KYC & AML Onboarding Agents

Separate the regulated decision from the work that surrounds it.

Most failed pilots in this space start by asking the model to say yes or no. That framing is wrong on compliance grounds and, less obviously, wrong on value grounds — the decision is the cheap part.

• The disposition is attributable to a person, by design. Clearing an alert, accepting a customer, or filing a suspicious-activity report is an act with a name attached. The regime assumes an accountable individual, and no architecture makes a model that individual. Fix this first, in writing, before anything else — accountability and roles is the general form of the argument.
• Almost everything else is unregulated grunt work. Pulling the corporate registry filing, walking an ownership chain to find beneficial owners above the threshold, reconciling three transliterations of the same name, checking whether a document has expired, finding the adverse-media article that the alert was actually about. This is where the hours go and where the agent belongs.
• The output is a case file, not a verdict. Design the agent to produce a structured package — evidence, sources, the specific reason each hit matched, the residual question — with a recommended disposition attached as a recommendation. The analyst's job becomes checking a written argument rather than reconstructing one, which is a categorically cheaper task.
• Then measure the right thing. The metric is not model accuracy. It is alerts closed with a reasoning record an examiner would accept, per analyst-hour, at unchanged recall. Every one of those qualifiers is load-bearing, and the last one is the one teams quietly drop.

Sanctions screening is a deterministic system, and the model must stay outside it.

This is the specific place where enthusiasm does the most damage. A language model is genuinely good at judging whether two names refer to the same person — and that is exactly the job it must not be given.

• The matcher must be reproducible years later. An examiner asks why a name did not match on a given date. Answering requires re-running the same algorithm, at the same threshold, against the same list version — and getting the same result. A model that is non-deterministic under sampling, silently updated by its vendor, and impossible to pin to a version cannot answer that question, for the reasons in reproducibility and nondeterminism.
• Threshold calibration is now an explicit supervisory expectation. The EBA's Guidelines on Restrictive Measures, in force since the end of 2025, expect firms to demonstrate that screening parameters are calibrated with evidence. That is a statement about a tunable, testable system. It does not describe a prompt.
• So keep the fuzzy matcher classical, versioned and pinned. Transliteration rules, phonetic algorithms, edit-distance thresholds, date-of-birth tolerance. Boring, auditable, and defensible — and every list version and configuration change is stamped on every screening event.
• Put the model on the other side of the match, where it helps. Once a hit exists, the model assembles the discriminating evidence — a different date of birth in the registry filing, a different nationality, a corporate entity with an unrelated registration history — and drafts the discounting rationale. It reduces the analyst's time on a hit; it never decides whether the hit exists.
• Never let the model pick the threshold. Loosening a match threshold is a risk-appetite decision made by a committee and documented. It is not a tuning knob for improving your agent's precision score, and a team optimising an eval metric will reach for it without noticing what it is.

Adverse media is where the model earns its keep — and where it fabricates.

Negative-news screening is the one part of the workflow that is genuinely a language problem, and it is also the part where a fluent, wrong answer is hardest to catch.

• The hard problem is entity resolution, not sentiment. Is this the same John Chen? A confident summary of an article about a different person with the same name is the characteristic failure, and it reads exactly like a correct one. Require the agent to state which attributes matched — employer, city, age, role — and to flag which did not.
• Every claim must cite a retrieved document, or it does not exist. No source, no claim. This is grounding as a hard architectural constraint rather than a prompt instruction: the drafting step should only be able to reference documents in the retrieved set, and an uncited assertion in the output is a defect to be caught by a check, not a stylistic preference.
• Snapshot the source at decision time. Articles are edited, paywalled and deleted. The case file needs the retrieved text as it stood when the decision was made, stored under a retention schedule that survives the article — the copy problem in retention and legal hold.
• Distinguish allegation, charge, conviction and retraction. These carry different weight, and a summariser that flattens them into "linked to fraud" produces both unfair outcomes for the customer and an indefensible file. Make the distinction a required field, not something the prose is expected to convey.
• Recency and jurisdiction change the answer. A spent conviction, a dismissed case, a report from a jurisdiction with known press-freedom problems — these need to be surfaced with that context attached, because the analyst's judgement depends on it and the model will not volunteer it.
• Search coverage is a silent failure mode. If your retrieval misses the local-language press in the customer's home market, the file will read clean and be wrong. Measure recall against a known-positive set per language and per region, not in aggregate.

The economics: false positives at fixed recall, and never the reverse.

The business case is precision. The regulatory exposure is recall. Those pull in opposite directions and the whole programme turns on holding one of them still.

• Fix recall as a constraint, then optimise everything else. Any change that lowers detection is a risk-appetite change requiring approval through the same governance as a threshold change — never a side effect of an engineering improvement. Write this into the eval gate so a model update cannot quietly trade it away.
• Value shows up as analyst-minutes per alert, and it compounds. Cutting a 22-minute investigation to 6 minutes at the same disposition quality is the entire return, and at 95% false positives the volume multiplier is enormous. Model this the way the cost of human review does, because the reviewer is the dominant line here by a wide margin.
• Beware the review-quality trap. When the agent is usually right, analysts start approving its recommendation without reading the evidence — and the failures that remain are the plausible ones. Rubber-stamped clearances are worse than the backlog, because they carry a record asserting that someone reviewed them.
• So sample and re-review, permanently. A random slice of agent-assisted clearances re-worked blind by a second analyst is the only measurement that detects drift in the humans as well as the model. Budget it as a running cost, not a launch activity.
• Give the queue a triage tier the agent can actually own. The clearest wins are the mechanical discounts — a hit on a deceased individual with a mismatched date of birth, a corporate name collision with a registry entry that resolves it. Carve those out as a named category with its own quality target rather than trying to lift the average across everything.

Build the examination record as you go, because you cannot reconstruct it later.

An inspection two years from now asks about a specific customer on a specific date. Everything you need has to have been captured at the time, and most of it is not captured by default.

• Stamp the behaviour triple on every case. Model version, prompt version, tool and retrieval configuration, and the list version in force. Behaviour is that whole tuple, as rollout and versioning argues, and "we were using the current model" is not an answer to an examiner.
• Keep the evidence, not a link to it. Registry extracts, documents, article text, screening results — as retrieved, at decision time. Links rot on exactly the timescale examinations operate on.
• Record what the analyst changed. Where the human disagreed with the recommendation is your highest-value dataset: it is the drift signal, the training signal for the rubric, and the evidence that review is real. Capture the delta and a required reason, along the lines of annotation and labeling ops.
• Write the file for a reader who was not there. The rationale has to stand alone — no references to internal shorthand, no "as discussed". The test is whether a new analyst can reach the same conclusion from the file alone, and it is worth running that test on real cases before you scale.
• Expect the AI-specific questions now. Where the system falls under the EU AI Act's high-risk regime, the automatically generated logging duties apply on their own timetable — see the EU AI Act for agents — and they are additive to, not a substitute for, the financial-crime record.

Roll it out against closed cases, and keep the exit visible.

This is a domain with an unusually good backtest available: years of alerts with human dispositions attached. Use it, and be careful about what it does and does not tell you.

• Shadow against closed alerts first. Run the agent on historical cases and compare its recommendation with the analyst's disposition. Disagreements are the whole product of this phase — read every one, because a fraction of them will be cases where the agent is right and the historical file is wrong, and that changes the conversation.
• Do not treat past dispositions as ground truth. They contain the backlog pressure, the inconsistency and the rubber-stamping you are trying to fix. Agreement rate is a sanity check, not a target — judging with a model has the same ceiling problem.
• Then run in parallel with the analyst blind to the recommendation. Showing the agent's answer first anchors the human and destroys your measurement. A period where both work independently is the only clean read on whether the agent adds anything.
• Slice every metric by nationality, name origin and language. Screening systems fail unevenly across naming conventions, and a model layered on top can amplify that. Uneven false-positive rates across populations are a fairness problem and a supervisory problem at the same time, and the aggregate number hides both.
• Have a switch-off that leaves the queue workable. If the agent is disabled on a Monday, the team must be able to work the backlog manually. That means not letting headcount fall below the manual floor during the honeymoon, and it means practising the fallback — the argument in graceful degradation.
• Tell your supervisor before they find out. Model risk management expectations already apply; a financial-crime control that quietly acquired a language model is a much worse conversation than one that was described in advance with its validation evidence attached.

Related: finance agents for the broader function, insurance claims agents for the same evidence-then-decision shape in another regulated queue, audit trails for the record, and human-in-the-loop for why the approval must not become a formality.