Agentic AI for KYC is the use of software agents, AI systems that can read documents, call tools such as registries and screening services, draft text and check their own and each other's work, to do the assembly and cross-checking in a KYC file while people make the decisions. On a corporate file that division is natural: most of the hours go to gathering registry extracts, building ownership structures, chasing documents and writing up figures, and a small share goes to judgements a bank must own, such as clearing a screening match, accepting a rating or approving a client. Botminds' Corporate KYC is built that way: seven agents gather, write and check each chapter, and the KYC analyst signs while a QC reviewer approves.
Examples on this page come from a fictional bank and client, Corvane National Bank and Brightwater Cold Chain Holdings, as their file runs through the solution. Regulatory statements are quoted from the agencies' own documents, and proposals are marked as proposals.
Where US regulators stand on AI in KYC, in October 2026
2018
year five agencies said a failed innovation pilot is not by itself grounds for criticism
Apr 2026
FinCEN proposal, not final: responsible innovation would add no additional enforcement risk
Out of scope
generative and agentic AI, under SR 26-2, the April 2026 model risk guidance
None
of the regulators using AI told GAO they let it make decisions autonomously
What agentic AI for KYC means, and how it differs from earlier automation
Agentic AI differs from earlier KYC automation in what it can handle. Rules engines and robotic process automation move structured data from one field to another and fail on anything unexpected; optical character recognition reads a document but does not understand it. An agent can read an operating agreement, notice that a fund holds 34% through a general partner, ask a registry for the general partner's filing, draft a paragraph explaining who must be identified and cite the page it relied on. It can also be wrong in fluent prose, which is why the design question is not what agents can do but what they are allowed to do alone.
US agencies already describe AI in this work. Treasury's December 2024 report on AI in financial services, drawn from 103 comment letters, says AI is widely used for "verifying customer identities under Bank Secrecy Act (BSA) obligations," and that generative AI is already used to gather and summarise data and to produce reports automatically (Treasury, AI in Financial Services, 2024). Collating, summarising and drafting are most of a corporate KYC file.
Can AI do KYC? Which corporate KYC tasks can be automated, and which cannot
AI can do most of the work in a corporate KYC file and none of the decisions. Every task with a right answer, fetching a record, reconciling a certification to a register, copying volumes from statements, screening a name, can be done by an agent and checked by another. Every task that commits the bank, clearing a match, accepting an exclusion, signing a chapter, approving the file, stays with a named person. The grid below is how Corvane divides one corporate file.
One corporate KYC file, nine tasks: what agents do and what people decide
Pull company records for every entity
What the agent doesRegistry agent fetches extracts across states and countries, keeps them under 90 days old
Who decides—
WhyA right answer exists; no judgement
Build the ownership structure
What the agent doesOwnership agent reads the stock register, certification and look-through letters; finds who must be identified
Who decidesAnalyst confirms any exclusion
WhyAn exclusion removes a person from scrutiny
Ask the client for what is missing
What the agent doesOutreach agent merges every gap into one request and drafts reminders
Who decidesAnalyst approves before it is sent
WhyClient contact is a relationship decision
Write nature, purpose and expected activity
What the agent doesWriter agent drafts each chapter with a source on every sentence
Who decidesAnalyst reads and signs as maker
WhyThe signature is the bank’s judgement
Cross-check the chapters
What the agent doesChecker agent, on another model family, disputes what does not hold, with the clause and sources
Who decidesAnalyst fixes, overrides with a reason or asks the client
WhySettling a dispute is a decision
Screen every party
What the agent doesScreening agent screens and proposes clearances on identifiers
Who decidesAnalyst confirms or escalates; sanctions team takes true matches
WhyClearing a match is never automatic
Rate the relationship
What the agent doesRisk rating agent scores on the bank’s model, every factor cited
Who decidesAnalyst signs; an override needs a reason code and QC
WhyThe rating sets monitoring and review
Approve the file
What the agent does—
Who decidesQC reviewer; Financial Crimes Compliance at the high-risk line
WhyApproval is the bank’s accountable act
Change a threshold, prompt or model
What the agent does—
Who decidesBSA officer, after a run on a golden set of 240 past files
WhyThe bank governs its own tools
Two design choices in the grid matter more than the agents themselves. The Checker agent runs on a different model family from the agents whose work it checks, so the two are less likely to share a blind spot, and it can only dispute, never edit. And every sentence an agent writes carries a source a person can open, so the analyst's signature means she read the evidence, not the summary. On the sample file the Checker's disputes found the two real gaps: expected activity written on last year's statements, and a Mexican subsidiary that would receive wires but had never been screened.
Do regulators allow AI for KYC?
Yes. No US rule forbids using AI in KYC, and the agencies have encouraged it since 2018, while keeping the bank responsible for the outcome. The December 2018 joint statement of the Federal Reserve, FDIC, FinCEN, NCUA and OCC noted that "some banks are also experimenting with artificial intelligence and digital identity technologies," and told banks that a pilot which fails is not, by itself, a reason for supervisory criticism (Joint Statement on Innovative Efforts, 2018). The same agencies said they would not penalise banks that choose not to innovate.
The 2026 proposals go further, though neither is final. FinCEN's April 2026 AML/CFT program proposal says an institution that experiments responsibly with new technology would carry no extra risk of a significant supervisory or enforcement action just for using it, and names "machine learning, generative artificial intelligence (GenAI), digital identity" among them (FinCEN, 91 FR 18704). The Federal Reserve's July 2026 proposal repeats the language and stresses that it does not require any technology (Federal Reserve, July 7, 2026). Treasury's Under Secretary for Terrorism and Financial Intelligence put it more bluntly in 2025: a team that uses AI to cut false positives "should be celebrated, not written up" (Treasury, September 17, 2025).
Who governs KYC agents now that SR 26-2 excludes them?
The bank governs them, under its own risk management, because the agencies' model risk guidance no longer reaches them. SR 26-2, issued on April 17, 2026 by the Federal Reserve, OCC and FDIC, replaced both SR 11-7 and the 2021 interagency statement on model risk for BSA systems, and drew a line around generative and agentic AI.
In the guidance's words: "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance. Nonetheless, a banking organization's risk management and governance practices should guide the determination of appropriate governance and controls for any tools, processes, or systems not covered in this document" (SR 26-2). The guidance itself is aimed mainly at organisations over $30 billion in assets. For a bank buying agentic KYC, that means there is no checklist to borrow: the bank has to write down how it approves, tests and changes its agents, and an examiner will ask to see it.
In Corporate KYC that governance is concrete. Agents are versioned; a new prompt or model runs on a golden set of 240 past files before the BSA officer approves it; every threshold, from the risk bands to the screening agent's 0.95 confidence floor for proposing a clearance, is a versioned setting that takes effect only on the BSA officer's approval. None of that is a regulatory requirement; it is what the SR 26-2 carve-out leaves banks to supply.
What went wrong when automation ran unsupervised
The clearest recent warning is not about KYC agents but about automation without supervision. In April 2026 the OCC entered a consent order against Community Federal Savings Bank. The OCC found that the bank's automated alert triage system had flaws in its logic, data and method, so it closed by itself alerts that should have gone to a person, and in the end closed a very high share of all the alerts it took in (OCC, AA-ENF-2025-21; the buyer's lessons are in KYC refresh software).
The same order found the bank's customer due diligence program "ineffective," so that it did "not understand the nature of certain of its customers' businesses and the purpose of the transactions." The two findings belong together. Automation that closes things on its own, on top of a file that cannot explain the customer, compounds the gap. The design response is the one in the grid above: agents may propose a closure, a clearance or a rating, but a named person decides, and the file explains the customer in cited prose.
Human in the loop, as regulators and researchers define it
Regulators and researchers converge on one pattern: machines do the volume, people make and own the decisions, and the bank can say which is which. FATF's 2021 study of new technologies found they can make AML work quicker, cheaper and better, but that people reviewing and judging the output still matter a great deal, and that systems pairing digital tools with expert analysts are sturdier and easier to audit and hold to account (FATF, 2021; AI in enhanced due diligence follows that line into the hardest reviews). The European Banking Authority's remote onboarding guidelines ask firms to state which steps run with no person involved and which need one (EBA/GL/2022/15), a useful discipline for US banks even though it is not US law.
Research on face identification gives the pattern an empirical footing. A NIST-led study published in PNAS in 2018 found that one trained facial examiner paired with one of the strongest algorithms did best, better than two examiners together (NIST, 2018). And GAO found that the financial regulators themselves, where they use AI, neither let it decide alone nor rely on it as their only input (GAO-25-107197). A KYC design that lets agents draft and propose and a person decide is consistent with all three.
The Screening agent proposes a clearance on identifiers; the analyst decides
Will AI replace KYC analysts?
The evidence points to a change in the job rather than its disappearance. The Bureau of Labor Statistics projects compliance officers, the occupation that includes most KYC analysts, to grow 3.8% from 2025 to 2035, to 453,100 jobs, while new accounts clerks, who used to collect account-opening information, are projected to shrink 6.5% (BLS Employment Projections). Collection is what automation has always taken first; review and judgement are what the rules require a person for.
Four seats on a corporate file, and what each keeps when agents assemble it
Today
Assembles the file from registries, statements and emails, then writes it up.
With agents
Reads cited chapters, settles disputes, confirms or escalates screening proposals, signs as maker.
Still theirs: Every judgement in the file
Today
Finds the gaps at the end and returns the file.
With agents
Receives files with every chapter signed and every party screened; approves or returns with a reason.
Still theirs: Approval
Today
Owns policies the desk applies by hand, unevenly.
With agents
Approves every setting, prompt and model change, after a run on 240 past files.
Still theirs: Governance of the agents
Today
Phones the analyst for status; the client is asked twice.
With agents
Sees progress, never ratings or screening; the client is asked once.
Still theirs: The client, not the decision
What does change is the ratio of reading to writing. A corporate analyst's day with agents assembling the file is mostly reading cited chapters and deciding, and the analysts who will be valued are the ones who can read a structure chart, challenge expected activity and write a rationale an examiner can test.
What to look for when buying agentic AI for KYC
Buy agentic KYC on evidence, not demonstrations: on what the agents may not do, how their work is checked, and how the file reads to an examiner. The checklist below is what we would ask of any product, including ours.
Eight questions to ask of any agentic AI for KYC
- What may the agents never do?
Sign, approve, contact the client unapproved, clear a match, override the model. If the answer is “it depends on configuration,” ask for the configuration.
- Does every sentence cite its source?
A reviewer must be able to open the passage behind each statement, not trust a summary.
- Who checks the agents, and on what model?
A checker on the same model shares its blind spots; one that can edit hides its corrections.
- Does it read chapters against each other?
Most real gaps sit between sections: a subsidiary in one, its wires in another, its screening in a third.
- Whose CDD standard and risk model does it apply?
Yours, versioned, with every change approved by your BSA officer.
- How is a change to a prompt or model tested?
On a fixed set of your past files, with the differences reviewed before release.
- What does the examiner receive?
Every chapter version, source, signature and dispute, with identifiers masked.
- Will it run on your closed files before you buy?
A pilot on files examiners already saw is better evidence than any demonstration.
Honesty about fit belongs in the same conversation. Corporate KYC builds and maintains the KYC file for commercial and corporate clients; it does not monitor transactions, triage alerts or decide on suspicious activity reports, and it does not replace a bank's client lifecycle management platform, core banking system or screening service, which it works alongside. It applies the bank's CDD standard and risk model rather than supplying its own. The best way to judge any of this is a pilot on files your bank has already closed.
How Corporate KYC divides one file between agents and people
On the sample file the division is visible in the trail. On the morning of day 6 the client's reply arrived at 10:42; within three minutes the Writer agent had redrafted expected activity and the Checker agent had disputed the screening chapter; by 11:05 the Screening agent had screened the new subsidiary, the analyst had confirmed one clearance and the Risk rating agent had re-rated the file from Low, 28 to Moderate, 46. The afternoon belonged to people: the analyst read and signed four chapters at 3:51, and QC approved at 4:12.
Expected activity in cited prose, with the Checker agent's dispute beside it
To see the seven agents, their limits and the people around them on one file, start from Corporate KYC.
Questions people ask
How is AI used in KYC in banking today?
Treasury's 2024 review of 103 comment letters found AI widely used to verify customer identities, detect anomalies and flag suspicious activity, and generative AI used to collate and summarise data and draft reports. In corporate KYC the newer use is agents that assemble and draft the file itself, with people reviewing and approving.
Where does AI fit in the KYC process?
In the steps with right answers: fetching registry records, reconciling ownership documents, drafting nature and purpose and expected activity from statements, screening names and scoring on the bank's model. The steps that commit the bank, accepting an exclusion, clearing a match, signing and approving, stay with people.
Can AI clear a sanctions screening match?
Technically it can propose one; whether it may decide is the bank's choice, and the safer design keeps that decision with a person. In Corporate KYC the Screening agent proposes clearances only above a confidence floor set by the BSA officer, and an analyst confirms or escalates; true matches go to the sanctions team.
Do we need regulator approval to use AI in KYC?
No approval is required to use a tool; the bank remains responsible for its AML program and must be able to show how the tool is governed. The 2018 joint statement encourages pilots and says a failed pilot is not by itself grounds for criticism, and FinCEN's 2026 proposal, not yet final, would add that responsible innovation brings no additional enforcement risk.
Is agentic AI the same as robotic process automation for KYC?
No. Robotic process automation repeats fixed steps on structured screens and stops when something unexpected appears. Agents read unstructured documents, decide which tool to call next and draft text, which makes them far more capable and also means their output must be cited and checked.