Most of a KYC refresh is evidence work, and an agent can carry it: finding reviews that are due, listing what is missing, chasing the customer and checking what comes back. Two things stay with a person. The customer's risk rating is a judgement a named reviewer makes, and any restriction or exit for non-response is decided by a person.
What is a KYC refresh, and who owns it?
A refresh, sometimes called periodic review, brings a customer file back up to date. Identity documents expire, ownership changes, addresses move, and the reason the customer gave for opening the account may no longer match what the account is used for. The cycle is usually set by risk rating, with higher-risk customers reviewed more often, and some events trigger an early review.
The first line owns the review. A KYC analyst or relationship team completes it, quality assurance samples it, and the financial crime function owns the policy. If you need a primer, what KYC is covers the basics. The question here is narrower: how the work divides when an agent joins.
How does the work divide, step by step?
- Agent, depth 1: finds due and triggered reviews. It reads the review calendar and watches for trigger events: an adverse media hit, a change at the company registry, a large shift in account activity.
- Agent, depth 1: builds the gap list. It compares the file with the current policy for that customer type and lists every item that is missing, expired or inconsistent.
- Agent, depth 2: drafts the customer request. A plain request for exactly the missing items. A person sends the first request. Routine reminders on the bank's approved schedule can run at depth 3 once that capability is certified.
- Agent, depth 1: checks what comes back. Document type and expiry, name and date of birth matches, beneficial owners against the registry, fresh screening results. Each check is marked passed, failed or unable to check.
- Agent, depth 2: drafts the risk view. It sets out what changed and proposes whether the rating should move, with the reasons cited.
- Person: sets the rating. A reviewer accepts, changes or rejects the proposal and decides whether enhanced due diligence is needed.
- Person: decides on non-response. If the customer does not reply, a person decides whether to restrict services or begin an exit. The agent may draft the notice.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Find reviews | Reads calendar and triggers | 1 | Changing the cycle |
| Gap list | Lists missing and expired items | 1 | Policy exceptions |
| Request | Drafts request; sends approved reminders if certified | 2, then 3 | First contact |
| Check evidence | Runs document and registry checks | 1 | Accepting a failed check |
| Risk view | Proposes rating with reasons | 2 | The rating itself |
| Non-response | Drafts restriction or exit notice | 2 | Restriction and exit |
Why does the risk judgement stay with a person?
The rating drives everything after it: monitoring thresholds, review frequency, which products the customer can hold. A wrong rating does quiet damage for years. That is a judgement with accountability attached, and it belongs to someone who can be asked to explain it.
There is also an asymmetry worth building in. A proposal to raise a rating costs the customer some friction. A proposal to lower it reduces the bank's scrutiny. We recommend that any proposed reduction goes to a second reviewer, and that the agent states which evidence would have to be wrong for the lower rating to be a mistake.
Exit is the clearest case. Closing an account can cut someone off from wages, rent and bills. The agent can show that the customer did not respond to three requests; only a person can weigh whether that is evasion or an elderly customer who never saw the letters.
Which controls apply, and what evidence do they leave?
Provenance on every fact. A passport scan the customer uploads is declared. A registry extract is external. A result from your own screening system is sealed. The risk view shows each fact's class, so the reviewer knows which claims stand on the customer's word alone.
Check results, not summaries. Each evidence check is filed with its input, its result and the rule it applied. A reviewer can open any one and see why it passed.
Held decisions. The risk view and every non-response notice are filed as held, with the reviewer's name, the outcome and any edit.
Bounded reminders. If reminders run at depth 3, the record shows the template, the schedule, and that the minimum chain allowed each one. A reminder outside the approved schedule is refused.
The fields to capture are listed in the KYC refresh checklist for agent-assisted reviews.
What should you measure?
- Overdue reviews. The backlog is the reason most banks start here.
- Time from first request to complete file. This shows whether clear requests reduce back-and-forth.
- QA rejections on agent-checked files. A rise means a check is passing evidence it should not.
- Rating proposals accepted unchanged, by direction. Watch reductions closely.
- Exits for non-response. Each should have a reviewer's reasons on file.
Where does it usually go wrong?
Refreshing documents, not the picture. New passport, same stale profile. The real question is whether the account's activity still fits the purpose the customer gave. The agent should compare stated purpose with actual flows and flag the gap.
Declared facts passed as verified. A customer's statement of their occupation is not evidence of it. Without provenance labels, a reviewer can read a tidy summary as stronger than it is.
Chasers that pressure. Repeated reminders threatening closure reach vulnerable customers too. Keep tone and frequency in the approved templates, and send any sign of difficulty to a person.
Assuming the agent can do the whole check. Whether an agent can carry out KYC checks depends on the check. Gathering and comparing are agent work; deciding what the evidence means is not.
The wider bounds for bank agents sit in AI agents in banking, and the case for starting with evidence work is made in the KYC bottleneck is evidence gathering.
Questions people ask
Can the agent accept a document that fails a check?
No. A failed check goes to a reviewer, who may accept it with a reason, ask for another document or escalate. The agent records the failure and stops.
Does a refresh agent need a separate certificate from an onboarding agent?
Yes. The checks overlap, but a refresh compares new evidence with an existing file and an existing pattern of activity. That is a different capability, and it should be proven on your own closed refresh cases.
What if the customer replies with a question instead of documents?
The agent can answer questions about which documents are needed, from the bank's own guidance. Questions about why the bank is asking, or complaints, go to a person.