A KYC refresh checklist for agent-assisted reviews lists what must be re-confirmed about an existing customer, identity, address, ownership, business activity, expected versus actual transactions, screening results and risk rating, and splits each item between what the AI agent prepares and what the analyst decides. Copy it, set it to your policy, and use it on every refresh.
What is a KYC refresh, and where does the agent help?
KYC is not done once. Customers change address, ownership and business, and the risk they carry changes with them. A refresh re-confirms the file, either on a schedule set by the customer's risk rating or because a trigger event, such as a change of director or unusual activity, makes it necessary.
Most of the time in a refresh goes on finding things: pulling registry extracts, chasing documents, comparing stated activity with actual transactions. That is where an agent helps, and why the KYC bottleneck is evidence gathering, and agents can carry it. The judgements, whether the explanation is credible, whether the risk rating should change, whether to keep the customer, stay with the analyst.
When should the checklist be used?
On every periodic review and every trigger-event review. The trigger version starts from the event and may not need every item; the method for trigger-event KYC reviews explains how to scope it. Periodic reviews should complete every item.
The FATF Recommendations expect customer due diligence to be kept up to date through ongoing monitoring, on a risk-based approach. Your own policy sets the review cycle per risk rating; enter it at the top of the checklist so the reviewer knows which cycle applies.
How do you fill it in?
The agent opens the checklist, completes the "agent prepares" column for each item, marks each piece of evidence with its source and provenance, and lists mismatches. It then holds the review for an analyst at depth 2. The analyst works through the "analyst decides" column, records decisions and closes the review.
Two rules keep the split honest. The agent may say what it found and what does not match; it may not say what a mismatch means. And any item the agent could not complete is marked open, never estimated. The full reasoning is in KYC refresh with an agent: what stays with a person.
The KYC refresh checklist
| No. | Item | Agent prepares | Analyst decides |
|---|---|---|---|
| 1 | Review type and due date | Records periodic or trigger, risk rating, cycle | Confirms scope |
| 2 | Identity of customer or key individuals | Checks documents on file are in date; requests new ones if not | Accepts new documents |
| 3 | Address | Compares file with recent correspondence and registry | Accepts changes |
| 4 | Ownership and control (business customers) | Pulls registry extract; lists changes since last review | Confirms beneficial owners |
| 5 | Nature of business or occupation | Compares stated activity with registry and website | Judges whether activity has changed |
| 6 | Expected versus actual activity | Summarises volumes, counterparties and countries against the profile on file | Judges whether differences are explained |
| 7 | Source of funds or wealth (higher risk only) | Lists evidence held and gaps | Judges sufficiency |
| 8 | Sanctions, politically exposed person and adverse media screening | Runs or retrieves screening; summarises hits | Dispositions every hit |
| 9 | Customer outreach | Drafts requests for missing items | Approves sending if sensitive |
| 10 | Risk rating | Shows current rating and the factors that changed | Sets the rating |
| 11 | Outcome | Drafts summary | Retain, retain with conditions, escalate, exit |
A filled sample: small business periodic review
A hypothetical bank reviews a catering company rated medium risk.
| No. | Agent prepares | Analyst decides |
|---|---|---|
| 2 | Director's passport on file expired; new copy requested and received | Accepted |
| 4 | Registry shows a new shareholder with 30 shares out of 100 since last review | Confirmed not a beneficial owner under policy threshold; recorded |
| 5 | Website now advertises event equipment hire as well as catering | Activity change accepted as related |
| 6 | Incoming payments three times the profile on file; two new counterparties abroad | Asked customer; explanation and contracts received; profile updated |
| 8 | No sanctions or PEP hits; one adverse media article about a late-paid supplier | Not relevant to financial crime risk; recorded |
| 10 | Factors changed: new activity, cross-border flows | Rating kept at medium |
| 11 | Summary drafted | Retain; next review on medium cycle |
Item 6 is the reason a person is needed. The agent spotted a threefold change and two new countries. Only the analyst could decide whether the contracts made that change ordinary.
Where Pryme fits
In Pryme, a KYC refresh agent would hold depth 2: it gathers, compares and drafts, and every review is held for a named analyst. Each piece of evidence is stamped with its provenance. Whether an AI agent can carry out KYC checks and the guide to AI agents in banking set out the boundaries.
Questions people ask
Can the agent contact the customer directly for documents?
Yes, for routine requests using approved wording, typically at depth 3 once certified. Requests that could tip off a customer under investigation must be held for the analyst.
What if the agent finds nothing has changed?
It records that each item was checked and found unchanged, with evidence. The analyst still signs the outcome, but the review takes minutes.
Can the risk rating be updated automatically?
No. The agent shows which factors moved. Setting the rating is a judgement that stays with the analyst and is recorded with their reasons.