Choosing an AI agent for KYC/AML evidence: a buyer's checklist

A demonstration of an AI agent for KYC usually ends on a clean summary: the entity verified, the owners identified, no sanctions hits, a suggested risk rating. The summary is the least useful thing to evaluate. What matters is whether your officers can check it, challenge it and defend the decision that follows, months later, to someone who was not in the room.

This checklist is for compliance, risk and operations leads evaluating agents that prepare onboarding evidence for human review. It does not rank products. Each item says what to require and how to test it with your own cases.

The rules point the same way. The EU Anti-Money Laundering Regulation, which applies to most of the firms it covers from 10 July 2027, sets conditions for decisions that result from automated processes or AI systems (Article 76(5)). Among them, decisions to enter, refuse or maintain a business relationship, to carry out an occasional transaction or to increase or decrease due diligence must be subject to meaningful human intervention, and the customer can obtain an explanation and challenge the decision, except in relation to a suspicion report. For remote onboarding, the EBA guidelines already ask institutions to set out which steps are fully automated and which require human intervention, and to monitor the solution's ongoing adequacy and reliability.

An agent fits that model only if the human intervention is real: the officer can see what the agent did, test it and change the outcome. The ten items below are how to find out.

1. Every material fact links to its source

An agent's output should not be a narrative that blends what a document says with what the agent concluded. For each material fact, such as the legal name, registration number, signing authority, an ownership percentage or the stated purpose, the record should point to the source it came from, when that source was retrieved, and whether it is an official record, a customer statement or a third-party report.

Test it: pick three facts from the output and open their sources. If you cannot get from the fact to the page or record that supports it, neither can an examiner.

2. Gaps are stated, not filled

Agents are good at producing complete-looking answers. A KYC file is not always complete. Require the agent to say what it could not establish: a document that was not provided, a register it could not reach, an ownership layer it could not resolve, two sources that disagree. "Not found" and "not checked" must be different states.

Test it: give the agent a case with a missing ownership document and a register extract that contradicts the customer's ownership chart. The output should name both problems, not average them away.

3. Screening is kept as a query, not a verdict

"No sanctions hits" is a conclusion without its method. The record should keep who was screened, which names, aliases and identifiers were submitted, which lists or sources were used, when the query ran and what came back. Each possible match needs a disposition with a reason and the evidence used. Our note on KYC evidence review beyond name screening explains why a cleared name establishes so little on its own.

Test it: ask for the screening record of a party with a common name. You should see the query and each possible match with its disposition, not a single status.

4. Sources, findings, inferences and judgments stay apart

A useful record keeps distinct what a source says, what a defined check found, what the agent inferred and what a person decided. When they are merged, a reviewer cannot tell whether to challenge the source, the check, the inference or the judgment. Audit-ready evidence packs sets out these layers in more detail.

Test it: find one inference in the output, for example that two records describe the same company or that a holding passes a control threshold. The record should show it as an inference and show what it rests on.

5. The agent prepares; a named person decides

The agent should not hold approval authority. It can propose a risk rating or recommend a disposition, but the decision to onboard, refuse, escalate or apply enhanced due diligence belongs to a person with the authority to make it, recorded with their role and rationale. If the agent can approve or refuse a customer on its own, there is no human decision left to examine.

Test it: ask to see which role approves a case and which permissions the agent itself has.

6. Challenge and return are part of the record

Four-eyes review adds assurance only when the checker can disagree. The system should let a checker return a recommendation with a question, and keep the original recommendation, the challenge, the answer and the final approval with the people who made them. Our walkthrough of a challenged four-eyes review follows one such exchange.

Test it: return a case during the demonstration, answer the question, then read the history. All of it should still be there.

7. A gap is accepted only on the record

Some gaps cannot be closed before a decision. An accepted gap needs a rationale, the alternative evidence relied on, the person who accepted it and any condition, such as an expiry or a trigger for review. It cannot waive due diligence the law requires, and it must not quietly disappear when the case is approved. The KYC case walkthrough shows a gap kept visible while the case proceeds.

Test it: try to approve a case with an open request for information. The system should make you deal with the open item first.

8. A second officer can reconstruct the decision

The test of a KYC record is whether another authorised officer, months later, can see what was known, what was uncertain, which policy applied and who decided, without the original reviewer. That needs versions and snapshots: what the reviewer saw at the time, not the current state of the file. See reconstructing a customer approval for the test applied to one case.

Test it: replace a document after approval and check that the record still shows the version the decision relied on.

9. The audit trail is tamper-evident, and its limits are stated

Ask how records are protected after the fact. A hash-chained audit trail can make later changes to recorded events detectable, provided the reference values are kept where whoever writes the trail cannot change them; with write access, a whole chain can be recomputed. Even then, it does not prove that every event was recorded, that a source was authentic or that a conclusion was right.

Test it: ask where the reference values are kept and who could rewrite them, what verification shows if a recorded event is altered, and which controls show that the required events were recorded at all.

10. You know where data goes and what the models do with it

Ask where customer data is processed and stored, which subprocessors see it, whether it can be used to train models, and whether you can choose or change the model provider. Get the answers in the contract, not only on a security page.

Test it: ask for the subprocessor list and the contract clause on model training.

What should stay human

An agent can gather, compare, extract and draft. These decisions stay with people who hold the authority and answer for them:

• entering, refusing, maintaining or ending a business relationship;
• raising or lowering the level of due diligence;
• accepting an evidence gap or a residual risk;
• disposing of a material screening match or adverse-media item;
• escalating to the MLRO, and any decision about reporting suspicion;
• setting the risk appetite and the policy the agent works under.

Run the checklist on your own cases

A demonstration on a vendor's sample case shows the product working on the case it was built for. Bring three of your own, prepared under your data policy: a clean case, a case with an ownership gap and a case with a possible screening match. Score each item above as shown, partly shown or not shown.

How cmpliance approaches this

cmpliance is built on the same division of labour: agents prepare the evidence for review, and officers decide. cmpliance is assembling this operating model around current components for source records and source-linked facts, screening context and dispositions, evidence-quality checks, contradictions, RFIs and reviewer-state controls, with maker, checker and escalation roles and the rationale attached to state changes. Separate evidence-pack components can assemble those records with artifact and manifest hashes, version identifiers and audit-chain verification. The claim here is the operating model and its verified components, not a fully connected production sequence from acquisition to evidence pack. We do not use Customer Data to train public or foundation AI models.

Hold us to the same checklist. Bring us the evidence gaps and handoffs your onboarding team finds hardest to defend.

Agents do the work. Humans make the call.

Talk to cmpliance