A KYC remediation project brings a defined set of existing customer files up to a bank's current CIP, CDD and EDD standard by a committed date, and it breaks down into nine repeated tasks: scoping, pulling and testing each file, searching the bank's own records, screening, drafting and pacing customer requests, reading replies, re-rating, checking batches, and deciding what happens to customers who never answer. By hand, most of the people-hours go to pulling, searching and writing. With agents doing those, the remaining hours go to checking and to conversations, which changes how many people a project needs and which kind. Botminds' KYC Remediation is built on that division: agents search, propose and draft; people decide, and a different person checks.
The arithmetic on this page uses KYC Remediation's own estimate of minutes per file and a fictional sample programme at Norrell Federal Credit Union, labelled where it appears. Regulatory statements on AI are linked to their sources; some are proposals, and are called that.
Where the people-hours go on one cohort of 5,614 business files: from searching to checking
By hand, every customer asked · about 8,900 hours
- Testing · 11%
- Searching · 26%
- Writing · 16%
- Chasing and calls · 21%
- Checking · 16%
- Updating · 10%
Agents search first, then ask · about 1,170 hours
- Testing · 8%
- Searching · 16%
- Writing · 5%
- Chasing and calls · 23%
- Checking · 40%
- Updating · 8%
What is a KYC remediation project, and what does it buy?
A KYC remediation project, or programme, is a time-boxed effort with a scope, a standard, a plan line and a sponsor, and what it buys is a back book the bank can defend file by file. Its deliverable is not "files touched" but files whose corrected values sit in the system of record with the evidence they rest on, approved by two people. Everything a sponsor pays for, analysts, quality reviewers, contact center hours, a programme office, should be judged against that unit.
Most projects are bought as capacity: a contractor desk sized to the file count, priced per head or per file. That model scales the expensive part of the work, people opening folders and writing letters, instead of removing it. The KYC remediation analyst's seat describes that desk from the inside; this page asks what happens when the folder-opening is not done by people at all.
Nine tasks in a KYC remediation project, and who should do each
Divided by what each task requires, four of the nine are mechanical and repeatable, four are decisions, and one is mixed. The European Banking Authority's guidelines on remote onboarding ask firms to state which steps run with no person involved and which need one (EBA/GL/2022/15). They are written for onboarding, not remediation, and do not bind US banks, but the discipline is the right one for any project that uses agents: write the division down, task by task.
Who does which of the 9 tasks in a KYC remediation project with agents
1Set the scope and the standard
Agents—
PeopleThe BSA officer approves the population, the evidence that closes each gap and the deadline; changes need a second approver.
2Pull each file and test it
AgentsBrings core, loan, imaging and filing records to every file; tests it against the scope and logs every gap.
PeopleSpot-checks the cohorts the test produces.
3Search the bank’s own records
AgentsProposes closing a gap only when the sources agree at the set confidence, citing each line used.
PeopleThe analyst checks cited closures and approves the batch as maker.
4Screen customers and owners
AgentsScreens every customer, beneficial owner and control person against the sanctions lists.
PeopleAny similar name goes to a named person; the agent never clears a potential match.
5Draft and pace the requests
AgentsOne plain message per customer for everything still missing, in their language, after a tipping-off check.
PeopleThe contact center supervisor sets weekly caps; a reviewer approves each week’s release.
6Read replies against the standard
AgentsSets each proposed value beside its source.
PeopleThe analyst decides whether the evidence is sufficient; the checker approves with a reason code.
7Re-rate the customer
AgentsRecalculates the rating under the bank’s model once other gaps close.
PeopleA higher rating always goes to a reviewer; the agent never applies a rating.
8Check each batch on a sample
AgentsRe-reads each sampled file’s sources side by side.
PeopleA quality reviewer or the BSA officer samples and approves; one error returns its stratum.
9Decide on silence, and report
AgentsRecommends a call, a limit or closing accounts, drafts the notice, and drafts the board report.
PeopleThree people approve any limit; the BSA officer signs the report.
Two design rules sit underneath the table. Agents propose and draft but never write to a customer record, send a message, limit services, close an account, clear a potential sanctions match or apply a rating. And every decision people take has a maker and a different checker, a rule a project should make impossible to switch off for a busy week.
Task 3 in practice: closures proposed from the bank’s records, with what is left for people
Can AI do KYC remediation?
AI can do the mechanical part of KYC remediation, pulling, testing, searching and drafting, and regulators are increasingly explicit that using it is acceptable; it should not take the decisions alone. FinCEN's April 2026 proposal for AML programmes would tell institutions that responsible experiments with innovative technology carry no added risk of significant supervisory or enforcement action merely because the technology was used, and names generative AI among the examples (FinCEN NPRM, 91 FR 18704); it is still a proposal.
On decisions, the public sources point one way. GAO reported in 2025 that the financial regulators using AI in their own supervision treat its output as one input to a staff decision, never as the decision (GAO-25-107197). FATF's 2021 review of new technologies reached the same view for firms: digital tools make AML work faster and cheaper, and people's review stays essential to keep it auditable and accountable (FATF, 2021). For remediation, that means agents that find and propose, with people approving what goes into the file.
How many analysts does a KYC remediation need?
The number of analysts a KYC remediation needs depends less on the file count than on how many customers it has to ask, because asking, chasing and reading replies are where the hours and the waiting sit. A programme that searches its own records first, with agents, needs a small desk of analysts and a relatively larger group of checkers; one that asks every customer needs a large desk and a contact center surge.
Staffing arithmetic for one cohort of 5,614 business files, four ways
| Approach | People-hours | Customers asked | Expected calls | Analyst-weeks |
|---|---|---|---|---|
| By hand, every customer asked | 8,889 | 5,614 | about 1,740 | about 254 |
| By hand, searching first | 6,566 | 1,632 | about 510 | about 188 |
| Agents assist, every customer asked | 1,965 | 5,614 | about 1,740 | about 56 |
| Agents search first, then ask | 1,169 | 1,632 | about 510 | about 33 |
Two lines matter for a sponsor. Searching first cuts the customers asked by more than two-thirds, which is what protects the contact center and the deadline, whoever does the searching. And agents doing the searching and drafting cut the people-hours more than seven times over on this cohort, which is what changes the shape of the desk. On the sample programme as a whole, six analysts and two quality reviewers review about 1,100 files a week against a plan of about 975.
How the project team changes when agents take the mechanical tasks
Today
Buys a contractor desk sized to the file count and waits for weekly spreadsheets.
With agents
Buys a smaller desk, more checking capacity and a burn-up that is the analysts’ queue.
Still theirs: The deadline and the budget.
Today
Signs for closures nobody can sample at scale.
With agents
Approves scope, beneficial owner batches and limits on a stated sample.
Still theirs: Every decision that changes a customer’s position.
Today
Samples files after the fact and finds patterns too late.
With agents
Sets the sample per batch and sees each sampled file’s sources side by side.
Still theirs: The error definition and what a failure does to a batch.
Today
Fulfil one-off extract requests from the desk.
With agents
Connect the loan, imaging and core systems once, with approval.
Still theirs: Access, masking and retention.
Today
Absorbs letter waves nobody told them about.
With agents
Sets weekly caps against staffed calls.
Still theirs: The pace of outreach.
Where automation has gone wrong in AML, and the lesson for remediation
Automation that decides without supervision has already appeared in enforcement. In its 2026 order against Community Federal Savings Bank, the OCC found that the bank's automated alert triage, through flaws in its logic, data and method, had closed by itself a very large share of the alerts it received, including ones that should have been escalated, alongside a CDD programme it called ineffective (OCC AA-ENF-2025-21). That was alert triage, not KYC remediation, but the failure would translate directly: an agent that closes files on weak matches produces a back book that looks remediated and is not.
The defences are design choices a buyer can test. Closures should require agreement between sources above a stated confidence, and should never happen when two records disagree. Every closure should cite the lines it used, so a checker can verify it in seconds. And batches should be approved on a sample whose size and result are stated; the quality assurance guide sets out what a sample of 40 proves.
The governance agents need when model-risk guidance does not cover them
US model-risk guidance does not govern AI agents. SR 26-2, issued in April 2026 to replace SR 11-7 and the 2021 BSA model-risk statement, leaves generative and agentic AI outside its scope as too new and fast-changing, and says the bank's own risk management and governance should determine the controls (SR 26-2; agentic AI for KYC reads the carve-out). A project using agents therefore needs its own governance, written for agents.
In practice that governance looks like a programme control framework: each agent's role and limits written down; versions approved by a named person, the BSA officer in the sample programme; every agent action in the audit trail beside people's; and the division of tasks in the table above, so an examiner can see which steps are automated and which are human. It is not a model validation, and should not be described as one.
What to look for in KYC remediation software
Look for software that removes the searching and drafting from people's hours while making every decision easier to check, not harder. The questions below separate tools that will survive an examiner's sample from tools that will simply close files faster.
Questions to put to any KYC remediation software or service
- Does every closure cite the record and the line it used?
A checker should open the source from the file in one click. If evidence lives only in the vendor’s portal, it is not the bank’s evidence.
- What happens when two records disagree?
The right answer is that nothing closes and the customer is asked for the one item that settles it.
- Can maker and checker be the same person?
They should not be, and the rule should not be a setting someone can switch off.
- Does it search your records before it writes to a customer?
Loan origination, imaging, account history and state filings, with requests held until the search finishes.
- Does it state the sample behind each batch approval?
Size, stratification, result and the confidence it supports.
- How does it pace outreach and prevent tipping off?
Weekly caps set by the contact center, and a check on every message.
- What does it never do?
Write to the core, send, limit services, close accounts or clear a sanctions match without people.
- Can you pilot it on your own files?
A few hundred files from your hardest cohort, against your scope, before any commitment.
Where KYC Remediation fits, and where it does not
KYC Remediation fits a bank or credit union with thousands of existing files to bring to a standard by a date, whose evidence is spread across a core system, loan files, image archives and public filings. It runs the nine tasks above with eight agents, Gap Finder, Records Searcher, Screening agent, Risk Rating agent, Package Builder, Member Request agent, Non-response agent and Program Forecaster, and four kinds of people deciding. On the sample programme, one search closed 3,982 business files from the credit union's own loan files, each citing its signed certification, and moved the programme from 32 to 61 days ahead of its plan line.
One file as a checker sees it: each gap, how it closed, and the agents’ steps
It does not fit everywhere. A back book of a few hundred files may not justify connecting systems; a skilled team with a spreadsheet can do it. It does not replace a sanctions screening service, a core banking system or a CRM; it uses them. It cannot close a file from records that do not exist, so a book acquired without its loan files or images will lean heavily on outreach. And it does not take the bank's decisions: scope, sufficiency, ratings, limits and the board report stay with people.
People approve: the maker’s step, with the checker named and the sample stated
Running an AML remediation project with agents: the first 30 days
An AML remediation project with agents should spend its first month proving the division of work on real files before it scales. Week one fixes the scope and the evidence rules for each gap, approved by the BSA officer. Week two connects the systems the search needs, starting with the one most likely to hold certifications and IDs. Week three runs the agents on a pilot batch of a few hundred files from the hardest cohort, with full review rather than sampling, to measure how often a proposed closure is right. Week four sets the sample sizes, the message caps and the plan line from what the pilot showed.
The 2018 interagency statement on innovation supports that approach: a pilot that proves unsuccessful should not, by itself, draw supervisory criticism. The week-by-week version, with a burn-down a regulator can follow, is in clearing a KYC backlog. To see the nine tasks running on one programme, start from KYC Remediation.
Questions people ask
What is KYC remediation automation?
It is the use of software, increasingly AI agents, to do the repeatable parts of remediation: pulling records, testing files against the standard, searching internal systems for evidence and drafting customer requests. The decisions stay with people. In KYC Remediation, the agents never write to a customer record or send a message without people approving.
What should a KYC remediation project cost?
No public source gives a reliable cost per remediated file, so price your own: people-hours per file by cohort, customers asked, calls per message, and the months the project runs. GAO found customer due diligence was the costliest BSA area at the banks it studied, about 29% of direct BSA/AML cost on average. Duration usually drives the total.
Do examiners accept AI in KYC remediation?
No US rule prohibits it, and FinCEN's April 2026 proposal would state that responsible use of innovative technology adds no enforcement risk by itself. Examiners will test the result as they would any file: is the evidence there, and did a person approve it. SR 26-2 leaves governance of agentic AI to the bank.
How long does a KYC remediation project take?
It depends on file count, gaps and how many customers must be asked. The fictional sample programme plans about 975 files a week to bring 38,400 files to standard by June 30, 2027, and runs ahead of that line because many files close from records the credit union already holds.
Should we buy a contractor desk or software?
Many programmes need both: people to prepare cases, take calls and decide, and software to remove the searching and drafting. The useful question is which tasks each will do. Buying capacity for tasks agents can do scales the cost of the slowest part of the work.