Clearing a potential sanctions or PEP match, approving a high-risk customer, lowering a risk rating, treating a customer's upload as verified proof, explaining a refusal in a way that tips someone off, and exiting a customer: none of these belong to the agent. KYC analysts keep them because each decides who the firm does business with and carries regulatory accountability.
What is a KYC red line, exactly?
A red line is an act that stays with a person whatever the agent's depth and however good its record. It differs from the ordinary limits on a new agent, which loosen as the agent proves itself on the firm's own cases.
KYC is a gatekeeping function. The firm's regulators expect a person to stand behind each decision to admit a customer of elevated risk, and the FATF Recommendations build the whole regime on a risk-based approach applied by the firm. An agent can make that approach faster and more consistent. It cannot be the one who applies it at the gate.
Which acts stay with the KYC analyst?
| Never let the agent | Why it stays with a person |
|---|---|
| Discount a potential sanctions or PEP match as a false positive | A wrong discount can breach sanctions law; the judgement must be named |
| Approve a high-risk customer or enhanced due diligence | Senior approval for higher-risk relationships is a core AML expectation |
| Lower a customer's risk rating | Downgrades reduce monitoring for years; they need a reason a person owns |
| Treat a declared or external document as verified | An upload is a claim; verification needs a stronger source |
| Tell a refused applicant why, where that could tip off | Disclosure of suspicion can be an offence |
| Exit or block an existing customer | Offboarding affects a person's access to services and may follow a report |
Credit analysts and fraud analysts protect adjacent ground; compare what credit analysts should never let an agent do and what fraud analysts should never let an agent do.
Why does provenance sit under most of these lines?
Several of the red lines are really about what counts as evidence. The agent sees each fact stamped sealed, signed, declared or external. A passport scan the customer uploaded is external. A result from an issuer's verification service is signed. An analyst who knows this can see at a glance whether "identity verified" rests on the right kind of fact.
The firm writes into its own limits which provenance is required for each check. Where the evidence is weaker than required, the agent's attempt to mark the check complete is held, and the verdict names sources as the deciding bound. That is how "never treat an upload as proof" becomes a control rather than a hope.
What does a red line look like in practice?
Take a payments firm in the Netherlands onboarding a freelance consultant. Screening returns a potential PEP match: same name, different date of birth, different country. The agent drafts a reasoned note recommending discount as a false positive, and it is almost certainly right.
The verdict is still held. The analyst reads the note, checks one more identifier, agrees, and approves the discount under their own name with a sentence of reasoning. It takes two minutes. If the match had been true, those two minutes would be the most important of the analyst's week, and the record shows a person made the call either way. Australian payments teams work the same way under their own regime; see KYC analyst training in payments in Australia and in the Netherlands.
How do teams keep the lines from wearing thin?
Volume is the enemy. An analyst clearing a hundred near-certain false positives a day starts to approve on reflex. Three practices help: rotate a second analyst through a sample of approved discounts each week; track how often analysts overturn the agent's recommendation, since a figure near zero may mean nobody is reading; and reread the red-line list whenever the screening lists or risk methodology change. A full plan for preparing a team is in the training plan template for KYC analysts, and the cross-role view is in AI agent skills by role.
Where the Academy fits
Pryme Intelligence Academy certifies the people who hold these lines. The Operator track's practicum is two weeks of real review decisions signed off by a Pryme assessor, and one missed red line fails it. A firm can also adopt the practice of granting approval rights for screening discounts only to analysts with a current Certified Pryme Operator certificate, checkable at source through VerifyDoc.ai.
Questions people ask
Can the agent clear an obvious false positive at depth 3?
Some firms allow it for narrow cases, such as a name match with a different date of birth and nationality, once certified. Many keep every sanctions discount with a person regardless.
Can the agent tell a customer their application was declined?
Yes, using approved wording that gives no reason where a reason could tip off. Drafting the bespoke explanation stays with the analyst.
Who decides the red-line list?
The money laundering reporting officer or equivalent, with compliance and operations. Analysts should be consulted, because they know where the near misses happen.