FATF customer due diligence with AI agents

Under FATF standards, an AI agent can prepare most of customer due diligence: collecting documents, checking data, running screening, mapping ownership and drafting a risk rationale. People make the decisions: whether identity is verified when evidence is imperfect, who the beneficial owner is in a complex structure, what the risk rating is, and whether to accept or exit the customer.

What does FATF require for customer due diligence?

The FATF Recommendations are the international standard for anti-money laundering and counter-terrorist financing, and national laws build on them. Customer due diligence (CDD) asks a firm to:

• identify the customer and verify their identity using reliable, independent sources;
• identify the beneficial owner and take reasonable measures to verify who they are, which for legal persons means understanding ownership and control;
• understand the purpose and intended nature of the business relationship;
• conduct ongoing due diligence, scrutinising transactions to make sure they fit what the firm knows about the customer.

The depth of CDD follows risk. Higher-risk customers need enhanced measures; lower-risk situations may allow simplified ones. Politically exposed persons need extra steps, including senior management approval for the relationship. If CDD cannot be completed, the firm should not open the relationship, or should end it, and should consider a suspicious transaction report. When a firm relies on a third party for parts of CDD, responsibility stays with the firm. Our explainers on customer due diligence and enhanced due diligence cover the basics.

Who does it apply to?

Financial institutions and designated non-financial businesses and professions in countries that implement the FATF standards: banks, payment firms, money service businesses, crypto-asset service providers, insurers for certain products, and also lawyers, accountants, estate agents and dealers in high-value goods in many places. National regulators and laws set the details; FATF sets the frame.

What may the agent prepare, and what stays with a person?

The line follows judgement. Where CDD is mechanical, an agent can do it well at depth 2. Where CDD requires weighing imperfect evidence or accepting risk, a person decides. Our short answer to whether an agent can perform CDD puts it the same way.

The agent may prepare: - Request missing documents and chase them within set timings. - Extract names, dates, addresses and registration numbers, and check them against each other. - Run sanctions, PEP and adverse media screening and summarise the results. - Build an ownership chart from registry filings and documents, citing each source. - Compare the stated purpose of the account with expected activity. - Draft a risk rating with the factors and sources behind it. - Draft enhanced due diligence questions for a higher-risk customer.

A person decides: - Whether identity is verified when documents conflict or show anomalies. - Who the beneficial owners are where control runs through trusts, nominees or layered companies. - The final risk rating, and whether enhanced measures apply. - Whether to accept a politically exposed person, with senior management approval. - Whether to decline or exit a customer when CDD cannot be completed. - Whether anything warrants a suspicious transaction report.

For business customers, the ownership work is the heaviest part. Our playbook on how to run business customer due diligence with an agent shows how to split it.

Why does the decision have to stay with a person?

Three reasons, each specific to CDD.

First, the standard asks for reasonable measures and understanding, which are judgements. An agent can show that three documents agree; it cannot be accountable for concluding that the firm understands a customer.

Second, the hard cases are adversarial. People hiding beneficial ownership build structures designed to look legitimate to a checklist. An agent that is good at completing checklists is exactly what they hope to meet.

Third, the consequences fall on the customer. A decline or exit can cut someone off from banking. That decision needs a person who can weigh fairness and explain it, and data protection law in many markets restricts such decisions being made solely by automated means.

How do you meet CDD standards with an agent?

An enhanced due diligence checklist helps both the agent and the analyst work to the same standard on higher-risk files.

What will a supervisor ask?

• Which CDD steps does the agent perform, and at what depth?
• Show us a file where documents conflicted. What did the agent do, and who decided?
• How does the agent identify beneficial owners, and who confirms them?
• Who sets the final risk rating?
• Can an account open before a person has made the required decisions?
• How do you test the agent's extraction and screening accuracy?

What does FATF not settle?

FATF sets the standard; national law and regulators set the exact rules, documents and timings, which vary by country. FATF does not govern the AI itself, which falls under rules such as the EU AI Act where they apply, or under supervisors' expectations on model risk. It does not cover data protection duties for the personal data agents collect. Our guide to AI compliance agents covers how these fit together.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.