Most of the labor in KYC happens before anyone makes a risk decision. It goes into collecting documents: chasing a missing utility bill, requesting a clearer passport photo, explaining why a bank statement from 2019 will not do. The chasing is what makes KYC expensive.

The CX bottleneck

KYC gets discussed as a compliance function, but it is also a customer experience function. Every verification touchpoint is a moment where a customer either completes onboarding or abandons it.

The touchpoints stack up fast. Document collection requires customers to submit government-issued ID, proof of address, and often source-of-funds documentation. Identity verification then has to match those documents against the person presenting them.

Watchlist and sanctions screening runs customer data against PEP lists, OFAC, and local equivalents. When risk profiles change, ongoing monitoring triggers periodic re-verification, updated documents, and enhanced due diligence.

Each of these stages generates customer interactions, and each interaction is a point where the customer can stop responding and the file can stall.

The compliance team isn't slow. The process is inherently high-touch, and most of those touches are repetitive.

Automation boundaries

The distinction between what AI agents can handle and what requires human judgment maps cleanly onto regulatory expectations. Regulators do not demand that a human personally request a passport scan, only that a qualified person makes the final risk determination.

AI agents handle the operational layer well: collecting documents, validating completeness, extracting data from submitted files, running initial format and consistency checks, prompting customers when submissions are incomplete or expired, and answering questions about what's needed and why. These interactions follow predictable patterns with clear right answers.

Human review remains essential at specific gates. Beneficial ownership determinations for complex corporate structures, enhanced due diligence decisions triggered by PEP matches or adverse media, risk rating assignments that carry regulatory weight, and SAR filing decisions all require trained compliance professionals.

The design question is whether the agent is scoped to a queue or to the case. A queue-scoped agent answers whatever lands in front of it. A case-scoped agent would open the conversation, chase the missing utility bill, re-request the passport photo that failed the authenticity check, and follow up three days later when nothing has arrived.

Be clear about which of those you can buy today. Case ownership, where you hand an agent an objective and it works toward that objective until it gets there, is where we think KYC agents are heading. It is not what Lorikeet ships today.

What ships today are the parts it would be assembled from: one AI concierge trained once and deployed across chat, SMS and voice, proactive outbound conversations the concierge starts rather than waits for, and scope controls that bound what it is allowed to determine.

Those scope controls matter either way. They decide what the concierge may determine, and a human still rules on risk.

The automated workflow

A practical AI-assisted KYC workflow operates in distinct phases, each with clear handoff points.

A customer initiates onboarding through the company's app or website. The AI concierge greets them, explains what documentation is required based on their account type and jurisdiction, and collects initial information: name, date of birth, nationality, intended account purpose. This interaction happens in natural language.

Verification chases fail on channel more often than on content. The customer who ignores three onboarding emails will answer an SMS, and the one who will not upload a document will read the number off it on a call. The concierge is trained once and deployed to chat, SMS and voice, and context is carried across those channels, so a customer who started the upload in-app does not restate their date of birth when the follow-up reaches them by text.

The concierge then guides document submission. When a customer uploads a blurry driver's license, the concierge identifies the quality issue immediately and requests a new capture, rather than letting it sit in a queue for two days before a human reviewer rejects it. The concierge flags a proof of address older than three months in real time.

Once documents are collected, the concierge extracts relevant data fields and runs them through verification APIs: document authenticity checks, facial matching against submitted ID, sanctions and PEP screening. Results populate a structured case file.

Clean cases (verified documents, no watchlist hits) route to a human reviewer for final sign-off, but the reviewer is confirming a decision rather than assembling one. Flagged cases route to senior compliance analysts with the specific flag identified and the supporting documentation already organized.

The published data point on this comes from Breeze: "In 30 days Lorikeet's agent has been able to independently resolve 40% of our complex support volume (including >90% independent resolution of the tickets it chooses to solve), including questions about KYC reviews, transaction statuses and decline." The concierge is resolving questions about KYC reviews, not making the determinations.

After onboarding

Verification is a lifecycle obligation that runs for as long as the customer is on the books. Proactive outbound is the shipped piece here. The same concierge that got the customer through day-one KYC can start the refresh conversation instead of waiting for one, requesting the document before it expires and opening re-verification when transaction patterns trigger enhanced monitoring.

The tail is not solved. Someone still has to own the case until the file is current, and that someone is not yet the concierge.

Audit trail architecture

Regulators examining KYC processes look for three things: consistency, completeness, and traceability. Every decision in the verification chain needs a documented rationale, and every customer interaction needs a timestamp and a record. This is where a defense in depth approach to AI accuracy becomes essential.

AI agents, properly built, are better at this than humans. An agent generates a complete interaction log by default, and every document request, every customer response, every validation check and every escalation decision produces a structured record. Human reviewers working through email and chat logs leave gaps that an agent does not.

Logging is the easy half, and the harder question is which steps in a KYC chain are allowed to be probabilistic at all.

Document chasing, clarification and re-requests can be model-driven, because the cost of getting them slightly wrong is a second message. Screening thresholds, escalation triggers and the boundary of what the concierge may determine should be deterministic rules that the model cannot reason its way around, because that is what an examiner will actually test.

KYC data falls under stringent privacy regulations across virtually every jurisdiction: GDPR in Europe, the Privacy Act in Australia, CCPA in California. The AI system processing this data needs infrastructure-level security certification.

This is where vendor credentials matter concretely. ISO 27001 certification demonstrates that a vendor's information security management system has been independently audited, and SOC 2 Type II goes further by verifying that those controls have been operating effectively over a sustained period. For KYC use cases, both are table stakes.

Lorikeet is SOC 2 Type II audited, ISO 27001:2022 certified and GDPR attested, with certifications published on our public trust center. Every customer interaction, model choice and action is tracked, and for regulatory reporting we support audit trail exports, compliance dashboards, exception reporting, customer consent reports, data access logs and incident reports.

Data storage residency is available in the US, Australia and the EU. For fintechs operating across multiple regulatory jurisdictions, that matters more than any feature comparison.

Vendor evaluation

Scope control comes first. A KYC agent needs hard boundaries on what it is allowed to determine, and those boundaries have to be enforced in the system rather than requested in a prompt. If the agent can be talked into a risk determination it should not make, the platform is a liability regardless of how well it handles language.

Integration depth matters for KYC specifically. The agent has to reach the identity verification provider, the sanctions screening database and the case management system, and write back to all three. A tool that cannot trigger an IDV check or write to the compliance case file adds a step to the process instead of removing one.

Ask how that access is actually built, because a prebuilt connector and an API you integrate against are different amounts of work. Lorikeet's published integrations cover ticketing, telephony, knowledge bases and action tools, and there is no prebuilt connector to an IDV, screening or case management vendor.

The mechanism is general instead: Lorikeet integrates with any API, MCP connection or internal system, reads data and takes action through APIs, MCP and webhooks, and write access can be switched on, switched off, or set to read-only per integration in the app. Put the same question to every vendor on your list.

Verification is never finished, so the capability that matters is a concierge that can open the next conversation.