Five steps, applied to every decision they look at: open the record, find the bound that decided, test the evidence against your due diligence policy, decide whether to approve, edit or decline, and write the reason. The same steps work for a held onboarding file and for a sample of decisions the agent was allowed to complete on its own.
Which KYC decisions get reviewed?
Two kinds, and analysts often forget the second.
Held decisions wait for a named person before anything happens: a new customer with a screening hit, a high risk rating, an ownership chain the agent could not finish.
Allowed decisions were completed by the agent inside its bounds, typically at depth 3: refreshing a low-risk customer's periodic review, closing an alert on an exact-match false positive, requesting a missing document. Nobody saw these before they happened, so a sample of them is the only check that the agent is still deciding the way the firm intends.
What are the review steps?
- Read the record, not the summary. The record holds the verdict, the draft, every source the agent used and the version of its brief. The summary is the agent's own account; the record is evidence.
- Find the deciding bound. Every action meets five bounds at once: role scope, certificate, sources, the firm's own limits and the platform guardrails. The verdict names which one decided. If an onboarding was allowed, ask which bound would have stopped it and how close it came.
- Test the evidence. Check each fact's provenance. A registry extract or a verified identity check is signed by a named party; an occupation the customer typed is declared; a utility bill sent by email is external. A low risk rating built mostly on declared facts deserves a harder look.
- Compare with policy. Does the due diligence level match the rating? Is the review cycle right? Were the right lists screened?
- Decide and give the reason. Approve, edit or decline, in words a second-line reviewer can follow.
What stays with the analyst?
| The agent may | The analyst keeps |
|---|---|
| Gather registry extracts and screen names | Discounting or confirming a screening match |
| Draft a risk rating and its rationale | Accepting a high-risk relationship |
| Refresh low-risk periodic reviews within the firm's limits | Deciding that enhanced due diligence is complete |
| Request missing documents from the customer | Any decision to exit a customer or refer suspicion |
The right column is not a list of things the agent is bad at. It is a list of judgements the firm has to be able to attribute to a named person.
What does a sampled review look like?
Take a retail bank's periodic review queue. The agent refreshed a low-risk customer's file at depth 3, confirming identity against the bank's own core records and leaving the risk rating unchanged. The analyst picks the decision in the weekly sample.
The record shows the deciding bound was the bank's own limits: low-risk refreshes are allowed. But the customer's occupation is still the one they declared at account opening, and the account now receives regular transfers from abroad that do not fit it. The agent was within its bounds; the bound itself was too loose. The analyst edits the decision to a manual review with a reason, and raises the pattern with the team lead so the firm's limits can require a transaction check before any refresh is allowed.
That is the most useful kind of finding: not a single wrong answer, but evidence that a bound needs changing.
How do analysts avoid becoming a rubber stamp?
Rotate who samples, so nobody reviews only their own colleagues' approvals. Track decline and edit rates per reviewer: an analyst who never edits anything is either reviewing perfect work or not reading it. And keep sample sizes small enough that each item gets real attention.
The same method transfers across risk teams: compare how credit analysts review an agent's decisions and how fraud analysts review them. Market detail differs; KYC training in payments in Nigeria shows how. The underlying point, made in why KYC analysts are the real control, is that the review step is where governance becomes real. More in AI agent skills by role.
Where the Academy fits
The Operator track in Pryme Intelligence Academy teaches how a governed agent decides, human review and reading the workspace, which together cover the five steps above. Lessons and labs are free and run in a free Build workspace, and module tests are set in the learner's industry and role. Certified Pryme Operator is valid for 12 months, so a firm can check at source that an analyst's review rights are backed by a current certificate.
Questions people ask
How many allowed decisions should a KYC analyst sample?
Enough to see patterns, few enough to read properly. Start small, weight the sample towards decisions that came closest to a bound, and adjust once you see what the findings look like.
Can an analyst change the agent's bounds after a review?
Not directly. The analyst raises the finding; the process owner changes the firm's limits or the agent's brief, and the change is recorded.
What if two analysts disagree on the same decision?
Escalate to the team lead and record both views. Disagreements usually point to policy wording that needs tightening.