Reviewer onboarding checklist for onboarding team

KYC analysts reviewing an onboarding agent must learn to judge evidence by where it came from, not how it looks. This checklist covers access, red lines on sanctions matches and declared information, shadowing on held applications, reviewer training and exam, a practicum with near-matches and weak documents, a drill and sign-off with risk-tier limits.

What does an onboarding reviewer decide?

The onboarding agent collects identity documents, verifies them against data sources, screens names against sanctions and politically exposed person lists, checks addresses, assigns a risk rating and drafts the account decision. Clean, low-risk applications may be approved within bounds at depth 3. The agent holds near-matches, high-risk ratings, document doubts and anything needing enhanced due diligence. Certain customer types the business does not serve are refused by its own limits.

The core skill is reading provenance. Every fact reaching the agent is stamped with where it came from. Sealed: issued by a system of record, such as a registry. Signed: a named party answers for it, such as a verified identity provider. Declared: stated by the applicant, unverified. External: arrived from outside, such as an emailed utility bill. A new analyst who treats a declared occupation or an emailed document as if it were signed will approve risks the policy meant to catch. FATF's risk-based approach expects due diligence to scale with risk, and that depends on knowing how strong each piece of evidence is.

How do you use the checklist?

The onboarding operations manager owns it; the money laundering reporting officer signs the red lines. Work through each item in order. No approval rights until item 15. Onboarding here means two things at once, the customer's and the analyst's; this checklist is about the analyst. The teaching method for analysts is in how to train the onboarding team to review AI agent decisions, and the business-wide order of training in the guide to training teams for AI agents.

The checklist

1. Read-only access to applications, screening results and the record.
2. Agent capabilities read: document collection (2), verification (1), screening (1), risk rating (1), approval of low-risk applications within bounds (3), held near-matches and high-risk cases, refused prohibited types.
3. Provenance briefing: sealed, signed, declared and external, with an example of each from the team's own files.
4. Red lines signed: never clear a sanctions or PEP near-match without comparing date of birth, nationality and other identifiers; never treat declared information as verified; never approve an application you have a personal connection to.
5. Buddy named.
6. Shadowing: two days on held applications.
7. Seen a sanctions near-match cleared correctly, with identifiers recorded.
8. Seen an application held because key evidence was declared only.
9. Shared foundation complete; test passed.
10. Reviewer modules complete; written exam passed.
11. Practicum: two weeks of real held applications, each confirmed by a buddy.
12. Coverage: a sanctions near-match, a PEP, a document with signs of editing, a business customer with a complex ownership chain.
13. Incident drill completed.
14. Assessor sign-off; no missed red line.
15. Approval rights by risk tier; renewal date set.

Worked example

An illustrative e-money business brings Sample Analyst AA into its onboarding team. The agent approves personal accounts where identity is verified through a signed source and screening is clear.

In shadowing, the agent holds an applicant whose name partly matched a sanctions entry. Her buddy compares the dates of birth and nationalities, finds they differ, clears the match and records the identifiers used. In another case, the agent rated a sole trader as low risk, but the business activity was declared on the form only and the stated turnover was high for the activity. The buddy holds it and requests evidence.

Sample Analyst AA's practicum covers 95 held applications. She spots a bank statement whose font changes mid-line and refers it, and works through a company with three layers of ownership to identify the controller. The drill, run as in how to run an AI agent incident drill for the onboarding team, simulates a screening data source failing. She is signed off with rights for standard and medium-risk tiers.

Where the Academy fits

Pryme Intelligence Academy delivers items 9, 10 and 14. Operator modules include how a governed agent decides and keeping knowledge current, which map onto provenance and screening changes. The certificate is valid 12 months and listed on a public register by name, credential and expiry, which helps when a correspondent bank asks how analysts are trained.