Customer Due Diligence Before and After Agentic AI
It’s a story that plays out at financial institutions around the world: a bank with 150,000 high-risk customers employs a team of relationship managers to manage those riskier accounts.
High-risk customers should get more frequent reviews. But those relationship managers can only get through a fraction of the high-risk population, because manually assessing transaction activity and reviewing each customer by hand takes time.
To make matters worse, some medium-risk customers will need to move into the high-risk category. But if reviews on those medium-risk customers haven’t been completed, the bank has no reliable way of identifying the movers.
The good news: this is a problem that agentic AI can solve. By automating the manual steps of customer due diligence, such as gathering transaction data and calculating review metrics, agents enable banks to increase their CDD capacity and keep reviews in step with risk as their customer base grows, spotting rising risk before it becomes a problem.
But the answer is not in handing the whole process over to AI. The value comes from applying agents to the right stages, with the right controls and human oversight in place.
In this seven-minute read, we’ll take you through a periodic review step by step, showing where agents can support or automate parts of the process and where human judgment remains essential.
Challenges With Customer Due Diligence
The US FinCEN CDD Rule, UK Money Laundering Regulations 2017, and EU Anti-Money Laundering Directives require financial institutions to monitor customers on an ongoing, risk-based basis. However, severe analyst bandwidth constraints force compliance operations into multi-year review cycles, often reviewing high-risk accounts once per year and low-risk accounts as infrequently as once every five years.
When reviews do happen, analysts can spend significant time pulling information from different systems, rechecking risks that have already been identified, and chasing customers for information that previous reviews failed to capture. This leaves less time for the analysis that actually determines a customer’s current risk level.
For institutions with large customer bases, the gap between reviews is a risk. A customer’s ownership, activity or risk profile can change significantly after a review, leaving the institution exposed until the next one. A customer considered low risk today could become involved in financial crime tomorrow, and the institution wouldn’t know.
How AI Agents Transform Customer Due Diligence
The constraint, in other words, is capacity. And AI agents address it directly.
Traditional AI models produce outputs, like risk scores or matches, within processes that people still run. AI agents can execute the multi-step processes themselves, with the level of human oversight set by the institution. In customer due diligence, they can take on the manual work that consumes analysts’ time. Institutions can set review frequency by customer risk, as regulators intend, rather than by analyst bandwidth.
In a typical workflow, the agent acts as the coordinator of the review. It breaks the review into a sequence of tasks, assigns each task to the model best suited to it, and passes the results forward so each step builds on the last. The latest customer data, documentation and registry filings become the foundation for tracing ownership structures, including cross-border shell companies.
The resulting ownership tree then determines which individuals and entities are screened against sanctions lists and researched online. By the end of the workflow, these findings come together into a single risk profile. Before the due diligence file is finalized, a quality assurance agent checks that each task has been completed to the institution's required standard.
This changes how often reviews take place. Institutions have traditionally reviewed low-risk customers every five years, medium-risk customers every three and high-risk customers annually. Since analysts can trigger an AI agent review at any time, institutions can review customers more often, moving closer to perpetual KYC (pKYC).
Manual vs AI-Assisted Customer Due Diligence
A typical periodic review follows nine steps:
- Retrieve the existing file
- Re-verify identity information
- Re-confirm beneficial ownership
- Reassess the purpose of the relationship
- Screen against lists
- Review transactional activity
- Reassess the risk rating
- Document the outcome
- Sign off
Each step involves a significant amount of manual work. Across hundreds of thousands of customers, that work adds up quickly. Agentic AI automates much of it, turning a drawn-out process into a far more efficient one. Below, we compare each step side by side, before and after agentic AI.
1. Retrieve The Existing File
Today: Analysts log into three separate systems to locate AML case history, screening results and KYC information, then consolidate it by hand.
With an agent: The agent assembles the information into a single view automatically, removing one of the most time-consuming parts of the process.
2. Re-verify Identity Information
Today: Analysts begin by locating each customer's documents, often finding that some are missing. The documents they do find must then be checked for validity.
With an agent: The agent flags expired identity documents, missing information and outdated verification dates. Analysts review only the files that require attention.
3. Re-confirm Beneficial Ownership
Today: Analysts manually compare ownership and control information against registry records to identify changes.
With an agent: The agent retrieves ownership data, checks it against source data such as registry feeds and flags any discrepancies for review.
4. Reassess The Purpose of The Relationship
Today: Analysts locate notes from previous reviews, where they exist, and re-read the full file to determine whether the relationship remains consistent with what was recorded. Because those notes are documented manually, their quality depends on how much time the previous analyst had and how thorough they were.
With an agent: The agent compares current activity with the existing customer profile. It flags turnover or income that no longer fits the profile, along with changes in behavior, and explains the potential significance of each. For example, it might flag a local café receiving large transfers from overseas accounts, far above its declared turnover.
5. Screen Against Sanctions, PEP And Adverse Media Lists
Today: Analysts pull current and historical screening results from different lists to see how earlier alerts were handled, whether those decisions still hold, and which alerts remain open. Bringing it all together by hand takes up much of the review.
With an agent: The agent gathers every screening alert into one view, both resolved and open, so analysts no longer have to piece the history together. For any open alert, the agent reviews the hit and recommends whether it is a true match or a false positive. The analyst then confirms the final decision, ensuring no genuine risk is missed.
6. Review Transaction Activity
Today: Analysts open separate core banking and monitoring systems to manually audit historical transaction logs, looking for past SAR filings, recurring internal alerts, and deviations from expected activity.
With an agent: The agent automatically aggregates historical transaction behavior, past SAR indicators, and alert logs, instantly feeding these complex signals directly into the customer's risk score.
7. Reassess The Risk Rating
Today: Analysts work through the data to decide whether a customer is high, medium or low risk, often relying on their own judgment. Because each analyst may weigh the same findings differently, risk ratings can vary from one analyst to the next, creating inconsistency and risk.
With an agent: The agent calculates a risk level and sets out the factors driving it. The analyst's role shifts from analyzing data to reviewing and confirming the recommendation. As a result, institutions apply the same standard to every high, medium and low risk rating, whichever analyst handles the case.
8. Document The Outcome
Today: Analysts manually record each action taken on a case, including when it was opened, any changes to the customer’s risk level, who reviewed it and when, the final decision and when the case was closed. Because these notes are written manually, their quality and detail vary from one analyst to the next.
With an agent: Every action taken on the case is logged automatically, from the moment the case is created to the final decision and closure. This includes any changed risk levels and the reason behind that decision. The result is a complete record of the review, without analysts having to document each step themselves.
9. Sign Off
Today: Analysts review all the information they have gathered and cross-referenced, then decide whether the customer needs enhanced due diligence (EDD). If it does, they either start the EDD forms from scratch or refer the case to an EDD analyst.
With an agent: The agent triggers EDD automatically when a customer crosses a set risk threshold. The analyst can then start the extra checks and forms straight away. Or they can pass the case to an EDD analyst or senior compliance practitioner, who reviews it and makes the final decision.
Measurable Impact of AI Agents on Customer Due Diligence
For banks that adopt agentic AI for customer due diligence, the most immediate result is faster reviews. As a result, instead of reviewing a sample of high-risk customers because capacity won’t stretch further, AML teams can review every one of them at the frequency their risk requires.
Findings also become more consistent, because the agent applies the institution’s policies and procedures to every review.
The bank described earlier shows what this can mean in practice. It now expects to review its entire high-risk population each year instead of sampling customers for review and to move quality control from quarterly to monthly.
Coverage, however, is only one measure of success. Banks evaluating AI agents should also assess output quality against four criteria. The bank we described earlier is measuring its own results against the same four:
- Traceable findings, with every finding and summary citing its source
- Transparent gaps, with the agent flagging missing or expired information
- Accurate detection, with the bank expecting its agents to correctly identify customers with material risk over 90% of the time
- Agreement with analysts, with the bank expecting its agents to match analysts' verdicts over 90% of the time
Introducing Hawk's Customer Due Diligence Agent
Hawk's CDD Agent removes the capacity constraint at the heart of manual customer due diligence. It follows each institution's own operating procedures and takes on the data gathering, cross-checking and documentation work that consume analysts' time. Analysts can then focus on the risk decisions that require their judgment.
Consolidate customer risk data: The agent pulls AML investigation information, sanctions and screening results and KYC details into one view. It produces a weighted risk score with the risk drivers behind it grouped by source.
- Catch profile changes early: The agent identifies material changes to the customer's profile, such as expiring identity documents, changes to a higher-risk nationality, and turnover or income that no longer fits the profile.
- Complete forms automatically: The agent completes the CDD forms the institution already uses, where the workflow supports it, and determines which additional fields each case requires. When a customer is rated High or Critical, it triggers enhanced due diligence automatically and pre-populates the review form.
- Apply your own procedures: The agent adapts to each institution's own workflows and internal policy requirements, rather than applying one fixed risk-scoring methodology. As it follows how the institution already operates, it works across regulatory regimes without needing a separate model for each jurisdiction.
Exploring AI agents for your customer due diligence process? See how Hawk's CDD Agent works in practice.