Three things banks get wrong about agentic KYC: lessons from Sibos 2026

Most banks believe their agentic know your customer (KYC) programs will succeed or fail on the model. Which one to choose, how to tune it, how accurate it can get. At Sibos 2026, three of the world’s most AI-advanced banks suggested they are looking in the wrong place.

Encompass hosted “Trust at agentic speed: reimagining corporate identity in an AI-driven economy” in Miami. Moderated by Alex Ford (Chief Revenue Officer, Encompass), the panel brought together Lori Messer (US COO and Global Head, Cross Product, RBC Capital Markets), Sameena Shah (Chief AI, Data and Transformation Officer, J.P. Morgan) and Rafik Majiti (Global Head Digital Wholesale Banking and Global Head of Corporate Customer Data Management (ad interim), ING).

Each bank is at a different point on its journey. Yet all three arrived at the same conclusion. Agents are ready for corporate KYC. What most banks are not ready for is proving where their agents’ answers came from.

Here are three common beliefs the panel challenged, and what to do instead.

Misconception 1: corporate KYC is too complex for agents

Corporate KYC has a reputation as the hardest place to apply AI. Lori turned that around:

“Corporate identity is an easy space, in my opinion, for agentic AI, because corporate identity does not need creative judgment. What it does need is speed, accuracy, auditability, traceability and transparency.”

The work itself is governed by policy. Gathering documents, reconciling registry records, resolving ownership to ultimate beneficial owners (UBOs) and checking results against anti-money laundering (AML) rules is structured and repeatable. That is exactly what agents do well.

The complexity sits in the data. Rafik noted that an individual can be verified with “a selfie and a passport,” but a corporate identity “is so complex. There are so many data points.” Ownership chains cross borders. Registries publish in different formats and languages. Evidence sits in PDFs and email threads.

Here is the risk most banks underestimate. An agent does not fix poor data. It amplifies it. Reasoning quickly over stale or unsourced information does not create trust. It creates risk at speed.

Picture the moment that follows. A regulator asks why an agent approved a client. The bank can show the decision, but not what the agent knew, where that information came from, or when it was last verified. Lori’s five requirements apply to the data as much as to the agent. A bank that cannot trace its inputs cannot defend its outputs.

Misconception 2: keeping a human in every loop is the safe option

For most banks, a human reviewer on every case is the default safeguard. Sameena challenged the assumption behind it:

“Humans were not at 100%. Humans had some other baseline. We are removing this myth of humans operating at 100% accuracy.”

The real comparison is not agent against perfection. It is agent against the human process it replaces, with its variation between analysts, offices and shifts. At J.P. Morgan, layers of maker, checker and validation agents now work with a human on the loop rather than in it, and oversight scales with risk. “We have retained two, three, four humans when it is needed, but we have also gone to zero.”

That does not make the shift easy. When ING deployed its first document agents, it had to make trusting them a matter of policy. Analysts trained for a decade to read documents one way did not change overnight. “For me it’s not a technical challenge, it’s a cultural challenge,” said Rafik.

The new way of thinking is risk-based oversight. But it only holds up under scrutiny when every agent decision is consistent, explainable and traceable to a source. That is a data standard before it is an AI standard.

Misconception 3: KYC starts with the client

In most banks, the first step in a KYC case is still an email to the client with a list of documents. Every panelist had heard the same response: why are you asking for this again?

The hidden cost is larger than it looks. Each repeat request slows onboarding, frustrates relationship managers and signals to the client that the bank does not know them. Rafik described how ING has reversed the order:

“We first look at where the information is available in the bank. If you don’t find the information, then you have to look at external sources, and that’s why we use Encompass.”

Only then does ING go to the client, and it is digitizing that last step too, replacing email with a structured channel where clients answer and upload once. Sameena called bringing in private client data “the holy grail at this point.” J.P. Morgan’s work on tagging, access and reuse permissions now lets it prepopulate about 86% of a KYC record before contacting the client.

Lori went further, calling for industry standards built around a corporate identity profile “with clear lineage on where the data sources are and how the client profile is constructed.” Clients would see less duplication. Regulators would get more transparency. Banks would lower their cost to serve.

What getting it right looks like

Banks that fix the data foundation are already seeing results. Lori shared where RBC Capital Markets stands:

“Some of the work that we’ve been doing with Encompass over the last couple of months gives us the confidence and conviction that we can probably get to 70, 80, 90% STP within the next year.”

RBC once spent about 22 hours of analyst time on a KYC case. It is now around 10, with an ambition of four, and ultimately straight through processing (STP) for standard and medium risk clients. The aim is not fewer people. It is skilled analysts focused on the complex cases where their judgment matters most.

How Encompass helps banks close the gap

Each of these misconceptions points to the same missing foundation: a corporate digital identity (CDI) that agents can trust, people can audit and clients only have to provide once. That is what Encompass builds with Tier 1 banks.

• Data agents can trust. EC360 creates and maintains CDI profiles from authoritative public sources and private client information, applies each bank’s policy consistently and records the lineage of every data point. When a regulator asks what the agent knew, the answer is there.
• Oversight that can scale with risk. Because every EC360 outcome is consistent and traceable to a source, banks have the evidence they need to reduce manual review where risk allows, and keep people focused where it matters.
• External sources before the client. EC Public Automation retrieves data and documents from global registries, regulators and authoritative sources at scale, so agents start from evidence rather than a blank file.
• A structured final step. EC Private Outreach replaces email chasing with secure digital outreach for private documents and attestations, captured once for reuse.

Alongside the technology, our global transformation team works with operations, compliance and AI teams to move from pilot to production.

The question to ask now

Rafik closed the session with a vision we share: a world of perpetual KYC, where banks “only reach out to clients when it’s really needed.”

Getting there will not depend on who has the most advanced model. It will depend on who has the most trusted view of their clients. So, before your next AI investment decision, ask a simpler question: if a regulator asked where your agent’s answer came from, could you show them?