Account opening automation means software that runs the checks on a deposit application and opens the account without a person, when the results allow it. It can run almost every step of a consumer opening: reading the form, checking sanctions lists, verifying identity, reading a checking account report, delivering disclosures and holding the opening deposit. What it should not do is decide alone where the rules or the risk call for judgement: refusing an applicant on an automated identity hit, sending an adverse action notice, or opening an account outside the bank's written appetite. The useful question for a buyer is therefore not "how much is automated" but "what is each automated step allowed to do, and who takes over when it stops". Botminds' Deposit Account Opening answers it with eight agents, each with written limits the bank owns; this page sets out that limits matrix, and the standards it rests on.
The standards are quoted from NIST, the Federal Reserve, FATF, the GAO and US rules, linked where they appear. The sample screens and figures come from a fictional bank, Corvane National Bank.
The limits matrix: what each account opening agent may do alone, must never do, and hands to
Application Reader
May do aloneRead the application as it is typed, at the desk or online, and keep one application file the other agents work from.
Must neverAsk the applicant for anything outside the form.
Hands toEvery other agent
Lists agent
May do aloneCheck OFAC and the 314(a) list the moment a name is entered.
Must neverClear a potential match.
Hands toSanctions team for OFAC; the BSA officer alone for 314(a)
Identity agent
May do aloneCheck the ID and the selfie, verify the data on two sources, propose how a discrepancy is resolved.
Must neverResolve a mismatch on its own; a selfie match under the bank’s threshold refers.
Hands toDeposit operations specialist
Screening agent
May do aloneRead the checking account report and test each entry against the second-chance policy.
Must neverDecline anyone; fraud-type entries always go to a person.
Hands toDeposit operations specialist
Funding agent
May do aloneVerify the card or ACH account, check device and velocity, hold the deposit.
Must neverCapture funds before approval; signals over the threshold go on with evidence.
Hands toFraud team; a team lead to release a hold
Disclosure agent
May do aloneDeliver E-SIGN consent, Regulation DD and E disclosures and the privacy notice, and log versions and times.
Must neverPre-select overdraft opt-in, or let an account open without delivered disclosures.
Hands toConsumer compliance officer for wording
Decision agent
May do aloneOpen an application whose every result is inside the bank’s written limits; write up every other one with one reason.
Must neverAct outside the limits, or open a referral without a person’s approval.
Hands toSpecialist as maker, team lead as checker
Notice agent
May do aloneDraft adverse action notices and offer letters from approved wording, and flag risky words.
Must neverSend without a maker and a checker, or mention 314(a), a SAR or a fraud referral.
Hands toMaker and checker; compliance owns the wording
Can account opening be fully automated?
A clean consumer application can be opened without a person; a whole account opening operation cannot responsibly be. The difference is the applications that do not resolve on their own: an identity that matches one source but not another, a name close to a sanctions listing, an old overdraft on a checking account report, a deposit from a card in someone else's name. Each needs judgement the rules expect a person to exercise, or a notice a person must stand behind.
The standards say so plainly. NIST's 2025 identity proofing standard says a provider using automated one-to-many biometric searches may not decline anyone's enrollment until a person has reviewed the automated result (NIST SP 800-63A-4). FATF's 2021 review of new technologies concluded that people reviewing and judging the output remain essential (FATF, 2021). The EBA's remote onboarding guidelines, an EU standard but a useful pattern, ask firms to write down which steps run with no person involved and which need one (EBA/GL/2022/15; its exact words are below). A limits matrix is that statement, written down per step.
What full automation looks like at the sample bank, and what it leaves to people
89%
of completed applications opened inside the bank’s limits, the design target
178
referrals on one sample day, each with one reason, sent to a person
0
applicants declined by an agent: every refusal is a person’s decision
2
people on every referral, offer, decline and notice: a maker and a different checker
AI account opening: where the limits come from
The limits for AI in account opening come from three places: rules that require a specific human act, standards that set a human checkpoint, and the bank's own risk appetite. Each line of the matrix traces to one of them, and a buyer should ask any vendor which one.
Rules. If a bank acts against an applicant because of a consumer report, the Fair Credit Reporting Act requires a notice with specific content (15 U.S.C. 1681m(a)); someone at the bank must stand behind it, so the Notice agent drafts and two people approve. The CIP rule requires the bank's file to describe how each substantive discrepancy was resolved (31 CFR 1020.220), so the Identity agent proposes a resolution and a person makes it. Regulation E requires the customer's affirmative consent before overdraft fees on ATM and one-time debit transactions (12 CFR 1005.17), so the Disclosure agent never pre-selects the opt-in.
Standards. NIST's manual review rule becomes "the Identity agent never resolves a mismatch on its own, and a selfie match under the bank's threshold refers". Appetite. Everything else, the seven-year screening window, the $500 card funding cap, the second-chance criteria, is the bank's decision, written as limits the agents cannot change.
Who approves an automated account?
Nobody approves an account the agents open inside the limits, one by one; the bank approves the limits themselves, in advance, and a person approves every account outside them. That moves the human decision from the single file to the rule, which is where a bank's risk appetite properly sits, and it makes the rule the thing to test.
In the solution, a limit change is proposed by the head of deposit operations, replayed on the last 30 days of applications, and approved by the BSA officer; the system blocks anyone from approving a change they proposed. In the sample, a proposal to raise debit card funding from $500 to $1,000 would have opened 396 more applications automatically over 30 days, about 13 a day, lowering the referral rate from 11.0% to 10.2%. Two of those 396 later proved to be funding fraud, $1,640 in all, and nothing changed in identity, list or screening outcomes. That is the trade the BSA officer signs.
A limit change, replayed on 30 days of applications before anyone approves it
Where the agents stop and people start, on every application
Agent
Checks run onceLists, identity, screening, disclosures and funding run as the data arrives, each result with its source and confidence.
Agent
Limits appliedThe Decision agent opens the application only if every result is inside the bank’s written limits.
Never: opens a referral without a person’s approval.
A person decides
Specialist decidesOpens, offers a different account, declines or asks for more, with a reason code; an override needs a reason and a note.
A person decides
Team lead checksApproves or returns the decision and the drafted notice; the system blocks anyone from checking their own item.
A person decides
BSA officer owns the limitsApproves every limit change after it is replayed on 30 days of applications; restricted matches reach only that seat.
Automated account opening compliance: the model-risk question
A bank automating account opening will be asked how it governs the automation, and the 2026 answer is that it must design that governance itself. The Federal Reserve, OCC and FDIC replaced their model risk guidance on April 17, 2026 with SR 26-2, and the new guidance carves out exactly this kind of system: it puts generative and agentic AI outside its scope and leaves their controls to each bank's own risk management and governance (SR 26-2; agentic AI for KYC reads the passage in full). Europe's banking authority had already said what such governance should write down.
These policies and procedures should be risk-sensitive and set out at least: … which steps are fully autonomized and which steps require human intervention.
European Banking Authority, Guidelines on the use of remote customer onboarding solutions, EBA/GL/2022/15, paragraph 9
That leaves the bank's own framework to cover agents, and the regulators' own practice is a fair benchmark. The GAO found that financial regulators using AI in their own work never let it decide alone or relied on it as their only input (GAO-25-107197; AI in enhanced due diligence applies the same line to reviewers). In Deposit Account Opening each agent has a version, an owner and a confidence threshold, is measured against a golden set of 400 applications, and runs in a new version only after the bank's own reviewers approve it; overrides of its proposals carry reason codes so the bank can see where people disagree with it.
The case against unsupervised automation has an enforcement record too. In an April 2026 consent order, the OCC found that a bank's automated alert triage, because of flaws in its logic, data and method, had closed on its own a very large share of the alerts it received, including ones that should have gone to a person (OCC AA-ENF-2025-21). The order concerned monitoring, not account opening, but the lesson transfers: an automated step that can close a matter without a person needs a limit, a measure and an owner.
Digital account opening without video KYC: what replaces the call
No US rule requires a video call to open a consumer deposit account, so the question is which automated checks stand in for one, and where each stops. In Deposit Account Opening the answer is layered: the Identity agent checks the document's authenticity and the selfie's match and liveness, verifies the data on two independent sources, and refers any selfie match below the bank's threshold, 0.95 at the sample bank, to a person with a proposed request, such as a new selfie or a second ID.
The Funding agent adds a second line of evidence a video call would not give: whether the card or account funding the deposit is in the applicant's name, and whether the device has started other applications. In the sample queue, an applicant whose license was authentic but whose selfie matched at 0.91 was referred with exactly that sentence, and the specialist's choice was to ask for a new selfie, not to refuse. A video step can still be one of the bank's options for an unresolved case; the limits matrix simply says it is a person's option, not the agent's.
What regulators say about trying automation at all
Regulators have said for years that trying new technology is not itself a supervisory risk. The 2018 joint statement of the five federal agencies said that a pilot should not, on its own, bring supervisory criticism, even if it fails (joint statement, 2018). FinCEN's April 2026 proposal for AML programs goes further, if finalized: an institution that experiments responsibly with new technology would face no added risk of significant supervisory or enforcement action merely for using it (91 FR 18704). It is a proposal, not a rule, as of October 2026.
Responsibly is the operative word, and it is what the matrix documents. A bank can show its examiner the limits, the replay behind each change, the version of each agent that ran on a sampled file, and the person who decided every referral.
Every action by a person or an agent, with its reason and evidence
What to ask any account opening automation vendor
A buyer can test any account opening automation, including ours, with the same questions. The answers should be specific enough to write into a procedure, and demonstrable on the bank's own past applications rather than a vendor's sample.
Ten questions for an account opening automation vendor
- Show me the written limit for each automated step
What it may do alone, what it never does, and who it hands to; not a percentage of automation.
- Can the system decline an applicant without a person?
NIST’s standard requires manual review before an automated biometric hit declines anyone; the safe answer is no.
- Who sends the adverse action notice, and from what wording?
The FCRA content is fixed; the wording should be the bank’s, approved by compliance, with two people before it goes.
- How is an identity discrepancy resolved and recorded?
The CIP file must describe the resolution; ask to see one.
- Where do potential sanctions and 314(a) matches go, and who can see them?
Never cleared by software; 314(a) kept to those who need it.
- Is the opening deposit held or captured before approval?
Held, so a refused applicant’s money has not moved.
- Who can change a limit, and what evidence do they see first?
A replay on recent applications, and a different approver from the proposer.
- How is each agent versioned, measured and approved?
SR 26-2 leaves agentic AI to the bank’s own governance; the vendor should fit it.
- What does a referral look like to the specialist?
One reason, the evidence and the action policy allows, or a code to investigate?
- Can you run it on our last month of applications before we sign?
Your own referrals are the only honest benchmark.
Where Deposit Account Opening fits, and where it does not
Deposit Account Opening fits a bank or credit union that already has a digital account opening platform, an identity verification service, a screening service and a core, and wants the checks across them to run once, the clean applications to open inside its own limits, and every referral to arrive written. It works with those systems rather than replacing them; digital account opening software that integrates with the core sets out how.
It does not set a bank's risk appetite, make sanctions decisions, file suspicious activity reports or replace the fraud team; those stay with the people who own them, and the solution hands them evidence. Nor is it the place to start for a bank without a written second-chance policy or adverse action wording: the agents apply the bank's policy, so the policy has to exist. The standard the identity checks are measured against is set out in NIST identity assurance levels for account opening, and the applicant's side of a refusal in why a bank account application is denied. To run the matrix on your own past applications, start from Deposit Account Opening.
Questions people ask
Is it legal to open bank accounts automatically without a person?
Yes. No US rule requires a person to approve each consumer account. The rules govern what must be collected, verified, disclosed and recorded, and some outcomes, such as a refusal based on a consumer report, carry duties a person at the bank must stand behind.
Can AI decline an account application?
It should not on its own. NIST's identity proofing standard bars declining an enrollment on an automated biometric hit without a manual review, and any decline based on a consumer report needs an adverse action notice. In Deposit Account Opening no agent declines anyone; a specialist decides and a team lead checks.
Does SR 11-7 apply to AI agents in account opening?
No longer. SR 26-2, issued on April 17, 2026, superseded SR 11-7 and SR 21-8, and it states that generative and agentic AI models are not within its scope. A bank's own risk management and governance must cover them, which is why versioning, measurement and approval of each agent belong in the bank's framework.
What is a reasonable straight-through rate for account opening?
It depends on the bank's appetite and its applicants, which is why the rate should follow from written limits rather than be chosen first. Deposit Account Opening's design target is 89% of completed applications opened inside the bank's limits; a replay of any proposed limit change on 30 days of applications shows what it would change before anyone approves it.
How do you keep automated account opening consistent and fair?
By writing the limits and the second-chance policy down, applying them identically to every applicant, and recording each referral's reason and decision. When the same facts always produce the same proposal, and an override needs a reason code, the bank can show that decisions were individual and objective rather than dependent on who read the file.