KYC analysts approve the agent's information requests and any standard account opening that did not clear on its own. Higher-risk customers, including politically exposed persons, need a senior analyst and compliance. Declines are decided by a person. The agent opens only clean, low-risk cases within its certified depth, and each approver's rights depend on a current certificate.
What does an onboarding approver rule decide, and who owns it?
Onboarding teams check who a customer is before the firm takes them on. Agents read identity documents, run screening, compare data across sources, rate risk and chase missing information. Some cases are clean and routine; others need judgement about risk, source of funds or a screening match. The approver rule names who releases each kind of held case, and keeps the risk-based approach the FATF Recommendations describe in people's hands where it matters.
The head of onboarding owns the rule. Compliance signs it off. The agent owner configures it. Our explainer on what an agent approver is covers the general duty, and our guide to AI agent skills by role sets out what KYC analysts need to know.
What are the steps?
- Head of onboarding: lists the agent's actions by depth. Depth 1: reads the application, identity documents, registry data and screening results. Depth 2: drafts requests for information, risk rationale and decline letters. Depth 3: requests missing documents, re-runs screening, opens a low-risk account where every check passed on sealed or signed evidence. Depth 4: opens a medium or high-risk account, approves enhanced due diligence, closes a screening match as a false positive.
- Head of onboarding: assigns standard cases that did not clear to KYC analysts.
- Head of onboarding: assigns high-risk cases to a senior analyst plus compliance. Politically exposed persons follow your firm's senior approval rule.
- Head of onboarding: assigns screening match closures to an analyst who records why the match is false.
- Head of onboarding: keeps declines with a person. The agent drafts; an analyst decides.
- Head of onboarding: ties each role to a current certificate. Agent owner configures and files.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Read documents | Extracts and compares | 1 | Nothing |
| Request information | Asks the applicant | 3 | Nothing within templates |
| Open clean low-risk account | Opens within bounds | 3 | Nothing if every check passed |
| Standard case that did not clear | Prepares and holds | 4 | KYC analyst |
| High-risk or PEP | Prepares with rationale | 4 | Senior analyst plus compliance |
| Screening match | Prepares closure note | 4 | Analyst records reason |
| Decline | Drafts letter | 2 | Analyst decides |
Why does provenance decide which cases the agent may open?
A clean case is only clean if the evidence is strong. An identity confirmed by a government registry or a verified issuer is signed. A company director list from the official registry is signed. A utility bill uploaded by the applicant is declared. A web page about the company is external. The agent may open a low-risk account at depth 3 only where every required fact is sealed or signed; if anything rests on declared or external evidence, it holds the case for an analyst.
This keeps the agent fast where evidence is strong and careful where it is weak, and it is easy to audit: every opened account shows the provenance of each fact. Analysts learn to look first at the declared and external items, which is where fraud usually sits.
Remember the account opening gives the customer payment credentials. If the case is wrong, money can move before anyone notices. That is why cases needing judgement are treated as depth 4.
Which controls make the rule work, and what evidence do they leave?
Provenance gate for depth 3 openings. Evidence: provenance stamps on every fact in each opened case.
Senior and compliance on high risk. Evidence: two names on each high-risk approval, as in the approver authority matrix for the onboarding team.
Reasoned match closures. Evidence: the analyst's reason on each closed screening match.
Declines decided by people. Evidence: a named analyst on each decline.
Rights lapse with certificates. Evidence: certificate status on each approval date.
What should you measure?
- Accounts opened at depth 3 later found to be fraudulent or mis-rated.
- Time to open for clean cases and held cases.
- Screening matches closed without a reason. The target is none.
- High-risk approvals with one approver. The target is none.
- Analyst coverage, using the competency matrix for the onboarding team.
Where does it usually go wrong?
Declared documents are treated as verified. An uploaded bank statement looks official. Make its provenance visible to the analyst, and train analysts to read the declared items first.
Compliance becomes the everyday approver. If compliance signs every medium-risk case, they are first line for onboarding. Keep them for high risk and for independent sampling of what analysts approve; compare the approver rule for the compliance team.
Screening tool changes are not approved by onboarding. A change to match settings changes what the agent sees. See the approver rule for the IT team for how system changes involve the agent's owner.
Where the Academy fits
Pryme Intelligence Academy's Operator track trains KYC analysts and onboarding leads in human review, reading the workspace and teaching the agent, with tests set in their own industry and role. Its practicum requires no missed red line, which for onboarding includes opening a case on declared evidence alone. A firm can tie each depth of approval to a current Certified Pryme Operator certificate.
Questions people ask
Can the agent decline an application on its own?
No. Declines affect people's access to services and should be decided by an analyst, with the agent drafting the letter.
Should the agent check source of funds?
It can gather the evidence and compare it with what the customer declared. Judging whether the explanation is credible is an analyst's decision, recorded in their own words.
What happens when the agent's certificate lapses?
It drops to depth 1. It can still read and summarise cases, but analysts handle every opening until it is re-certified.