AI enhanced due diligence: agents draft the memo, people decide

AI enhanced due diligence means software agents doing the parts of an EDD file that are search, comparison and drafting: pulling twelve months of activity and the documents behind it, laying actual activity against what the customer declared, checking licenses and registrations, reading adverse media, drafting the memo with a source on every sentence, and reading it back the way an examiner would. The parts that are judgment stay with named people: whether the evidence explains the activity, the risk rating, any change to monitoring, and any exit. US regulators are encouraging the technology but have written no rule for it, and their model risk guidance now excludes generative and agentic AI, so the bank’s own governance has to draw the line. Botminds’ Enhanced Due Diligence (EDD) Review is built on it: the agents build, cite and ask; the analyst, the BSA Officer and the Chief Risk Officer decide.

Can AI do enhanced due diligence?

It can do most of the work and none of the deciding. Treasury’s 2024 report on AI in financial services, drawn from 103 comment letters, found AI already used to verify customer identities under the Bank Secrecy Act, and noted that “Generative AI has been deployed to complement an investigation platform in collating and summarizing data and automating report creation and filing” (US Treasury, December 2024). An EDD file is mostly collating, summarizing and reporting.

What it cannot do is own the conclusion. FATF’s review of new technologies put it in a sentence the rest of this page follows: technology can make AML “faster, cheaper and more effective”, “but manual review and human input remains very important”, and combining digital efficiency with “the knowledge and analytical skills of human experts produces more robust systems” that are “fully auditable and accountable” (FATF, Opportunities and Challenges of New Technologies, 2021).

What US regulators say about AI in EDD, as of October 2026

They encourage it, promise not to penalize responsible experiments, and have written no AI-specific rule. FinCEN’s April 2026 proposal to reform AML/CFT programs says that institutions that experiment responsibly with new technology would carry no added risk of a significant supervisory or enforcement action merely for using it, and it names generative AI among them (FinCEN NPRM, April 10, 2026). The Federal Reserve’s own proposal of July 7, 2026 repeats the language and adds that new technology “may not be suitable for all banks, particularly smaller ones” (Federal Reserve proposal, July 2026). Neither is final.

What is in force is older and narrower. The agencies’ 2018 joint statement on innovation says a pilot should not draw supervisory criticism on its own, even one that fails (joint statement, December 2018). Treasury’s Under Secretary for Terrorism and Financial Intelligence said in September 2025 that a team using AI to cut false positives deserves praise from examiners, not a finding (US Treasury, September 17, 2025). Encouragement is not a safe harbour: the bank still owns every decision the file supports.

Does SR 26-2 apply to AI agents?

No. The interagency model risk guidance issued on April 17, 2026, which replaced SR 11-7 and the 2021 BSA model risk statement, says so directly: generative and agentic AI are too new and moving too fast to sit inside it, and a bank’s own risk management and governance must decide the controls for them (SR 26-2; agentic AI for KYC reads the sentence in full). It is the most consequential carve-out for anyone deploying agents in BSA work.

Two consequences follow. A bank cannot point to model validation under SR 26-2 as the control for its agents, because the guidance does not reach them; the guidance is also aimed mainly at banking organizations over $30 billion in assets. And the bank must design the controls itself, which in practice means the controls a regulator would expect of any process that touches customer risk decisions: separation of duties, evidence for every conclusion, approval by accountable people, change control and an audit trail. A design that never lets an agent decide makes most of that simpler, because the decisions stay inside controls the bank already has.

Who must approve an EDD decision?

A named person with authority under the bank’s EDD policy, never the system and never the preparer. US rules do not name the approver for most customers, but the FFIEC judges banks on whether they have an effective customer risk decision-making process (FFIEC BSA/AML Manual, CDD), and a process in which software decides cannot show who exercised the judgment. Regulators hold themselves to the same standard, in GAO’s account of how the financial supervisors use AI.

Officials from all regulators that were using AI as of December 2024 told us they used AI outputs in conjunction with other supervisory information, such as examination reports and financial data, to inform staff decisions. They said they were not using AI to make decisions autonomously or relying on it as a sole source of input.

GAO, Artificial Intelligence: Use and Oversight in Financial Services, GAO-25-107197, May 2025

In the solution, approval is a chain with reasons. The analyst submits as maker and cannot approve her own file. The BSA Officer sees what approving would change, from the expected activity to the monitoring threshold and the next review date, and approves or returns with a reason code. For the relationships the policy names, and every exit, the Chief Risk Officer signs after. Only then is anything written to the core or the monitoring system.

The checker sees what approving would change, and signs with a reason

Can AI write an EDD memo?

Yes, if every sentence can be traced to what it came from and a person reads and signs it. The risk in a drafted memo is not that it is wrong in an obvious way; it is that it is fluent where the evidence is thin. Three controls turn a drafted memo into one an examiner can follow.

First, citation at the sentence level, to the passage, not the document. In the solution each sentence ends with labels for its sources, and each opens the line it came from. Second, a confidence floor with a question instead of a guess: when a scanned license amendment reads at 0.62 against the bank’s 0.80 floor, the memo does not assert coverage; it ends with one question for the analyst. Third, an adversarial read before approval, by a second agent instructed to find claims an examiner would reject. Whether the result is as reliable as a human-drafted file is measurable, and measuring reviewer agreement sets out how.

When a document will not read cleanly, the agents ask instead of asserting

The failure to design against: automation that closes things

The cautionary case in US enforcement is not an AI that wrote a bad memo; it is automation that was allowed to close work on its own. In its consent order against Community Federal Savings Bank, signed in April 2026, the OCC found that flaws in the logic, data and method of the bank’s automated alert triage led it to close, without a person, alerts that needed escalation, until it was closing a very high share of everything it received (OCC consent order AA-ENF-2025-21). In the same order the OCC found the bank’s customer due diligence program ineffective.

The design lesson for EDD is to give agents no terminal actions. An agent that can only propose cannot auto-close a file, auto-approve a rating, raise a threshold or send an exit letter. In the solution every such action is a request that waits for a person, and the monitoring threshold is written only after the last approval.

The same principle covers customer contact. A bank may not disclose a suspicious activity report or information that would reveal one (31 CFR 1020.320(e)). Agents can draft document requests and exit notices, but a relationship manager or the BSA Officer sends them, and every draft is checked for words that could reveal monitoring.

An exit is a recommendation until two people approve it, and its notice is checked

What to look for in an AI enhanced due diligence system

Look for proof that the system cannot decide, and that everything it produces can be checked. Most demonstrations show fluent memos; the questions below are the ones that separate a drafting assistant from a defensible process. They apply equally to Botminds’ product and to anyone else’s, and the solution does not do everything on the list around it: it relies on the bank’s monitoring system for alerts, its adverse media service for articles and a separate screening process for sanctions and politically exposed persons. The cost side of the decision is in EDD software vs outsourcing vs in-house.

Who does what when agents build the file

The roles do not disappear; their weeks change. The analyst stops assembling and starts judging. The BSA Officer approves from a summary of changes instead of reading a whole file to find them. Internal audit tests a trail rather than reconstructing one. Getting those roles and inputs ready is the go-live work, covered in what to have ready for EDD automation.

Questions people ask

Is AI allowed in EDD?

Yes. No US rule prohibits it, the 2018 joint statement protects responsible pilots from criticism, and FinCEN’s April 2026 proposal would add that responsible innovation carries no additional enforcement risk on that basis alone. The bank remains responsible for every decision, so people must approve them.

Can AI replace an EDD analyst?

It can replace most of the assembly and first drafting, not the judgment. FATF says manual review and human input remain very important, and US supervisors do not let AI decide autonomously in their own work. The analyst’s role shifts to testing the draft and answering what the agents could not settle.

Do AI agents need model validation under SR 26-2?

SR 26-2 says generative and agentic AI are outside its scope and that the bank’s own risk management and governance should set the controls. Many banks will still test agents against past files and monitor overrides, but that is their governance choice, not the guidance.

What is an EDD automated system?

Software that assembles an enhanced due diligence file, compares activity with expectations and drafts the memo, leaving the risk decision to people. The defensible versions cite every statement, ask when unsure, and cannot approve, close or write to systems of record.

Can AI do due diligence on adverse media?

It can search, separate articles about other people with the same name, and classify relevance, as the solution’s Adverse Media agent does across four sources with a 0.70 relevance threshold. Whether an article changes the risk rating is the analyst’s call, made with the article cited in the memo.

Who is accountable if an AI-drafted EDD memo is wrong?

The people who approved it, under the bank’s program. That is why the approver should see the sources behind each sentence and the weak claims the draft started with, and why every approval carries a name and a reason.