Three leads: payments operations, financial crime and merchant risk. In a payment company, those people approve the agent's held payouts, decide what happens with its alert summaries and sign off the merchants it recommends. Their decisions move money, often irreversibly. Train them before any agent goes near live flows, then disputes, support and the analysts under each lead.
Why these three leads?
Each guards a different door. Payments operations decides whether money leaves. Financial crime decides whether activity is reported and whether a customer stays. Merchant risk decides who gets to take payments at all. An agent working in any of the three drafts and holds for the lead or their team. If the lead does not understand how the agent reached its draft and why it was held, the team below will not either.
Who comes in which wave?
- Payments operations lead. Reviewer track with practice on held payouts, returns and repairs from the company's own history.
- Financial crime lead or money laundering reporting officer. Reviewer track focused on alert summaries, plus how verdicts are filed. Filing a suspicious transaction report stays with a person.
- Merchant risk lead. Reviewer track with practice on past onboarding decisions, including ones that should have been declined.
- Chief executive and chief risk officer. Common grounding on depth, limits and the record.
- Disputes lead. Reviewer track before agents draft chargeback responses.
- Analysts and support staff. Common grounding, then the reviewer track for those who approve.
A training needs analysis template for AI agents helps map these roles onto your own organisation.
What may the agent do, and what stays with people?
| Work | The agent | Depth | Stays with a person |
|---|---|---|---|
| Merchant onboarding | Checks registry data, website and documents; drafts the decision | 2 | Approval of higher-risk merchants and every decline |
| Payouts | Prepares | 4, held above limits | Release above the company's own limits |
| Alerts | Summarises and drafts a disposition | 2 | Every reporting decision |
| Disputes | Builds the evidence pack | 2 | Submission |
| Reversing a settled payment on Pryme's own rail | Withheld at the platform floor | None | Handled outside the agent, if at all |
An example: a merchant whose website told a different story
Take a payment company onboarding small online merchants. An applicant declares it sells home fitness equipment. The agent checks the company registry, which is a strong source, and the merchant's website, which is external provenance. The website's product pages match, but a linked subdomain sells unlicensed supplements. The agent drafts an approval on the declared activity and flags the subdomain, and because the company's own limits hold any merchant with an unexplained second site, the decision is held.
A trained merchant risk lead reads the flag, checks the subdomain and declines. An untrained one sees a clean registry check and a matching main site and approves. Weeks later the chargebacks arrive. The merchant risk lead belongs in wave one because the agent hands them the decision, not the answer.
Which standards shape wave one's training?
The FATF Recommendations set the standard for customer due diligence and suspicious transaction reporting. PCI DSS v4.0 governs card data, PSD2 strong customer authentication applies in the EU, and the EU Instant Payments Regulation requires payee name verification. Wave one does not need to recite them; they need to know which of their decisions each one touches. This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
How does the company show wave one is ready?
A written test and a supervised period of real held decisions with no missed red line, signed off by someone outside the team. A payment company can make the right to release payouts at depth 4 depend on a current certificate. Agent certificates lapse after 90 days, and a run that clears no depth drops an agent to depth 1 the same day; payments operations must be able to keep payouts moving by hand.
Run a readiness assessment in a payment company, then roll the training out across the payment company. Compare the order in a bank and in a logistics company, where carrier payments raise the same bank detail risk. The full approach is in training teams for AI agents.
Where the Academy fits
Pryme Intelligence Academy's Operator certificate needs a 40-question exam passed at 32 of 40 and a two-week practicum of real review decisions with no missed red line, signed off by a Pryme assessor. Leads who design agents go on to the Builder track, whose capstone is an agent certified in Attest to depth 2 or higher.
Questions people ask
Should engineers be in wave one?
Those who build the agents need the builder track early. They should not also approve the agents' held actions.
What about partner banks and schemes?
They will ask how you oversee agents. Certificates that can be checked at source answer that better than a training register.
How often should wave one renew?
At least yearly, and whenever an agent gains depth 4 for a new capability.