Why banks aren’t ready to take humans out of the KYC loop

For most of the past decade, “human in the loop” has been the default safeguard for AI in banking. Whatever the system produces, a person checks it before it counts.

Few banks have asked how well that safeguard actually works. At our ‘Trust at agentic speed panel at Sibos 2026′, Sameena Shah (Chief AI, Data and Transformation Officer, J.P. Morgan) described a move toward “humans on the loop rather than in the loop,” with people overseeing flags and exceptions instead of reviewing every case.

The logic is sound. Human review is not a perfect control. Experienced analysts reach different conclusions on the same file. Procedures are interpreted differently across offices. Fatigue sets in on high-volume, repetitive work. A person in every loop does not guarantee quality. It guarantees cost and delay.

But there is a trap on the other side. Moving people onto the loop without the right foundations does not reduce risk. It hides it. In our work with Tier 1 banks on corporate know your customer (KYC), five foundations make the difference, and many banks are missing at least one.

1. Policy that is explicit and applied consistently

What banks can get wrong: they assume their policy is applied the same way everywhere.

When banks first deploy agents, many apparent AI errors turn out not to be AI errors at all. They are gaps in procedure. Global teams have been doing the same task in slightly different ways for years. The agent, working from the documented policy, simply exposes the inconsistency.

That inconsistency did not arrive with AI. It was a compliance exposure all along. Regulators expect the same policy to produce the same result in every jurisdiction, and a bank that cannot show that has a problem whether or not it uses agents. Encoding policy so it is applied the same way every time is the first prerequisite for scaling oversight down.

2. A measured human baseline

What banks can get wrong: they cannot say how accurate their current process is.

You cannot show that an agent performs better than your current process if you have never measured that process. Few banks can quote their analyst error rate, how often files are reworked or which checks are most often missed.
Before changing oversight, banks need a clear view of how consistently analysts apply policy today. That baseline turns a subjective debate about trusting AI into an evidence-based decision. It also gives risk and compliance teams a benchmark to monitor against once oversight changes.

3. Trusted, sourced input data

What banks can get wrong: they focus on the model and assume the data will follow.

An agent’s output can only be as reliable as the data it reasons over. If the inputs are stale, incomplete or impossible to trace, a faster process simply produces unreliable answers more quickly.

This is why corporate digital identity (CDI) matters. A CDI profile is a structured, continuously maintained view of a corporate client, built from authoritative public sources and private client information, with the source and timestamp of every data point recorded. When the reviewer on the loop asks where a fact came from, there is an answer.

4. Explainable outputs and automatic exception routing

What banks can get wrong: they move people onto the loop without changing what those people can see.

A human on the loop is only effective if they can see, immediately, what the system concluded and why. Every outcome should show which sources were used, which rule was applied, and where data conflicted or fell short.

Exceptions must also surface on their own. Complex ownership structures, conflicting registry records and adverse findings should be routed to people automatically. Skilled analysts should spend their time on judgment, not on confirming work that was already correct.

5. Oversight tiered by risk, with governance ahead of scale

What banks can get wrong: they treat the change as a switch rather than a spectrum.

A low risk, publicly listed subsidiary does not need the same review as a high-risk client with a layered offshore structure. Banks should define oversight by risk tier: straight through processing (STP) where the evidence supports it, a human on the loop for most standard cases, and a human firmly in the loop for the highest risk decisions.

Governance must lead. Guardrails, monitoring and escalation paths should be in place before volumes increase, not after. And because analysts who have worked one way for years will not change habits overnight, adoption deserves as much investment as the technology.

Five questions to ask before you change oversight

If you cannot answer yes to all five, your bank is not yet ready to move people onto the loop.

1. Does the same KYC policy produce the same outcome in every office and jurisdiction?
2. Do you know your current analyst error and rework rates?
3. Can you trace every data point in a client file to its source and the date it was verified?
4. Can a reviewer see why the system reached each conclusion, and are exceptions routed to people automatically
5. Have you defined oversight by risk tier, with governance in place before volumes increase?

How Encompass helps banks get there

Encompass partners with Tier 1 banks to put each of these foundations in place.

• Consistent policy and trusted data. EC360 creates and maintains CDI profiles from authoritative global public sources and private client information. It applies each bank’s own policy the same way every time and records the lineage of every data point. Structured KYC data flows directly into core banking applications and agentic workflows, giving agents a trusted input and reviewers a clear audit trail.
• A measurable baseline. EC Review applies the same approach to back-book remediation and refresh. It delivers high-volume, policy-consistent and audit-ready outcomes, creating the evidence banks need to set a defensible baseline and decide where oversight can safely scale down.
• Risk tiers and adoption. Our global transformation team of KYC and banking experts works with operations, compliance and AI teams to define risk tiers, design exception handling and support the change that turns pilots into production.

Earning the right to step back

The shift from in the loop to on the loop is not about trusting AI more. It is about building a process that deserves trust: consistent policy, a measured baseline, sourced data, explainable outcomes and oversight matched to risk.

Banks that build these foundations first will move faster with more confidence. Those that skip them risk discovering their gaps the hard way, in front of a regulator.