Key takeaways
- Each workflow has a distinct intended outcome, a named process owner, and a defined human authority boundary.
- Readiness depends on four things you can check before a pilot: accessible records, documented review requirements, representative past cases, and an engaged process owner.
- Agents prepare evidence and surface exceptions; consequential decisions stay with your authorized staff.
- The governance layer that controls what an agent may access and do matters as much as the workflow design itself.
Know-your-customer (KYC) reviews, anti-money-laundering (AML) investigations, loan files, reconciliation breaks, and payment exceptions all contain preparatory work you could delegate to an AI agent. Deciding where to start means looking closely at the operation, beginning with the work your team spends the most time investigating and the systems that hold the answers.
That framing gives you a more useful shortlist than treating every banking workflow as the same automation opportunity. An agent following a company’s ownership records needs different sources and review criteria from one investigating an unmatched ledger entry. The business outcome and the authority you’re prepared to delegate will differ too.
The five workflows below show how that scope could look. They are proposed starting points for evaluation, with your bank retaining the consequential decisions. The numbering reflects a suggested review order only.
1. KYC Review
In know-your-customer review, an agent could help your team move from an onboarding or refresh trigger to a case ready for assessment. The work can extend beyond extracting fields: it may involve consulting registry records, comparing customer information, and following ownership relationships.
McKinsey’s research on financial-crime operations describes agents gathering company information and examining ownership before preparing a consolidated KYC file (McKinsey, 2025).
For example, if a company record names another company as an owner, the next step may be to examine that entity’s records. An agent could follow the relationship within the sources you permit and bring the findings back to your reviewer. Onboarding and screening disposition remain with your authorized staff.
KYC becomes a practical candidate when your review requirements are clear and the necessary records are accessible. You can then assess whether the agent produces a usable file, how much follow-up your reviewers still perform, and whether each material finding can be traced to its source.
Readiness checklist
- Registry and screening sources accessible to the agent
- Documented review requirements your team can apply to agent output
- A named compliance owner prepared to assess completed cases
- Assessed sample cases to compare against agent-prepared files
See how moring builds and deploys a commercial KYC evidence agent for banking teams.
2. AML Investigation
AML investigations offer a related opportunity, with more emphasis on understanding activity. Your investigators need to connect a transaction or alert to the customer’s circumstances and decide which questions deserve further examination.
An agent could retrieve customer information, examine transaction and alert histories, and organize the findings into a case chronology. The same McKinsey research describes agents examining transactions, counterparty patterns, and alert histories as part of end-to-end financial-crime workflows, with human investigators reserved for exception handling and final decisions (McKinsey, 2025).
The useful flexibility lies in following what the records reveal. A transaction might lead to a counterparty already present in the customer’s history, making those earlier records relevant to the investigation.
For your AML team, readiness means being able to judge the quality of that work. Does the case include the relevant evidence? Does it preserve information that weakens the suspicious interpretation? Can your investigator follow the analysis without repeating the research?
Your bank retains final disposition of the alert and the decision on whether to file a suspicious activity report (SAR) in this scope. The intended outcome is an investigation your team can assess and advance, with fewer preparatory lookups left to repeat.
Readiness checklist
- Transaction and alert histories accessible across relevant systems
- Documented criteria for what a complete investigation file contains
- A named AML owner who will assess agent-prepared cases
- Investigator-reviewed cases available to evaluate agent output against
3. Commercial Lending
Commercial lending offers a scope around preparing a credit file and identifying exceptions for review. An agent could work through borrower documents, retrieve the applicable policy provisions, and bring issues to your credit team’s attention.
Consider financial statements covering different reporting periods. Before presenting figures as comparable, the workflow needs to account for that difference. An agent could identify the mismatch, look for another statement in the available material, or flag the comparison for your analyst.
You can divide the work according to what it requires. Document interpretation can use a model, calculations can run in code, and credit approval remains with the people who hold that authority. moring’s lending exceptions agent follows this pattern: it assembles the file, retrieves the applicable credit policy, classifies the exception, and drafts a cited recommendation, but it cannot approve the exception or amend the terms.
This is a useful candidate when you have an accessible, current credit policy and representative files your lending team can assess. Those files let you evaluate whether the system extracts figures correctly and flags issues that warrant attention. The outcome is a better-prepared credit package; approval and lending terms remain your bank’s decisions.
Readiness checklist
- Current credit policy accessible and machine-readable
- Representative borrower files your analysts can use for evaluation
- A named credit owner who will review agent-prepared packages
- Clear criteria for what constitutes a flagged exception
4. Reconciliation Break Investigation
Reconciliation offers a place for agents to investigate the items left unresolved by your existing matching process. The work begins with a break and ends with an explanation and proposed resolution.
Suppose records appear to describe the same transaction but have different posting dates. The investigation could involve checking transaction details and your matching rules to establish whether timing explains the difference. An agent could carry out the relevant lookups and present its findings to your reconciliation team.
This allows you to evaluate investigative work without replacing the matching engine or granting authority to book corrections. Your controller retains approval of the accounting adjustment. The investment data break agent moring builds for banking teams follows the same boundary: it gathers records, compares fields, identifies a likely cause, and cites the applicable policy, but it cannot book a correction.
Previously resolved breaks provide useful evaluation material because your team can compare the proposed explanation with the records and accepted resolution. Unresolved cases matter as well: they show whether the workflow recognizes when more investigation is needed.
Readiness depends on access to both sides of the break, agreed comparison rules, and a clear review process for proposed adjustments.
Readiness checklist
- Records from both sides of the break accessible to the agent
- Agreed comparison rules documented for agent use
- Prior resolved breaks available as evaluation cases
- A named controller who approves proposed adjustments
5. Payment Exception Handling
For payment exceptions, an agent could bring together the current payment status, available error or return information, and the applicable handling procedure. It could then route the exception to your operations team with a recommended next step.
That creates a defined piece of work you can assess before considering any authority to move funds. Release, rejection, and return remain within your authorized payment process.
The current state is especially important. If a payment’s status changes during the investigation, a recommendation based on the earlier state may no longer apply. Your workflow needs to account for that change before the recommendation is acted on.
A practical starting scope covers exception types whose rules and outcomes your payments team understands. You can assess the quality of routing and recommendations, along with the investigation work left for the receiving operator. Broader coverage can follow as you evaluate additional exception types.
Readiness checklist
- Current payment status accessible in real time or near-real time
- Handling procedures documented per exception type
- A named operations owner who reviews routed exceptions
- Reviewed exception cases available to evaluate agent recommendations against
Comparing Your Options
This comparison brings the operational outcome and decision owner into the same view. The evidence listed for each workflow describes what you would need to assess that scope.
KYC
Owner: Head of KYC
Intended outcome: A case ready for customer review
Permitted agent work: Retrieve records, investigate ownership, prepare findings
Human authority retained: Onboarding and screening disposition
Evidence for readiness: Source records, review requirements, assessed cases
AML
Owner: Head of AML
Intended outcome: An investigation ready for assessment
Permitted agent work: Research activity, connect records, prepare analysis
Human authority retained: Final disposition and filing
Evidence for readiness: Transaction and alert histories, investigator-reviewed cases
Commercial lending
Owner: Credit head
Intended outcome: A credit package ready for review
Permitted agent work: Review documents, retrieve policy, flag exceptions
Human authority retained: Credit approval and terms
Evidence for readiness: Applicable policy, source financials, assessed files
Reconciliation
Owner: Controller
Intended outcome: An explained break and proposed resolution
Permitted agent work: Investigate differences, recommend corrections
Human authority retained: Booking adjustments
Evidence for readiness: Records from both sides, comparison rules, prior cases
Payments
Owner: Head of operations
Intended outcome: An exception routed with a recommendation
Permitted agent work: Check status, investigate, recommend next steps
Human authority retained: Release, rejection, or return of funds
Evidence for readiness: Current payment state, handling procedures, reviewed exceptions
Your first choice should reflect the operation you can evaluate well. Accessible records and an engaged process owner make a candidate more actionable than a broad use case with unresolved access or review requirements.
Governing what the agent can do
Once you have chosen a workflow, you need controls around the agent itself: limits on which systems it can reach, and a pause for human approval before any consequential action. Each run should also leave a retained record. These requirements apply to every workflow on this list.
The revised model risk guidance, SR 26-2, replaced SR 11-7. Its scope excludes generative and agentic AI. That scope distinction leaves your bank to determine the governance needed for the agent and any conventional models it uses. Your compliance and model risk teams should assess the specific workflow and applicable requirements.
The moring AI Control Plane provides the governance layer: agent identity and authorization, scoped access to models, data, and tools, human approval for consequential actions, runtime controls, and an evidence record attached to each run. The enterprise AICP whitepaper covers how those controls are assembled inside your environment.
The strongest case for expansion comes from your own operation: cases completed to the required standard, review effort understood, and exceptions reaching the people who can resolve them.
Frequently Asked Questions
Can an AI agent approve a KYC case or make a SAR filing decision?
Not in the scope described here. The agent prepares evidence and organizes findings; a named compliance officer retains onboarding disposition and filing authority. The boundary between what the agent completes and what a person decides should be explicit in your workflow design and recorded by your governance layer.
Does using an AI agent for KYC or AML create a regulatory obligation?
That depends on your jurisdiction, the specific workflow, and how your regulators treat AI-assisted processes. In the US, SR 26-2 excludes generative and agentic AI from its scope; that exclusion does not remove other applicable obligations. Your compliance and model risk teams should assess applicability to your specific workflows before deployment. This article covers workflow design choices only; take legal or regulatory questions to your counsel.
What does readiness actually mean before deploying an agent?
Four things, matching the readiness checklists above: the records the agent needs are accessible, your review requirements are written down, you have prior cases your team can use to evaluate the agent’s work, and a process owner has agreed to assess the output. Without those, you have no agreed way to tell whether the agent’s output is usable.
How do you prevent an agent from acting on stale payment data?
Build the current-state check into the workflow before the recommendation is acted on. Your workflow needs a second status check at the moment the operator acts if the payment status can change between when the agent investigates and when the operator acts.
What governance controls should be in place before a banking agent goes live?
At minimum: a registered agent identity, scoped access limited to what the workflow requires, a defined human approval step for consequential actions, and a retained evidence record. The AI Control Plane provides those controls as a reusable layer rather than requiring each workflow to implement them independently.
How do I choose between these five workflows?
Start with the workflow where you can evaluate the output well. That means an engaged process owner, accessible records, and prior cases your team can compare against agent-prepared work. Broad use cases with unresolved access or review requirements are harder to assess and harder to expand from.
If you want to scope one of these workflows for your operation, the banking workflow workshop is a practical starting point. You bring a priority workflow; the session produces a named owner, required systems, approval points, and a plan for deploying governed agents in production.