AgentKYZ uses artificial intelligence (AI) to prepare know your customer (KYC) cases: reading documents, mapping ownership, running screening and setting out an assessment with its reasoning. Qualified people review the findings. Your firm retains the final KYC decision.
For a compliance team evaluating AI KYC software, that division of work is only part of the assessment. You also need to understand how client data is handled and what evidence remains when someone challenges a conclusion. AgentKYZ brings case documents, risk assessments and review decisions together so your team can examine the work behind a decision.
What the AI does in an AgentKYZ case
The AgentKYZ workflow starts with your anti-money laundering (AML) policy, checklists and risk appetite, configured per jurisdiction. The agents read the case documents, build the ownership chart, screen sanctions, politically exposed persons (PEPs) and adverse media, and prepare a reasoned case assessment.
The purpose is to give a reviewer an organised case to investigate, with less document sorting and assembly. The assessment remains something to check against the underlying evidence and your policy.
You can run this workflow through AgentKYZ’s KYC software with your own compliance team, use our managed KYC service, or combine in-house reviews with specialist support. The choice changes who performs the review; your firm keeps responsibility for customer acceptance and compliance.
Our terms of service explain that AgentKYZ may use AI systems and third-party model providers for research, summaries, classifications, recommendations and other workflow outputs. They also require users to review outputs before relying on them. AI-assisted preparation does not replace legal, regulatory or professional judgment.
How human review challenges the findings
Human-in-the-loop KYC means giving someone the evidence and responsibility to test an assessment. In AgentKYZ’s published workflow, a qualified reviewer checks the agents’ work and tests the conclusions. Overriding the agents requires a written reason. High-risk and complex cases go to senior compliance, which records a recommendation.
The US National Institute of Standards and Technology (NIST) describes how generative AI can confidently produce incorrect content, including logic or citations that appear to justify an answer. Its Generative AI Profile, section 2.2 calls this “confabulation”, often called hallucination. Reviewers need to test even a convincing explanation against the source evidence.
Consider a hypothetical review example, not a customer case: a screening result has the same name as an investor, but the date of birth differs. A reviewer should examine the available identifiers and the source record before deciding whether it is a match. If the evidence is insufficient, the uncertainty should remain visible for further work. A name match alone should not settle the decision.
The same discipline applies to an ownership chart that conflicts with a register, or a risk assessment based on missing documents. We recommend checking those difficult cases during your evaluation, including how a reviewer records disagreement and when senior input is needed.
For managed KYC, our scope and responsibility information makes the boundary explicit: your firm retains customer acceptance, high-risk approvals and suspicious activity reporting decisions. The service does not itself appoint AgentKYZ as your money laundering reporting officer (MLRO).
How client data is used, retained and shared
Client documents are not used to train models, as stated in our published workflow. This is a commitment about training use. It should not be read as a promise that AI providers never process data or that all data is deleted immediately after a case is prepared.
Running a trained model on case information to generate an output is commonly called inference. Training and inference are different uses of data. Singapore’s Personal Data Protection Commission (PDPC) makes that distinction in its generative AI guidance, including model providers processing personal data on behalf of downstream users during inference (paragraph 7.4).
AgentKYZ’s privacy policy covers documents, onboarding information, due diligence materials, screening results and other information submitted to or generated inside the service. It describes using information to carry out requested KYC, AML and workflow activities, alongside operating, maintaining and supporting the service.
The policy also sets out these boundaries:
- We do not sell personal data. Information may be shared where necessary to operate the service, comply with the law or protect our rights, including with service providers and professional advisers.
- Personal information is retained for as long as needed for the stated purposes, including applicable legal and regulatory requirements. The public policy does not specify one fixed retention period for every KYC engagement.
- Information may be processed outside your country. The policy describes reasonable steps to use appropriate contractual, organisational and technical safeguards for those transfers.
- You can request access or removal by emailing [email protected]. Requests are reviewed subject to applicable rights and legal requirements to retain records.
Before transferring live files, confirm which providers will process the relevant data, where processing and storage occur, and how retention and deletion apply to documents, outputs, logs and backups. Ask how the no-training commitment is reflected in the arrangements for the providers used in your workflow. These are engagement-specific due-diligence questions; a general privacy notice cannot answer all of them.
Where to check security and contractual evidence
Start your security review at the AgentKYZ trust centre, published under Cortexa Research Lab Limited, the service operator named in our terms and privacy policy. It brings together policy, control and subprocessor information, with security-questionnaire and request-access options.
As checked on 29 October 2026, the public trust centre lists SOC 2 Type 2 with a “Compliant” status. For procurement, ask to inspect the underlying assurance material and check the scope, reporting period and any exceptions relevant to your intended use. The public listing is not a substitute for that review.
Our privacy policy describes administrative, technical and organisational safeguards designed to protect personal information. To assess those safeguards for your deployment, use the trust centre and ask about encryption, access permissions, incident handling and the data flow through third-party services. Confirm which providers handle each processing step and the safeguards that apply.
Record the arrangements your firm requires in the applicable engagement and data-processing documentation before work begins. In particular, agree hosting and transfer requirements, authorised access, retention, exit arrangements, and any audit or incident-notification terms your firm needs.
What the KYC audit trail needs to explain
An auditable KYC file lets another reviewer examine the evidence and understand the decision. AgentKYZ keeps client documents, risk assessments and review decisions together with an audit trail. For managed KYC, the agreed scope typically includes ownership and control analysis, screening rationale, indexed documents, reviewer notes and a risk assessment. Missing evidence and unresolved concerns remain visible at handover.
When evaluating that output, we recommend following one conclusion back through the file. For the hypothetical screening example above, can your reviewer find the source result, the identifiers considered, the reason for the match decision and any unresolved question? If a conclusion was overridden, can they inspect the written reason?
Also ask how the review and approval record identifies the responsible people, how changes are recorded, and how your team can retrieve the records it needs after the engagement. Inspect the actual record format against your own retention and oversight requirements.
Case-level reasoning and model-level explainability answer different questions. A case file helps explain the evidence and review behind a KYC conclusion. Assess the underlying model’s behaviour and reliability separately. If your policy requires tamper-resistant storage or prompt and model-version logs, include those requirements in the technical review.
Want to assess the workflow against your policy? Book a call to discuss the case evidence your reviewers need. Bring the review type and your assurance questions; there is no need to send identity documents to request a quote.
How this fits your wider AI governance
AgentKYZ’s policy-led preparation, human review and documented case work give your team a workflow to assess within its AI governance process. The institution still needs to determine whether the proposed use is suitable, what testing it needs, and how it will oversee the service.
For Singapore financial institutions, MAS’s October 2026 announcement on responsible AI adoption states that institutions remain accountable for AI used in their services, including third-party AI. The new guidelines have phased implementation dates. Our MAS AI risk management guide covers those dates, the supervisory framework, validation and ongoing oversight in detail. Use that alongside the separate MAS AML/CFT requirements guide for the fund-manager and VCC context.
Data protection needs its own assessment. The PDPC’s generative AI guidelines, paragraphs 9.1 to 9.3, address deployers’ responsibility to obtain sufficient information on upstream safeguards, define the purpose and amount of personal data processed, and safeguard inputs, outputs and other data collected through their systems. The guidelines are advisory; the underlying Personal Data Protection Act obligations still apply. Those are useful questions for a Singapore deployment; other jurisdictions require their own assessment.
Evaluate one defined KYC workflow
Start with a specific population, such as a periodic-review backlog or new investor onboarding. We recommend agreeing the permitted AI tasks, the evidence required, the reviewer and approver responsibilities, and escalation criteria before processing live cases.
Test representative files, including incomplete documents and conflicting information. Check whether the resulting case supports a defensible human decision and whether unresolved issues remain clear. Have your privacy, security and compliance teams assess the evidence and agree the terms they need before rollout.
You can explore software for your own reviewers or managed KYC delivery. For a scoping conversation, bring your case count, jurisdictions, review type and AML policy requirements. We can discuss where AgentKYZ fits and what your team needs to verify before the first live file.