU AI Act binds only high-risk systems, and most onboarding agents are not, unless they use biometric identification. Yet a wrong refusal shuts someone out of banking and a wrong acceptance lets risk in, so onboarding staff need its competence anyway.
What does Article 14 require, and when does onboarding fall inside it?
Article 14 requires that high-risk AI systems be overseen by people who can understand their capacities and limitations, monitor operation, stay aware of automation bias, interpret output, override or reverse it, and intervene or stop it. Article 26 requires deployers to assign oversight to people with competence, training and authority.
Onboarding agents meet the high-risk categories in two ways. Remote biometric identification of people is treated as high-risk, though biometric verification whose only purpose is confirming that someone is who they claim to be is excluded. And if the onboarding agent also assesses creditworthiness of an individual, for example to set a credit limit on a new card, that part is high-risk. A plain document-checking agent usually falls outside.
Two other duties apply regardless. AML rules built on the FATF Recommendations require customer due diligence on a risk-based approach, and the decisions stay with the obliged firm. The GDPR applies to identity data, and an automated refusal to open an account may engage Article 22. The EU's AML Authority, being established in Frankfurt, will add a supervisory layer for AML across the Union.
Who needs oversight competence?
- Onboarding analysts who decide held applications.
- KYC and due diligence specialists who handle enhanced due diligence cases.
- AML officers who decide on high-risk customers and suspicious activity.
- Onboarding operations managers who set the agent's bounds and monitor throughput.
This reaches beyond banks. Telecoms operators register customers, law firms run client due diligence, and both use agents for it; see how telecoms operators prove staff are trained to oversee AI agents and how law firms prove it.
Where does an onboarding agent need a person?
A governed onboarding agent might:
- Depth 1: read submitted documents, screening results and registry data.
- Depth 2: draft the due diligence summary, risk rating rationale and requests for more information.
- Depth 3: approve low-risk applications where every check passes on strong evidence, within the firm's own limits.
- Held: refusals, enhanced due diligence cases, screening matches, politically exposed persons and anything where checks disagree. A named analyst decides.
Three things make onboarding oversight distinctive.
Evidence quality is the whole job. A company's registration confirmed directly from an official registry is a signed fact. A director's address stated on the form is declared. A utility bill uploaded as a scan is external. The agent's recommendation is only as strong as the weakest fact it relies on, and analysts must see that at a glance.
Screening matches need judgement. A sanctions or adverse media match on a common name is usually a false positive, sometimes not. The agent can rank and explain matches, but the decision to clear or escalate belongs to a trained person.
Refusals have lasting effects. Refusing an account can exclude someone from basic financial services. Analysts must be trained to ask whether a refusal rests on risk or on missing information that a request could fix.
Competence, authority and intervention in onboarding
Competence. Analysts know the agent's certified depth and the depth each action needs, the firm's risk appetite and the due diligence the law requires. They can read the record behind a held application, see each fact's provenance and the bound that held it, and explain their decision.
Authority. Analysts can approve against the agent's recommendation within their mandate, request more information instead of refusing, or escalate. AML officers have the final word on high-risk customers. Throughput targets must not override that authority.
Intervention. Operations managers can suspend the agent's depth 3 approvals, for example if a new pattern of forged documents appears. Because an agent's certificate lapses after 90 days and a run that clears no depth drops it to depth 1 the same day, the firm must be able to onboard manually at short notice, or tell applicants plainly that it will take longer.
How do you meet the Article 14 standard in KYC and onboarding?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Overseers understand limits | Training on the agent's checks, depths and known weak document types | Training and assessment records |
| Awareness of automation bias | Seeded applications with subtle forgeries and false screening matches | Results on seeded cases by analyst |
| Correct interpretation | Analysts read provenance for each fact before deciding | Decision notes citing evidence |
| Power to override | Analysts approve or request information against the agent within mandate | Overrides with reasons |
| Ability to stop | Managers can suspend automatic approvals | Suspension events and triggers |
| Customer due diligence (FATF-based AML rules) | Enhanced cases always held for a specialist | Due diligence files with specialist sign-off |
| Competent people assigned (Article 26, where high-risk) | Approval rights tied to current credentials | Credential register matched to decisions |
What will a supervisor ask?
AML supervisors will sample onboarding files. For each, they will ask what checks were done, what evidence supported them, who approved the customer and how that person was trained. They will look at screening matches cleared by analysts and ask on what basis. They will ask how the firm knows analysts are not simply following the agent. Where biometrics are used, a market surveillance authority may ask whether the system is high-risk and how Article 14 is met. A data protection authority following a refused applicant's complaint will ask whether a person reviewed the refusal.
What does Article 14 not cover in onboarding?
It does not apply to most document-checking agents. It does not set due diligence standards; AML law does. It does not decide your risk appetite. It does not prescribe training. And it does not relieve the firm of responsibility for onboarding decisions made with the agent's help. For related sectors, see Article 14 oversight in customer support and in credit decisions.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where the Academy fits
Pryme Intelligence Academy teaches the human side of governed agents, from how an agent decides to reading the workspace, with module tests set in the learner's own industry and role, so an onboarding analyst practises on onboarding files. Certificates are checkable at source through VerifyDoc.ai, which matters for teams that verify identity for a living. The wider model is in AI literacy and certification for people who work with agents.
Questions people ask
Can an agent approve a new customer without a person?
Low-risk applications where every check passes on strong evidence can be approved at depth 3 within the firm's limits. Anything involving screening matches, enhanced due diligence or a refusal should be held.
Is face matching against an ID document high-risk?
Biometric verification whose only purpose is confirming a person is who they claim to be is excluded from the high-risk biometric category. Remote identification of people is different. Check the exact use with counsel.
What should analysts do with a refusal the agent recommends?
Check whether the refusal rests on real risk or on missing information. If more information would resolve it, request it; refusals should be reserved for cases where risk is outside appetite. See what human oversight is for the underlying standard.