AI Agents for investment banking: How to Automate KYC verification (multi-agent with AutoGen)

Investment banking KYC is a throughput problem wrapped in a compliance problem. Analysts spend hours pulling entity data, checking beneficial ownership, screening against sanctions lists, and reconciling inconsistent documents across jurisdictions. Multi-agent AI with AutoGen fits here because the work is naturally decomposable: one agent extracts, another verifies, another screens, and a supervisor agent resolves conflicts before a human signs off.

The Business Case

• •

  Cut onboarding cycle time from 5–10 business days to 1–2 days

  • •For standard corporate clients, an agentic KYC workflow can pre-fill 70–85% of the case file before analyst review.
  • •That matters when deal teams are waiting on account opening, credit approvals, or treasury access.
• •

  Reduce manual analyst effort by 40–60%

  • •A middle-market investment bank running 2,000–5,000 KYC reviews per year can typically free up 3–6 FTEs from document chasing and duplicate data entry.
  • •Those analysts can be reassigned to enhanced due diligence, PEP escalation, and complex ownership structures.
• •

  Lower error rates in entity resolution and document transcription

  • •Manual KYC packs often carry 3–8% data-entry or mismatch errors across legal names, registration numbers, and UBO fields.
  • •A structured multi-agent pipeline with validation gates can bring that below 1%, especially when paired with deterministic checks against source documents.
• •

  Improve audit readiness

  • •Every agent action can be logged with source citations, confidence scores, and human override history.
  • •That makes it easier to defend decisions during internal audit, external audit, and regulator inquiries under AML/KYC expectations tied to FINRA/SEC oversight and jurisdictional regimes like GDPR for EU clients.

Architecture

A production KYC system should not be a single LLM prompt. It should be a controlled workflow with clear responsibilities and hard stops.

• •

  Ingestion and document intelligence layer

  • •Use OCR and parsing for passports, certificates of incorporation, proof of address, shareholder registers, trust deeds, and board resolutions.
  • •Frameworks: LangChain for loaders/parsers, Unstructured or cloud OCR for extraction.
  • •Store raw artifacts in immutable object storage with retention controls aligned to SOC 2 evidence handling.
• •

  Multi-agent orchestration layer

  • •Use AutoGen as the coordination framework.
  • •Typical agents:
    • •Extraction Agent: pulls legal entities, directors, UBOs, addresses, tax IDs.
    • •Verification Agent: cross-checks extracted data against filings and internal records.
    • •Screening Agent: checks sanctions/PEP/adverse media sources.
    • •Supervisor Agent: resolves conflicts and decides whether the case is complete or needs escalation.
  • •For more deterministic routing and state handling, wrap the flow in LangGraph.
• •

  Knowledge and retrieval layer

  • •Use pgvector for semantic retrieval over prior KYC cases, policy playbooks, jurisdiction rules, and approved exception patterns.
  • •Keep policy content versioned so you can prove which rule set was applied at decision time.
  • •This is where you encode local requirements such as GDPR data minimization for EU persons and jurisdiction-specific AML thresholds.
• •

  Controls and audit layer

  • •Every agent output should write to an append-only audit log with:
    • •source document reference
    • •extracted field
    • •confidence score
    • •reviewer decision
    • •timestamp
    • •model/version identifier
  • •Add workflow gates for high-risk cases: PEP hits, offshore entities, bearer shares where permitted historically but now heavily restricted in many jurisdictions, or complex trust structures.
  • •Use human-in-the-loop approval for anything that would affect client acceptance or trigger enhanced due diligence under your internal policy.

What Can Go Wrong

• •

  Regulatory risk: false clearance of a prohibited client

  • •If the screening agent misses a sanctions hit or misclassifies a beneficial owner, you have an AML failure with real enforcement exposure.
  • •Mitigation: hard-code negative-list checks outside the LLM path for OFAC/UN/EU sanctions; require dual review on any match above a low threshold; keep the final disposition human-approved.
• •

  Reputation risk: inconsistent decisions across regions

  • •An AI system that approves one subsidiary structure in London but rejects the same structure in New York creates governance problems fast.
  • •Mitigation: centralize policy logic in versioned rulesets; use jurisdiction-aware prompts; maintain a single case taxonomy across front office onboarding teams.
• •

  Operational risk: bad extraction from messy documents

  • •Investment banking KYC often includes scanned PDFs, foreign-language filings, notarized copies, or incomplete corporate charts. One bad extraction can cascade into wrong UBO mapping or delayed account opening.
  • •Mitigation: require source-grounded outputs only; use confidence thresholds; fall back to manual review if key fields fail validation; benchmark on historical cases before production rollout.

Getting Started

1. •

   Pick one narrow segment

   • •Start with low-to-medium complexity corporate clients in one jurisdiction.
   • •Exclude trusts, funds-of-funds structures, high-risk geographies, and politically exposed persons in phase one.
2. •

   Build a pilot team of 5–7 people

   • •You need:
     • •product owner from onboarding/compliance
     • •AML/KYC SME
     • •two engineers
     • •data engineer
     • •security/privacy lead
     • •operations reviewer
   • •Run this as an eight-week pilot with weekly control reviews.
3. •

   Instrument the workflow before optimizing it

   • •Measure:
     • •average case completion time
     • •percentage of auto-filled fields
     • •false positive rate on screening
     • •human override rate
     • •number of escalations per case type
   • •If you cannot explain why the system made a decision under audit conditions, it is not ready.
4. •

   Integrate with existing control systems

   • •Connect to your case management platform, sanctions screening vendor, CRM/onboarding stack, and SIEM.
   • •Keep model access behind SSO and role-based permissions aligned with SOC 2 controls. \n- For EU-client workflows involving personal data processing outside the EEA, validate GDPR transfer mechanisms early. For regulated banking environments more broadly, align logging retention and access controls with internal compliance policy and applicable supervisory expectations rather than treating the model as a standalone app.

The right implementation does not replace KYC analysts. It turns them into reviewers of structured evidence instead of hunters of paperwork. That is where the real ROI sits: faster onboarding without weakening controls.

Keep learning

• •The complete AI Agents Roadmap — my full 8-step breakdown
• •Free: The AI Agent Starter Kit — PDF checklist + starter code
• •Work with me — I build AI for banks and insurance companies

By Cyprian Aarons, AI Consultant at Topiax.