Business due diligence is several checks that must agree: the entity is real and as described, the people behind it are verified, the business makes sense, and nothing raises a red flag. The agent runs each check, cross-tests the results and drafts a risk assessment. An analyst decides completeness and sets the risk rating; high-risk relationships need senior approval.
What is business customer due diligence, and who owns it?
Customer due diligence for a business customer means identifying and verifying the entity, understanding its ownership and control structure and identifying its beneficial owners, understanding the nature and purpose of the relationship, and conducting ongoing monitoring. FATF Recommendations set the standard and national laws implement it; FATF customer due diligence with AI agents explains how the standard applies when agents do the work. Where risk is higher, enhanced due diligence applies.
Onboarding or KYC analysts run due diligence under the MLRO's policy. Business customers are harder than individuals: more parties, more documents, more ways for things not to fit. Whether an AI agent can perform customer due diligence sets the boundary: the agent gathers and checks, a person concludes.
What does the agent do at each step, and at what depth?
- Agent, depth 1: verifies the entity. Registry extract: legal name, number, status, registered address, incorporation date, officers, filing history. Recorded as signed by the registry.
- Agent, depth 1: compares with the application. Name, address, directors and business description supplied by the customer, recorded as declared, against the registry. Differences are listed.
- Agent, depth 1: maps ownership and control to natural persons, with effective holdings and control rights, and lists beneficial owners against your threshold.
- Agent, depth 3, within bounds: requests verification of directors and beneficial owners through your identity service, for the parties the policy requires.
- Agent, depth 1: screens all parties. Entity, directors, beneficial owners and signatories against sanctions, PEP and adverse media sources.
- Agent, depth 1: assesses nature and purpose. The stated business against its filings, website, industry codes and expected activity: products wanted, expected volumes, countries and counterparties.
- Agent, depth 1: applies risk factors. Industry, countries, structure complexity, delivery channel, PEP or adverse media links, from your customer risk methodology.
- Agent, depth 2: drafts the due diligence summary and proposed rating. Findings per check, inconsistencies, outstanding items and whether enhanced due diligence is triggered.
- Person, analyst: decides whether due diligence is complete and sets the risk rating.
- Person, senior approver: approves high-risk relationships; enhanced due diligence follows running EDD on high-risk customers.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Entity | Pulls and records registry data | 1 | None |
| Compare | Finds application differences | 1 | Resolving them |
| Ownership | Maps to natural persons | 1 | Confirming owners |
| Verification | Requests checks on parties | 3 | Reviewing failures |
| Screening | Screens all parties | 1 | Deciding hits |
| Nature and purpose | Tests business against evidence | 1 | Judging plausibility |
| Risk factors | Applies methodology | 1 | None |
| Summary | Drafts findings and rating | 2 | Analyst decides |
| Approval | Nothing | None | Senior approver |
Which controls apply, and what evidence does each leave?
Provenance on every fact. Registry data, verification results, customer declarations and web content each carry their source. Evidence: the summary shows what is verified and what is only declared.
Cross-checks recorded. Differences between the application and the registry, or between the stated business and its filings, are listed with how each was resolved. Evidence: the inconsistency log.
Methodology applied as written. The proposed rating shows the factors and weights used. Evidence: a rating anyone can recompute.
Analyst decision separate. The analyst may change the rating, with a reason. Evidence: proposed and final rating, and the reason for any difference.
Verification bounded. The agent requests checks only on parties the policy requires, within spend limits. Evidence: each check linked to a party and a requirement.
What should you measure?
- Time to complete due diligence, by customer type and risk.
- Files returned by QA for missing elements.
- Rating changes by analysts, and in which direction.
- Inconsistencies found between application and registry, and their resolution.
- Customer drop-off during onboarding, which may show over-asking.
- Parties missed, such as signatories or owners found only at a later review, which shows gaps in the ownership and control step.
Where does it usually go wrong?
Registry status ignored. A company that is dissolved, in liquidation or overdue with filings is still applying. Status should be checked and acted on before any other step is completed.
Nature of business taken from the form. "Consultancy" or "trading" tells you little. Test it against filings, website and expected activity, and ask what the customer sells, to whom and where.
Signatories forgotten. People who can operate the account need verifying and screening even if they are not owners or directors.
Shell indicators missed. No employees, a formation agent's address, recent incorporation and large expected volumes together deserve attention, even if each alone is common.
Ongoing monitoring disconnected. Expected activity recorded at onboarding is the baseline for monitoring. If it is vague, monitoring cannot work.
Group structures handled as single entities. A customer that is one company within a larger group may share directors, owners and accounts with other group members you already bank. The agent should link the new entity to existing relationships so the analyst sees the whole exposure, not one company in isolation.
The overall stance on compliance agents is in AI compliance agents.
Questions people ask
Can the agent onboard a low-risk business without an analyst?
In this design, no. The analyst decides that due diligence is complete for every customer. For low-risk cases, the agent's work can make that decision quick, but it remains a person's.
How does the agent handle overseas entities?
It uses the relevant country's registry where accessible and marks what could not be verified locally. Overseas entities may raise the risk rating under your methodology.
Should the agent visit the customer's website?
It can read public web content as external evidence of the business. It should not treat a website as proof the business is real.