What happened when KYC analysts built their own AI agents

As banks start to use AI in know your customer (KYC) processes, the conversation is moving beyond the technology to the people who use it.

The biggest barrier to effective AI in KYC isn’t the technology. It’s that most analysts have never had the chance to see what AI could do for their own work. Ask an analyst what they would automate and you’ll often get a cautious answer. Give them the tools and an afternoon to experiment, and the answer changes completely.

That shift matters. Once people build something that solves a problem from their own week, AI stops being an abstract program run by someone else. It becomes something they can shape, question and improve.

The people who know where the time goes are the analysts working the KYC and financial crime queues every day. They’re rarely asked, and even more rarely given the chance to try. So, with Barclays and Scottish Financial Enterprise (SFE), we gave them that chance.

At our Agent Building Day in Glasgow, KYC, compliance and operations professionals from various organizations, including Barclays, Morgan Stanley and other global banks, formed six teams. Each team brought a real problem from its own week and built an AI agent to tackle it. Nobody needed to code. If you could describe a process, you could build an agent. By the end of the afternoon, every team had a working agent and a very different sense of what was possible.

The results are some of the most useful product research I’ve seen this year.

What the front line told us

Before building anything, attendees interviewed each other about a slow, repetitive task they do often. None of the answers mentioned a model or a platform. Almost all of them were about data: finding it, trusting it and getting it into the right place.

Five challenges came up again and again:

• Uncovering who really owns a company and what it really does. The strongest theme by far. When a client is a holding company with money spread across several entities, analysts have to connect the dots between registries, filings and sometimes the client itself to work out the underlying business and source of wealth.
• Manual research across too many sources. Every case starts with the same trawl through multiple registries, lists and websites. One analyst estimated that waiting for on-demand access to sources and data costs them several hours a day.
• Knowing where to focus. Financial crime teams want to monitor thousands of companies, but reviewing them all by hand is impossible. The ask was for something that surfaces the changes that matter and ignores the noise.
• Re-keying and duplicate records. The same information typed into a memo, then a tracker, then a form. Client-specific outreach packs built from templates by hand, case after case.
• Requests that arrive incomplete. Tickets missing the information needed to act, slow handoffs and long processes for simple requests.

What struck me most is how specific these are. None will show up on a steering committee slide. All of them shape how fast, and how defensibly, a bank onboards a client.

Six agents in one afternoon

Each team mapped its chosen problem on a build card: what starts the work, the steps the agent takes, what comes out, the time it saves and, most importantly, where a person makes the decision. Then, in two and a half hours, using Microsoft Copilot Studio and the EC360 model context protocol (MCP) connector to pull live registry and ownership data, every team built a working agent.

Five of the six agents focused on entity research, ownership or risk. Three took home prizes:

• People’s choice: a subsidiary-mapping agent. Voted for by everyone in the room. A legal entity goes in, and a cited table of its direct and indirect subsidiaries comes out, with ownership percentage, country and nature of business for each, plus a matching structure chart. Every relationship has a source, unknown percentages are never guessed and high-risk industries are flagged. The analyst decides what to do when matches are ambiguous or evidence conflicts.
• Better Call: an onboarding risk-ranking agent. For the agent that most improved the quality of a decision, or how well it could be defended. A company name and country of incorporation go in, and a standardized risk ranking comes out. The analyst decides the next step.
• Time Back: an AGM briefing agent. For the largest realistic time saving. It researches a company’s annual general meeting and prepares a voting-ready briefing pack. The person still makes every vote.

The other teams built agents for new client identification and verification, risk-rating companies so financial crime teams can prioritize investigations, and third-party supplier risk reviews that combine several data sources into one summary.

Notice the pattern. Every team kept a person at the point of judgment. Nobody tried to automate the decision. They automated the gathering, checking and assembling that comes before it.

The time on the table

Every team had to show its maths. These are the teams’ own estimates from the day, not audited results, but they show the scale of what’s possible:

The icebreaker cards told the same story from the other direction. One analyst reported around 25 hours a week lost to getting access to sources and data. Another reported around 13 hours a week spent copying the same information between a memo and a tracker. Ownership research alone took up to an hour a case.

Those numbers come from a single afternoon and a few dozen people. Scale them across a KYC operation and the case for listening to the front line makes itself.

Building is easy now. Data is the hard part.

Here’s what should worry anyone running an AI program. People with no coding background built six working agents in an afternoon. The build is no longer the bottleneck.

What the agent reasons over is. Look again at the challenges the front line raised: ownership that isn’t visible, sources that are hard to reach, data that arrives in the wrong format or not at all. An agent working from stale, incomplete or unverified corporate data doesn’t make better decisions. It makes wrong ones faster, with more confidence and less visibility.

That’s why every agent on the day drew on live, sourced data from authoritative registries through EC360. The winning agents were the ones that could show their evidence. And because the EC360 MCP connector is built on an open standard, it works with many AI models, including Claude, OpenAI, Rogo, Gemini and more. Banks can switch or mix large language models (LLMs) as the market moves without rebuilding the data foundation underneath.

But a connection isn’t the same as trust. Trust comes from data that is current, verified and structured well enough for a machine to use. That’s what corporate digital identity (CDI) is for.

What we’re sharing in person

This blog covers the headlines. The full findings go much further: every problem the front line raised, how teams prioritized them, the build cards behind each agent, and what the teams said they would need to take their agents into production.

Some of that detail is specific to the banks involved, so we’re sharing it only in person, with a small number of senior leaders responsible for KYC, onboarding, operations and AI.

If you lead one of those teams, there are two ways to see more:

1. Book a findings briefing. A 30-minute session where we walk through the full outcomes and what they suggest for your own operation.
2. Run your own Agent Building Day. Give your analysts the tools and live data, and find out in one afternoon where your own time is going.

Your analysts already have a backlog of agent ideas. They just haven’t been asked yet.

Contact us to find out more.