KYC Evidence Must Survive the Agent to Analyst Handoff

Define the Evidence the Analyst Must Receive

The KYC operations manager should specify the evidence package required for each material onboarding decision. It should distinguish observed customer information, extracted fields, inferred relationships, unresolved discrepancies, and the agent’s proposed assessment. The analyst needs the basis for judgment, not only a polished summary.

FATF’s technology analysis supports responsible innovation with informed oversight.¹ It does not approve any particular onboarding workflow. The bank should translate its own customer-due-diligence obligations into evidence and authority requirements for the supplier’s actual service.

Start with a representative case and identify what the provider obtains, changes, verifies, and returns. Record which decisions the provider may make and which remain with the bank. A task marked ready for analyst should mean that the agreed evidence is present, not that the agent has exhausted its processing budget.

Keep Source Facts Separate from Inference

An agent may extract a name from a document, infer a relationship from several records, or propose that two entities are the same. These operations have different evidentiary status. The case record should preserve source references, relevant dates, confidence limitations where meaningful, and contradictions requiring review.

The study reports manual intervention and divided visibility across systems.² Those accounts do not establish KYC errors. They support testing whether a corrected field or resolved discrepancy remains traceable when the provider hands the case to the bank analyst.

For a hypothetical ownership structure, the supplier may infer a controlling relationship from an outdated document. The analyst should be able to find the original record, see its date, understand the inference, and identify missing current evidence. A narrative conclusion should not conceal the gap.

Use a Joint KYC Handoff Record

Figure 1 proposes four fields: source support, unresolved judgment, intervention history, and receiving acceptance. Link the provider’s case reference to the bank record so the analyst can request additional evidence without losing the original chronology. Preserve the version of policy and configuration governing the preparation.

Human corrections should record the original value, corrected value, reason, authority, and relevant source. Distinguish repairing extraction from changing a risk judgment. Both may be appropriate, but they require different review and affect the interpretation of the supplier’s performance.

NIST’s identity analysis emphasizes attributable agents and delegated entitlements.³ Applied to this handoff, the bank should be able to identify which workload prepared or changed the case and under whose authority. A shared account should not make the source of a material alteration unknowable.

Control Rework and Local Decision Duties

The analyst should record whether the handoff was accepted, returned for missing evidence, corrected, escalated, or rejected. Returned work should remain in the provider’s service measurement where relevant. Otherwise a high preparation count can conceal a burden transferred to the bank.

EU, UK, Swiss, US, and other KYC, AML, privacy, secrecy, and record requirements differ by entity and activity. The manager should maintain the applicable instructions and qualified decision route. A global supplier checklist should not override the bank’s local obligations or substitute an unsupported inference for required evidence.

Test name variations, conflicting records, stale documents, incomplete ownership structures, and duplicate cases. Use appropriate data safeguards and qualified reviewers. The purpose is to establish the handoff mechanism and identify gaps, not to claim that a small test proves portfolio-wide compliance.

Accept the Handoff on Evidence Quality

A reasonable objection is that detailed provenance can slow onboarding. Use structured source references and reusable evidence rather than duplicate every document in the summary. The objective is efficient challenge. Removing provenance may make preparation faster while increasing analyst time and reducing decision quality.

Before production acceptance, reconstruct normal, corrected, returned, and escalated cases across both systems. Compare preparation volume with analyst acceptance, rework, and final disposition. Assign corrective owners and repeat the affected tests. A completed provider task should not close an unresolved bank decision.

The manager should approve a handoff the analyst can rely on and challenge. Agent assistance is valuable when it reduces preparation effort while preserving the evidence and uncertainty necessary for bank judgment. The supplier’s summary should help the analyst reach a supported decision, rather than become a substitute for its basis.

Evidence and Source Note

The study is a nonrepresentative cross-section of 850 vendor delivery-team respondents on 150 engagements serving Tier 1 financial institutions, collected during January–June 2026. Neither banks nor vendors corroborated the accounts. It establishes reported experience, not causation, legal breach, or market prevalence. The author-supplied version 1.8.2 is dated November 1, 2026 and is cited as a forthcoming manuscript consulted October 23, 2026.⁴

This is an analytical decision paper based on the supplied study and selected primary public sources checked through October 23, 2026. The original contribution is a KYC handoff record separating source facts, inferred judgments, human corrections, and analyst acceptance across provider and bank systems. The proposed method has not been independently validated. Legal requirements depend on the entity, activity, jurisdiction, and effective provisions; supervisory observations, research, and professional commentary have distinct authority.

Notes

1. Financial Action Task Force, “Opportunities and Challenges of New Technologies for AML/CFT,” Financial Action Task Force, July 2021, public report summary and suggested actions on informed oversight, https://www.fatf-gafi.org/en/publications/Digitaltransformation/Opportunities-challenges-new-technologies-for-aml-cft.html. ↩
2. Phil Hatch, Agentic AI Outsourcing at Tier 1 Financial Institutions: Full Study Report, version 1.8.2 (Akholi, forthcoming manuscript dated November 1, 2026), Part 5, “The Five Manual Alteration Methods” and “Disclosure of Manual Alteration,” table 5.8, https://doi.org/10.2139/ssrn.7164559; Hatch, Agentic AI Outsourcing, Part 2, sec. 5.1, “Agent Actions Visible Only Inside Each Firm’s Own Tools”. ↩
3. Bill Fisher and Ryan Galluzzo, “Back to the Future: Why Agentic AI Needs a Strong Identity Foundation,” National Institute of Standards and Technology, August 27, 2026, “Credential Sharing” and “Static and Long-lived Credentials”, https://www.nist.gov/blogs/cybersecurity-insights/back-future-why-agentic-ai-needs-strong-identity-foundation. ↩
4. Hatch, Agentic AI Outsourcing, Introduction, “Executive Summary” and “Evidentiary Basis and Its Limits”. ↩

Bibliography

• Financial Action Task Force. “Opportunities and Challenges of New Technologies for AML/CFT.” Financial Action Task Force. July 2021. https://www.fatf-gafi.org/en/publications/Digitaltransformation/Opportunities-challenges-new-technologies-for-aml-cft.html.
• Fisher, Bill, and Ryan Galluzzo. “Back to the Future: Why Agentic AI Needs a Strong Identity Foundation.” National Institute of Standards and Technology. August 27, 2026. https://www.nist.gov/blogs/cybersecurity-insights/back-future-why-agentic-ai-needs-strong-identity-foundation.
• Hatch, Phil. Agentic AI Outsourcing at Tier 1 Financial Institutions: Full Study Report. Version 1.8.2. Akholi. Forthcoming manuscript dated November 1, 2026. Author-supplied manuscript consulted October 23, 2026. https://doi.org/10.2139/ssrn.7164559.