KYC, or know your customer, is the process a regulated firm uses to verify a customer's identity, understand who they are and how they will use the account, and assess the financial crime risk they pose, at onboarding and for as long as the relationship lasts. It is the individual-customer form of customer due diligence.
Why does KYC matter once AI agents act?
Most of the time in KYC goes on collecting and comparing evidence: identity documents, proof of address, screening results, statements of income or source of funds. That is the bottleneck, and it is the part agents can carry, the argument made in the KYC bottleneck is evidence gathering, and agents can carry it.
What agents should not carry is the judgement. Deciding that a name mismatch is a harmless spelling variant, that a source of funds is plausible, or that a customer should be exited are decisions a firm must be able to defend. The FATF Recommendations, the international standard, call for a risk-based approach to customer due diligence, and risk-based means someone weighed the risk.
How does KYC work in practice?
- Identify: collect the customer's name, date of birth and address.
- Verify: check them against documents or reliable data sources.
- Screen: sanctions, politically exposed persons and adverse media.
- Understand: the purpose of the account and the activity expected.
- Risk-rate: set the level of due diligence and monitoring.
- Refresh: review periodically and when something changes.
Steps one to three suit agents at depth 1 and 2. Steps four and five need a person whenever the case is not plain. Which checks an agent can complete is covered in can an AI agent carry out KYC checks?
What does that look like in an example?
A retail bank's customer is due for periodic review. The agent requests and checks a new proof of address, re-runs screening, and compares the past year's activity with what the customer said at onboarding. Everything matches except a run of large incoming transfers from a country the customer has no stated link to. The agent drafts three questions for the customer and a summary for the analyst. The analyst sends the questions and keeps the review open. The agent did hours of gathering; the person made the one call that mattered. Refresh is examined further in KYC refresh with an agent: what stays with a person.
How is KYC different from KYB?
KYC verifies a person. KYB verifies a business and then reaches through it to the people who own and control it, each of whom needs KYC. A personal customer has one identity to prove; a company may have several layers of ownership to trace before you reach a person at all. The evidence, the sources and the hard cases differ, so treat them as separate capabilities when deciding what an agent may do.
Which related terms should you know?
- Customer due diligence: the wider obligation KYC sits within.
- Enhanced due diligence: deeper checks for higher-risk customers.
- Politically exposed person: someone in a prominent public role, who needs extra scrutiny.
A customer may also ask a service agent a KYC question it cannot answer, such as why their account is restricted. The right behaviour is covered in what happens when a support agent does not know the answer?, and the wider limits in AI agents in banking.
Questions people ask
Is KYC only done at onboarding?
No. Firms must keep customer information up to date and review it on a schedule set by risk, and when events such as unusual activity or a screening hit call for it.
Can an AI agent decide whether an identity document is genuine?
It can run checks and compare documents with data sources. Where there are signs of tampering or the checks disagree, a trained person should decide.