AI KYC AML: How Banks Are Moving AI Agents From Pilot to Production in 2026

Only 10% of surveyed financial services organisations have implemented AI agents at scale, while adoption remains concentrated in ideation and pilot stages (Source: Capgemini Research Institute).

The Next Vertical tracks where agentic AI meets regulated finance, and KYC and AML are among the most practical places to examine that intersection.

Compliance is the one banking function where AI automation has a measurable operational target: the cost of onboarding a customer, the time required to investigate an alert and the number of cases an analyst can handle.

The problem is that most products marketed as AI KYC describe a narrow capability: a model that extracts information from a passport or identifies a potentially suspicious transaction. That is not the same as an agent that retrieves evidence across systems, investigates an alert and prepares a complete case for human review.

This report breaks down how banks are moving AI agents for KYC and AML into production in 2026, which deployment models are available, what each can realistically do and how to evaluate them.

Key Takeaways

• Around 80% of financial services firms are still testing AI agents, while only 10% have deployed them at scale.
• Customer onboarding (59%) and fraud detection (64%) are leading uses of AI agents in banks.
• HSBC's AML AI identified two to four times more suspicious activity and cut alerts by around 60%.
• FIS launched its AML Investigations Agent commercially on October 15, 2026, with Amalgamated Bank deploying it.
• FIS projects up to 90%+ less Level 1 review time and around 98% less Level 2 investigation time.
• US regulators have excluded generative and agentic AI from revised model-risk guidance, but banks remain responsible for proper oversight.
• EU AI Act high-risk requirements are scheduled for December 2, 2027 (Annex III) and August 2, 2028 (Annex I).
• The main approach is controlled automation: AI agents gather evidence and prepare recommendations, while compliance professionals make key decisions.

The 2026 Market Backdrop: Where AI KYC Adoption Actually Sits

Capgemini's World Cloud Report – Financial Services 2026 describes an industry moving from traditional automation towards cloud-based AI agents.

Its research indicates that only 10% of surveyed financial services organisations have implemented agents at scale, while approximately 80% remain in the ideation or pilot stages.

The research also indicates that 33% of financial services firms are actively developing proprietary AI agents internally, while nearly half of surveyed banks and insurers are creating new roles to supervise AI agents.

These findings point in the same direction: experimentation is widespread, but scaled deployment remains relatively limited.

The adoption figures also need to be separated from individual use cases.

Among banks deploying cloud-native AI agents at scale, customer onboarding accounts for 59% of identified applications and fraud detection for 64%. These are use-case figures, not the percentage of all banks using AI for those purposes.

The evidence is broader than KYC and AML alone. It covers financial services generally, including customer service, underwriting, claims and fraud detection.

The distinction matters because an AI document-verification product, an AML transaction-monitoring model and an agent conducting an investigation are three different technologies.

Why Banks Are Moving KYC and AML Onto AI Agents

The business case is built around three operational problems.

Evidence gathering: An investigator may need to retrieve customer records, transaction histories, previous alerts, screening results and supporting documents from several systems before substantive analysis begins.

Alert volumes: AML teams must investigate potentially suspicious activity while filtering out false positives and prioritising the cases that warrant attention.

Customer onboarding: KYC teams collect and verify identity documents, establish beneficial ownership, conduct screening and assess customer risk. Delays can affect conversion and operating costs.

AI agents can connect these steps through approved tools and workflows.

An agent may retrieve a customer's transaction history, run an authorised screening query, compare records and prepare an evidence-linked summary. This is different from a conventional model that simply assigns a risk score.

FIS identified manual evidence assembly as a major source of investigative workload when it announced its financial-crime AI agent with Anthropic in May 2026.

The opportunity is not to eliminate compliance judgment. It is to redirect investigators away from repetitive preparation and towards decisions that require experience and contextual understanding.

What an AI Agent for KYC and AML Actually Needs to Do

Not every product labelled AI KYC qualifies as an agentic system.

Apply five tests before evaluating a vendor.

1. Workflow execution: Can the system complete a sequence of connected tasks, rather than simply extract a document field or answer a question?
2. Approved tool access: Can it retrieve information from authorised customer, transaction, screening and case-management systems?
3. Evidence traceability: Does every material conclusion link to the underlying document, database record or transaction?
4. Permission controls: Can the bank restrict what the agent can read, write, approve or escalate?
5. Human accountability: Can investigators review, correct and approve consequential outputs, with a record of their actions?

A system that passes only the first two tests may be useful automation, but it is not necessarily suitable for a regulated production workflow.

The distinction is particularly important when comparing machine-learning detection products with investigative agents.

AI KYC and AML Deployment Models Compared in 2026

The four models are not interchangeable. Some provide agentic workflow execution, while others deliver conventional machine-learning detection or specialist automation.

1. FIS: The Banking Vendor Bringing Agents Into AML Investigations

FIS announced its Financial Crimes AI Agent on May 4, 2026, developed with support from Anthropic's Applied AI team.

The system is designed to retrieve evidence across banking systems, analyse customer activity against financial-crime typologies and prepare investigation summaries for human review.

BMO and Amalgamated Bank were identified as early development partners.

The important development came on October 15, 2026, when FIS announced that the product, now called the FIS AML Investigations Agent, was commercially available to US-based banks, including institutions that are not existing FIS clients.

Amalgamated Bank, an original design partner, is now deploying the agent.

The commercial announcement included three significant performance projections based on Amalgamated's analysis of its existing workflows:

• More than 90% reduction in Level 1 alert review time.
• Approximately 98% reduction in Level 2 investigation time.
• More than 80% reduction in suspicious activity report narrative preparation time.

These are projected workflow improvements, not independently audited production results. They are based on the bank's analysis of existing workflows against the agent's capabilities.

FIS says the agent is built on its Trust Assured framework. Each output is presented as a recommendation, analysts retain control of case closure, statements link to source records and customer-specific risk procedures remain separated.

The advantage is integration with banking data and existing financial-crime infrastructure.

The constraint is vendor dependency. Banks need to assess data portability, integration requirements, contractual protections, audit access and the ability to change providers.

For banks considering this approach, commercial availability is now established, but the depth of independently verified production evidence remains an important procurement question.

2. Google Cloud AML AI at HSBC: The Machine-Learning Benchmark

HSBC's work with Google Cloud is one of the most frequently cited production examples of AI-powered AML monitoring.

Google Cloud and HSBC report that AML AI identified two to four times more suspicious activity than the previous approach while reducing alert volumes by approximately 60%.

The results are significant, but the technology needs to be classified correctly.

Google Cloud AML AI uses machine learning to identify suspicious patterns in transaction data. It is not an autonomous investigative agent that independently retrieves evidence and completes an AML case.

That distinction is important for banks comparing products.

Transaction-monitoring models identify suspicious activity and generate risk signals. Investigative agents use approved tools to retrieve supporting information and prepare case documentation.

The two technologies can work together in the same compliance workflow.

Google and HSBC's reported results are customer- and vendor-reported, not an independently audited comparison across the banking industry.

The lesson is that AI can improve detection and reduce unnecessary alerts, but a separate investigation workflow is still needed.

3. In-House Development: Control at the Cost of Complexity

Capgemini's research indicates that approximately one-third of surveyed financial services firms are actively developing proprietary AI agents internally.

The attraction is control.

Banks can design workflows around internal policies, connect agents to proprietary data and retain greater flexibility over model selection and deployment architecture.

They can also determine how agents interact with internal case-management systems, transaction databases and customer records.

The cost is responsibility.

An internal development programme needs:

• AI and software engineering teams.
• Model and workflow validation.
• Information-security testing.
• Data governance and access management.
• Ongoing monitoring and maintenance.
• Compliance personnel to supervise the systems.

The 33% figure indicates development activity, not successful production deployment, and applies to financial services firms rather than banks alone.

For larger institutions with established technology and model-risk teams, in-house development may be attractive. For smaller banks, the operational burden can outweigh the flexibility.

4. Specialist Compliance Platforms: Faster Onboarding and Screening

RegTech providers offer specialist functionality across identity verification, sanctions screening, adverse-media monitoring, beneficial ownership research and ongoing customer due diligence.

These platforms can be particularly useful for fintechs and institutions that need to introduce AI KYC onboarding automation without building an internal technology stack.

Their strength is specialisation.

A provider focused on identity verification may offer stronger document coverage than a general-purpose agent. Another may have deeper sanctions data or corporate ownership capabilities.

The risk is fragmentation.

A bank may end up with separate tools for identity verification, screening, monitoring and case management. If the systems do not share a consistent record, investigators can struggle to reconstruct why a customer was approved or why their risk classification changed.

A specialist platform should therefore be assessed on integration and auditability, not just the accuracy of its individual features.

Banks should prioritise independently documented implementation results when comparing providers, rather than relying solely on vendor-reported efficiency claims.

How These AI KYC and AML Solutions Are Priced

Commercial pricing arrangements vary by provider, but banks will generally encounter four broad procurement and cost structures.

• Platform bundle: AI functionality is included in a core banking or compliance platform. Predictable procurement, but the bank may pay for capabilities it does not use.
• Usage-based API: Pricing is based on document checks, risk assessments, API calls or other consumption measures. Easy to start, harder to forecast at scale.
• Per-outcome pricing: Charges are linked to completed tasks or agreed outcomes, such as cases processed or onboarding workflows completed. The challenge is defining and measuring those outcomes.
• Internal build: Engineering, infrastructure, validation, security and supervision costs sit with the bank. The headline software cost may be low, but the total operating burden can be substantial.

The decision rarely turns on the headline licence price.

Integration, validation, case-management changes and human review can materially affect total cost of ownership.

Banks should calculate the cost per successfully completed and appropriately reviewed case, rather than the price of an individual AI interaction.

The Human Oversight and Auditability Test

The agent prepares. The investigator remains accountable.

Four controls separate a credible compliance deployment from a system that simply produces convincing text.

Narrow permissions: The agent should receive only the access required for its assigned task. Reading customer records and preparing a draft should not automatically grant permission to change a risk rating or close an account.

Source-linked outputs: Every material conclusion should identify the underlying document, transaction or database record. Investigators should be able to verify the evidence without reconstructing the agent's entire process.

Approval for consequential actions: Suspicious activity reporting, customer offboarding and material changes in risk status should be subject to documented accountability and appropriate approval controls.

Reviewer monitoring: Banks should measure override rates, correction frequency, review time and evidence quality. A reviewer who approves almost every recommendation in seconds may not be providing meaningful oversight.

Human involvement is not automatically effective simply because an approval button exists.

Production systems should also maintain complete action logs, track changes to agent instructions and model versions, and monitor changes in underlying data quality.

Regulation: US Model Risk, FinCEN and the EU AI Act

The regulatory position changed during 2026, but the changes should not be interpreted as blanket permission for autonomous compliance decisions.

United States: Revised Model-Risk Guidance

On April 17, 2026, the OCC, Federal Reserve and FDIC issued revised model-risk management guidance.

The guidance replaces the 2011 interagency guidance and the 2021 statement on model risk management for systems supporting BSA/AML compliance.

It explicitly excludes generative and agentic AI models from its scope because of their novel and rapidly evolving characteristics.

That is not a regulatory exemption.

The guidance states that banking organisations should use their risk-management and governance practices to determine appropriate controls for tools, processes and systems outside its scope.

Banks remain responsible for applicable legal, regulatory, security and compliance requirements.

The practical implication is that banks need to consider controls that traditional model-risk frameworks may not fully address, including tool permissions, prompt injection, data provenance, third-party dependencies and autonomous actions.

FinCEN: Proposed AML/CFT Programme Reforms

On April 7, 2026, FinCEN issued a proposed rule to reform financial institutions' AML/CFT programme requirements.

The proposal emphasises risk-based, reasonably designed programmes and greater focus on effectiveness.

The comment period closed on June 9, 2026.

The proposal is not a final rule, and it does not specifically authorise autonomous AI agents.

A related proposed rule was also issued by the OCC, FDIC and NCUA for institutions under their supervision. These parallel proposals should not be confused with a single final regulatory framework.

Banks should check the latest rulemaking status before incorporating proposed provisions into compliance policies.

European Union: AI Act Application Dates

The EU's Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on July 27, 2026.

The amended timetable provides:

• December 2, 2027: Application of the relevant high-risk AI requirements to systems classified as high-risk under Article 6(2) and Annex III.
• August 2, 2028: Application of the relevant high-risk AI requirements to systems classified as high-risk under Article 6(1) and Annex I.

Other applicable obligations, including transparency and general-purpose AI requirements, have their own application dates and were not generally deferred by these changes.

Creditworthiness assessment of natural persons is specifically identified as a high-risk use case under Annex III, subject to the applicable provisions and exceptions.

KYC and AML systems are not automatically high-risk simply because they process financial or identity information. Classification depends on the system's intended purpose and the relevant provisions of the AI Act.

Banks should obtain legal and compliance assessments for individual applications rather than applying a blanket classification to all AI KYC products.

Stablecoins and Tokenisation: The Next KYC and AML Workload

Digital assets introduce another layer of screening and monitoring for banks.

Institutions dealing with stablecoin issuers, tokenised securities, exchanges and custody providers may need to assess customer identities, beneficial ownership, wallet addresses, sanctions exposure and on-chain transaction histories.

Traditional name screening is insufficient on its own.

AI agents could help investigators connect customer records with blockchain analytics, retrieve relevant transactions and assemble evidence across conventional and digital-asset systems.

However, wallet attribution can be uncertain. An association between a customer and an address does not automatically establish control or illicit activity.

The challenge is to connect conventional customer due diligence with on-chain monitoring while maintaining reliable evidence and clear accountability.

These applications represent an emerging opportunity for agentic AI rather than evidence of established, large-scale autonomous KYC and AML deployments across digital-asset institutions.

Choosing by Institution Profile

The right deployment model depends on the bank's technology, workload and internal capabilities.

• Large bank with a modern data platform: Build or co-develop agents internally, with specialist vendors supplying model and infrastructure components. Retain internal control over validation and governance.
• Regional or community bank using a major core provider: An embedded solution such as FIS may offer a more practical implementation route than building an agent from scratch.
• Fintech or digital-asset firm with fast onboarding requirements: A specialist identity and screening platform can accelerate AI KYC onboarding automation, provided it connects to a central customer and case-management record.
• Bank with a substantial AML alert backlog: Start with alert triage and evidence assembly, where operational improvements can be measured without handing over consequential decisions.

Risks and Limitations

The evidence base remains uneven.

Many published results come from vendor announcements and joint customer case studies rather than independent, audited comparisons. Banks should distinguish commercial availability from actual production usage and projected performance from measured outcomes.

The main risks are:

• Over-reliance: Reviewers approve recommendations without checking the evidence.
• Prompt injection: Malicious instructions embedded in documents or external content influence agent behaviour.
• Explainability: A plausible narrative is mistaken for a verified conclusion.
• Data privacy: Sensitive identity and financial information is exposed through excessive permissions or poorly governed third-party systems.
• Concentration: Critical compliance workflows become dependent on one model, cloud provider or vendor.
• Regulatory change: New requirements make existing controls incomplete or outdated.

No deployment model removes the bank's responsibility for its compliance programme.

Conclusion: Governance Is the Production Bottleneck

AI agents have a credible role in KYC and AML, particularly where investigators spend substantial time collecting information, reconciling records and preparing case documentation.

The evidence needs to be interpreted carefully.

HSBC demonstrates the value of machine learning in transaction monitoring. FIS and Anthropic demonstrate the development of more agentic financial-crime investigation workflows, with FIS now commercially offering its AML Investigations Agent to US banks and deploying it at Amalgamated Bank.

These examples represent different stages of AI adoption and should not be treated as equivalent evidence of scaled agentic deployment.

The transition from AI experimentation to production in banking will not be determined by model capability alone. It will depend on whether financial institutions can integrate agents into existing compliance infrastructure while maintaining reliable evidence, controlled permissions, auditability and accountable human oversight.

The immediate opportunity is not autonomous compliance, but controlled delegation of repetitive investigative work.

Banks that begin with one measurable workflow, test it in shadow mode and expand permissions only when the evidence supports doing so are better positioned to move beyond experimentation.

Before buying or building an AI KYC or AML solution, ask three questions:

1. Can every material conclusion be traced to reliable source data?
2. Who is accountable for approving each consequential decision?
3. How will the bank detect when the agent's performance, behaviour or underlying data begins to change?

The banks that answer those questions will be better placed to move AI agents from pilot to production.

Read Next

• AI Agents, Stablecoins and 24/7 Finance: What CV Summit 2026 Revealed
• Mathias Ruch: Build the Middleware, Not the Model
• Tokenised Stocks: Who Owns the Shares, and Who Bears the Risk?

FAQs

1. How do banks use AI agents for KYC and AML?

Banks can use AI agents to extract information from identity documents, initiate sanctions and adverse-media screening, research beneficial ownership, assemble transaction evidence and prepare suspicious activity report narratives. Agents support compliance workflows while accountable personnel oversee consequential decisions.

2. Are banks actually running AI agents for KYC in production?

Some institutions are moving agentic systems into commercial deployment, but scaled adoption remains limited. Capgemini found that around 10% of surveyed financial services organisations had implemented AI agents at scale. FIS announced commercial availability of its AML Investigations Agent in October 2026, with deployment at Amalgamated Bank. HSBC's widely cited AML results, by contrast, relate to machine learning rather than autonomous investigative agents.

3. Do regulators allow AI agents in AML compliance?

There is no general prohibition on using AI agents in AML operations. Banks remain responsible for applicable AML/CFT obligations, governance, data protection, security and accountability. Revised US model-risk guidance excludes generative and agentic AI from its scope but does not exempt these systems from appropriate risk management.

4. Does the EU AI Act apply to KYC and AML agents?

Potentially, depending on the system's intended purpose and classification. KYC and AML applications are not automatically high-risk simply because they process financial or identity data. The revised Annex III high-risk application deadline is December 2, 2027, while relevant Annex I requirements apply from August 2, 2028.

5. What is the biggest risk of AI KYC automation?

Weak human oversight is one of the most significant risks. If investigators approve agent-generated recommendations without checking evidence, or if conclusions cannot be traced to source data, automation can undermine compliance controls. Banks should monitor reviewer behaviour, error rates, overrides and evidence quality.

Disclaimer: This content is provided for informational purposes only and does not constitute legal, financial or compliance advice. Regulatory references and vendor announcements reflect publicly available information as of October 31, 2026. Regulatory requirements and product availability may change. Published performance results are largely vendor- or customer-reported and should not be treated as guaranteed outcomes.

Sources and References

1. Capgemini Research Institute – AI Agent Adoption Research, November 2025. Supports adoption rates, proprietary agent development and supervisory roles.
   Read the research announcement: https://www.capgemini.com/us-en/news/press-releases/banks-and-insurers-deploy-ai-agents-to-fight-fraud-and-process-applications-with-plans-for-new-roles-to-supervise-the-ai/
2. Capgemini – World Cloud Report: Financial Services 2026. Supports AI-agent applications in customer onboarding, fraud detection and other banking processes.
   Read the report announcement: https://www.capgemini.com/us-en/news/press-releases/banks-and-insurers-deploy-ai-agents-to-fight-fraud-and-process-applications-with-plans-for-new-roles-to-supervise-the-ai/
3. FIS – AML Investigations Agent Commercial Launch, October 15, 2026. Supports commercial availability, Amalgamated Bank deployment and projected efficiency improvements.
   Read the announcement: https://www.investor.fisglobal.com/news-releases/news-release-details/fis-aml-investigations-agent-now-commercially-available-help
4. Amalgamated Bank – AI-Powered Financial Crime Investigation Deployment. Customer-side evidence of the FIS implementation and its projected workflow improvements.
   Read the announcement: https://www.amalgamatedbank.com/news/amalgamated-bank-helps-pioneer-ai-powered-financial-crime-investigations-bringing-new
5. Google Cloud – HSBC AML AI Case Study. Supports the reported two-to-four-times increase in suspicious activity identified and approximately 60% reduction in alerts.
   Read the case study: https://cloud.google.com/blog/topics/financial-services/how-hsbc-fights-money-launderers-with-artificial-intelligence
6. Federal Reserve – SR 26-2: Revised Model Risk Management Guidance, April 17, 2026. Supports the revised US model-risk framework and treatment of generative and agentic AI.
   Read the guidance: https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm
7. FinCEN – Proposed AML/CFT Programme Reforms, April 7, 2026. Supports the proposed changes to US AML/CFT programme requirements.
   Read the proposal announcement: https://www.fincen.gov/news/news-releases/fincen-proposes-rule-fundamentally-reform-financial-institution-programs
8. OCC, FDIC and NCUA – Proposed AML/CFT Programme Reforms, April 7, 2026. Supports the parallel proposed banking-agency requirements.
   Read the announcement: https://www.occ.treas.gov/news-issuances/news-releases/2026/nr-ia-2026-25.html
9. European Union – Regulation (EU) 2026/1744, Digital Omnibus on AI. Supports the revised AI Act implementation deadlines.
   Read the regulation: https://eur-lex.europa.eu/eli/reg/2026/1744/oj
10. European Commission – AI Act Implementation Guidance. Supports the explanation of high-risk AI classifications and implementation requirements.
    Read the guidance: https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai