Provenance comes first. KYC work is deciding what to believe about a customer, so before an agent joins onboarding, analysts must learn how it labels each fact by source, which checks it may complete at which depth, why screening matches are held for them, and how to review its due diligence summary.
How does an agent change onboarding work?
Onboarding is document-heavy and repetitive: identity documents, proof of address, company registry extracts, ownership charts, screening results. An agent reads all of it in seconds, extracts the fields, matches names against screening lists and drafts the customer due diligence summary. The analyst stops typing and starts judging.
That is a better use of an analyst, but only if they understand what the agent did. A summary that says "identity verified" can mean the agent checked a document against an issuer's database, or that it read a scan the customer uploaded. Those are not the same, and a KYC analyst must know the difference without opening every file.
What does a KYC analyst need to understand?
- Provenance classes. Every fact reaches the agent stamped sealed, signed, declared or external. A registry extract obtained directly from a company registry through a verified connection is signed by the issuing body; a customer's statement of source of funds is declared; a PDF bank statement the customer emailed is external. The FATF risk-based approach asks firms to weigh evidence by reliability, and provenance makes that weighting visible.
- Depth per check. The agent may extract fields at depth 1, draft the due diligence summary at depth 2, and, once certified, complete low-risk checks within bounds at depth 3, such as confirming a clean screening result for a standard-risk retail customer. Analysts should know the depth of each step.
- Held items and the deciding bound. Every action meets role scope, certificate, sources, the firm's own limits and the platform guardrails. A potential sanctions match will be held by the firm's limits; a missing beneficial owner may be held by sources. The verdict names which.
- Certificates and lapses. A certificate lasts 90 days and drops to depth 1 the same day a run clears no depth. After a screening list change or a new document type, expect more held work.
- The record. Every decision is filed append-only. Analysts write review notes for the regulator who may read them later.
What does the agent do, and what stays with the analyst?
| The agent | The KYC analyst |
|---|---|
| Extracts fields from documents and registry data | Judges whether a document is genuine where doubt exists |
| Runs screening and drafts a match assessment | Decides whether a potential match is a true match |
| Drafts the due diligence summary and risk rating proposal | Sets the final risk rating |
| Requests missing documents from the customer | Approves enhanced due diligence and high-risk onboarding |
Fraud and KYC overlap at the edges; the fraud side is in what fraud analysts should learn first, and credit's version, focused on financial evidence, is in what credit analysts should learn first.
What does a good review look like?
Take a payments firm onboarding a small import business. The agent drafts a summary: company registered, two directors identified, one beneficial owner at 60 shares in 100, screening clear, proposed rating standard. It is held for the analyst because the firm's limits route all business onboarding to a person.
The analyst opens the provenance panel. The registry data is signed. The ownership chart, however, came from a document the applicant uploaded, which is external, and the registry shows a corporate shareholder the chart does not mention. The agent's summary was accurate to the chart and wrong about the company. The analyst declines, requests the corporate shareholder's ownership, and notes "ownership taken from applicant chart, not registry". That correction tells the builders to make the registry the source for ownership, not the upload.
Payments firms in Nigeria and Australia apply this under different regulators; see KYC analyst training in payments in Nigeria and in Australia.
Which controls keep it safe?
Screening matches, high-risk ratings and enhanced due diligence stay in the firm's own limits as held items. Analysts approve under their own identity. And the firm decides, in writing, which sources count as sufficient for each check, so the agent cannot treat an upload as a registry. Pryme Intelligence Academy's Operator track trains analysts on exactly this kind of review, with tests set in their own industry and role.
The argument for analysts as the deciding check is in why KYC analysts are the real control. The full role map is in AI agent skills by role.
Questions people ask
Can an agent verify an identity document on its own?
It can compare a document against a sealed or signed source, such as an issuer's verification service, and record the result. Judging a suspicious document by eye stays with an analyst.
Should the agent propose a risk rating?
Yes, as a draft with its reasons. The final rating is the analyst's, because it decides how the customer is monitored for years.
What happens at periodic review?
The same split applies. The agent refreshes data and drafts the review; the analyst decides whether anything has changed enough to re-rate the customer.