AI for KYC and KYB: where agents help, and where a person decides.
Agents can read the documents, map the owners and clear the obvious screening hits. A person still makes the onboarding decision, and from July 2027 EU law says so. Here is where agents help, where they stop, and what we have actually shipped.
We have not shipped a KYC system. Our published fintech work is payment-compliance verification: a rules engine that checks documents before money moves. The workflow is the same shape as KYC and KYB, so this page explains how it carries over, without claiming a case we do not have.
Seven KYC and KYB tasks, split between the agent and the analyst.
The agent does the reading, matching and drafting. The decisions that change who you take on, or how much you trust them, stay with a person.
| Task | What an agent can do | Where a person decides |
|---|---|---|
| Document intake and classification | Sort what arrives (passport, utility bill, certificate of incorporation, register extract), reject unreadable or expired files, and ask the customer for what is missing. | Accepting a document the agent marked low-confidence. |
| Data extraction and cross-checks | Pull names, dates, numbers and addresses into fields, and flag where the form, the document and the registry disagree. | Resolving a mismatch that changes who the customer is. |
| KYB: entity resolution and ownership mapping | Match the business to its registry record, read filings, and draft the ownership tree with every path to a 25% or larger stake, plus the people who control it. | Confirming the beneficial owners and the control person on file. |
| Sanctions and PEP screening triage | Group screening hits, rule out the obvious false positives on date of birth, nationality and spelling, and attach the evidence for the rest. | Clearing or escalating any hit that is not plainly false. |
| Adverse media | Read the articles a search returns, discard name-only matches, and summarise what is left with links. | Judging whether a story changes the customer's risk. |
| Case-file assembly | Put the documents, extracted data, screening results and open questions into one file in the order your analysts review them. | The onboarding decision itself. |
| Ongoing monitoring and refresh | Track expiring documents and periodic-review dates, re-run screening, and open a refresh case with what changed. | Changing the risk rating or ending the relationship. |
Two things an agent should not do: make the onboarding decision, and decide what your risk appetite is. Both are written down in your policy and owned by a named person. The agent works inside that policy, with a confidence threshold below which it stops and asks. For how we set those thresholds, see our escalation matrix.
Regulators allow automation. They do not allow an unaccountable decision.
The rules below are what we design an onboarding agent against. Each was read on its own page; this is a summary, not legal advice.
United States: FinCEN customer due diligence rule
Covered institutions need written procedures for four things: verifying customer identity, identifying and verifying the beneficial owners of legal entity customers (anyone with 25% or more of the equity, plus one person with significant control), understanding the nature and purpose of the relationship, and ongoing monitoring.
FinCEN CDD final rule · 31 CFR 1010.230 (checked 22 Oct 2026)
European Union: the AML Regulation (EU) 2024/1624
Applies from 10 July 2027 for most obliged entities. Article 76(5) allows decisions from automated processes and AI systems only if the data is limited to what customer due diligence collected, any decision to start, refuse or keep a relationship (or to raise or lower due diligence) has meaningful human intervention, and the customer can get an explanation and challenge it. The new EU authority, AMLA, was set up on 26 June 2024 and starts direct supervision during 2028.
Regulation (EU) 2024/1624 on EUR-Lex · About AMLA (checked 22 Oct 2026)
United Kingdom: FCA and the Money Laundering Regulations
Firms apply risk-based customer due diligence, monitor customers continuously, give overall responsibility for anti-money-laundering systems to a director or senior manager, and assess the risks of new technology before launching it.
FCA: Money Laundering Regulations (checked 22 Oct 2026)
FATF: Guidance on Digital ID (6 March 2020)
Before relying on a digital ID system for customer due diligence, understand its assurance levels (technology, architecture and governance) and decide whether it is reliable and independent enough for the risks involved.
FATF Guidance on Digital ID (checked 22 Oct 2026)
Buy the identity check. Build the workflow around it.
The regulated step of checking that a document is genuine and the person is present is a product category of its own. We do not rebuild it.
Document and biometric verification is sold by specialist providers such as Persona, Onfido (now part of Entrust) and Sumsub, and identity-decisioning platforms such as Alloy orchestrate checks across several data sources. They have the certifications, the document libraries and the liveness checks, and your examiner already knows how to review them. If you have one, keep it.
What those products leave to your team is the work around the check: chasing missing documents, researching who owns a business three holding companies up, clearing screening hits, writing the case file and running the periodic review. That is where analysts spend their hours, and it is what we build agents for. They call your provider through its API, read its results, and hand a prepared case to a person.
If you are still choosing between building, buying and embedding engineers for this, our build vs buy vs embed comparison walks through the trade-offs.
Payment-compliance verification, and why it carries over.
A seed-funded US construction payments startup needed every payment held until its compliance pack verified. We built the rules engine that does it.
Before any payment releases, the platform checks the lien waiver (signed, for the right amount and period), the insurance certificate (current and meeting contract minimums), the contract and draw terms, and that the previous payment settled. Each rule returns pass or fail with a specific reason. In its first year the platform processed $41.2M; 94.6% of compliance documents verified automatically and the remaining 5.4% were flagged for a person. It launched with audit logging, role-based access and encrypted storage, and passed a third-party penetration test.
That is not KYC. It is the same shape, and the parts map one to one:
| Step | Payment compliance (shipped) | KYC and KYB onboarding |
|---|---|---|
| Document check | Lien waiver, insurance certificate, contract and draw terms | ID document, proof of address, registry extract, ownership filings |
| Rule gate | Explicit rules return pass or fail with a reason before money moves | Your written CDD policy as rules: required documents, thresholds, risk triggers |
| Exception queue | 5.4% of documents went to a person with the reason attached | Low-confidence extractions, screening hits, ownership gaps |
| Human approval | Payment releases only when every rule passes | An analyst decides to onboard, refuse or escalate |
| Audit trail | Every check and decision logged for review | Every step, source and decision kept for the examiner and the record-retention period |
The full numbers are in the case study, B2B payment platform: $41M processed in year one.
Start with one step of onboarding, at a published price.
No new offer and no hourly estimate. These are the same fixed prices as everywhere else on the site.
- AI Transformation Sprint, $25,000, 2 weeks: we map your onboarding workflow and policy, size the analyst hours per step, and end with a deployed pilot on the step with the most hours behind it. How the Sprint works.
- Gigabit Agents, from $8,000 · flat, per agent: the production agent for that step, built with your provider, your case tool and your audit log. The agent catalog.
- AI Security Assessment, from $12,000 · fixed: for an agent that reads identity documents, the test for prompt injection and data leakage that a partner bank or auditor will ask about. What it covers.
- Managed AI Operations, $3,000–$20,000/mo: monitoring, accuracy checks and updates when your policy or a provider changes. Managed operations.
We will not build an agent that onboards or rejects a customer by itself, and we will not describe a screening model as compliant. We build the preparation, the evidence and the audit trail, and a named person on your team makes the call.
Questions compliance teams ask
Have you built a KYC system?
No, and we do not claim one. Our published fintech work is payment-compliance verification: a rules engine for a construction payments platform that checks lien waivers, insurance certificates, contract terms and prior settlement before any payment releases. 94.6% of documents verified automatically and the other 5.4% went to a person. The same pattern of document check, rule gate, human approval and audit trail is what a KYC or KYB workflow needs, which is why we describe it here.
Can an AI agent approve or reject a customer on its own?
It should not, and in the EU it cannot. From 10 July 2027, Article 76(5) of the AML Regulation requires meaningful human intervention in any automated or AI decision to start, refuse or keep a business relationship, and lets the customer ask for an explanation and challenge it. We build agents that prepare the decision and a person who makes it.
Do you replace our identity verification provider?
No. Document and biometric checks are bought from specialist providers such as Persona, Onfido (now part of Entrust) and Sumsub, and decisioning platforms such as Alloy sit alongside them. We integrate with the one you use and build the workflow around it: the exception queue, KYB research, case files and periodic refresh.
Where does an agent save the most time in KYB?
Usually in ownership research and screening triage. Mapping who owns 25% or more of a business through layers of holding companies, and clearing sanctions and PEP hits that are plainly false, are slow for analysts and well suited to an agent that drafts the answer with its evidence attached for a person to confirm.
What does it cost to build?
It starts with the AI Transformation Sprint: $25,000, 2 weeks, mapping your onboarding workflow and ending in a deployed pilot on one step. A production agent is a flat fee from $8,000 per agent. Agents that handle personal data usually also get the AI Security Assessment (from $12,000 · fixed), and Managed AI Operations ($3,000–$20,000/mo) keeps them accurate after launch.
How do you keep customer data safe?
Agents only see the data collected for due diligence, every action is logged, and access follows your roles. The payments platform we built launched with audit logging, role-based access, encrypted storage and documented change management, and passed a third-party penetration test after two medium findings were fixed.
From the field notes
Bring the onboarding step your analysts spend the most hours on.
We'll map it against your policy, show where an agent prepares the case and where your team decides, and say what it costs.