Who is accountable when a compliance agent misses something?

The firm, and the named people who own the control the agent performs. Never the agent, and never the vendor. Before an agent goes live, write down who owns its scope, who approved its depth and which senior manager answers for the function. Each filed verdict should point back to those names, so a miss can be traced.

Who carries the accountability?

A regulator looks to the regulated firm, and inside it to the people responsible for the function. If a sanctions screening agent misses a match, the question is the same one that would be asked if a screening analyst missed it: who designed the control, who checked it worked, and who oversaw the area?

A contract with a technology provider can allocate commercial liability. It does not move regulatory accountability. That stays with the firm and its senior people, which is the argument made in senior managers remain accountable for what agents do. The banking version of the same question is covered in who is accountable when a bank's AI agent makes a mistake.

How should accountability be assigned before launch?

Assigning these roles is cheap before launch and painful afterwards. The test is simple: for any capability the agent has, can you name one person who would explain it to a supervisor?

Does the cause of the miss change who answers?

Yes, which is why the record matters more than the blame. A miss usually has one of four causes, and each points to a different owner.

• Out of scope. The agent was never asked to look for this. The gap sits with whoever designed the scope.
• Missing data. The fact was not in the agent's sources. The gap sits with the data owner, and with the agent owner if the agent did not say what it could not check.
• In scope, but wrong. The agent was certified for this and still missed it. The certification approver and agent owner look at whether the tests were good enough.
• Approved without review. A person signed off held work they did not read. The miss is theirs.

The guide to AI compliance agents explains why an agent in the second line prepares rather than decides; that design is what keeps these causes separable.

What does this look like after a real miss?

Take a payments firm whose screening agent clears alerts at depth 3 for exact non-matches and holds everything else. A payment goes through to a party on a sanctions list under a transliterated name the agent treated as a non-match.

The filed record shows the agent's verdict, the list version it used and the rule that decided. The list was current; the agent's matching tolerance for transliterated names was set too narrowly. That is an "in scope, but wrong" miss. The agent owner and certification approver own the remediation: the agent drops to depth 2 for screening, the test set gains transliteration cases, and every clearance in the same period is rescreened. The accountable senior manager reports the incident.

What will a supervisor want to see?

The record of what happened, the named owners, the root cause, what was done about other affected cases, and what changed. Supervisors in different markets frame this differently; in Singapore, for example, MAS's FEAT principles put accountability at the centre, as covered in AI agents for compliance teams in payments in Singapore. The common thread is that "the system did it" is not an answer.

Where Pryme fits

In Pryme every verdict names the bound that decided it and is filed in an append-only record, alongside the certificate the agent was working under. That lets you see whether a miss came from scope, sources, certification or a person's approval, rather than reconstructing it from memory.