Eight hours per Know Your Customer (KYC) case. Thousands of FTEs. Up to $2 billion a year. That's the price of KYC and broader Risk & Compliance (R&C) at major banks today.
BCG and Anthropic have been exploring what happens when that process is approached not as a series of isolated AI use cases, but as an end-to-end agentic system. Building on Anthropic’s existing KYC Screener, we developed an 11-agent KYC onboarding system that orchestrates the process from intake through case finalization while keeping the ultimate decision with a human.
This article explores what the team built, how the system works, and what it suggests about the potential of agentic AI in KYC.
Why is KYC a compelling use case for agentic AI?
A typical KYC file requires more than eight hours of manual copy-and-paste, document review, and narrative drafting. More broadly, BCG estimates that risk and compliance spending at a large global bank can reach $1 billion to $2 billion annually, with anti-financial-crime activities representing the single largest cost pillar.
Those characteristics create an opportunity to use AI not simply to generate text or accelerate an individual task, but to rethink how work is performed across the KYC process. Imagine a KYC process in which customer information is automatically populated: relevant data is extracted and brought together from 20 to 30 internal and external sources, screening and due-diligence activities are performed—and all this takes place in the background. Instead of spending much of their time gathering, copying, and reconciling information, KYC professionals can focus their attention on high-value activities including investigation, challenge, and risk-based decision-making.
But taking advantage of AI to streamline the KYC process requires more than a model alone. Institutions must learn how to assemble and operationalize deep KYC expertise, technology and AI capabilities, appropriate controls, and human judgment.
What is the KYC reference agent?
The starting point in designing an agentic system was Anthropic’s financial-services plugin library, which included a KYC Screener with four agents and three skills. We expanded it into an end-to-end KYC reference agent comprising 11 agents, 17 skills, and three Model Context Protocol (MCP) connections to internal and external data sources.
To build out the end-to-end reference system, the team added the supporting components required for enterprise-grade KYC: a KYC rulebook, a comprehensive evaluation framework with 50+ graders and synthetic data, an audit database schema, communication and reporting templates, and a user-facing visualization layer.
The resulting system supports the KYC review journey from intake through finalization. Its modular architecture allows individual components to be customized or replaced with client-specific solutions.
How does an 11-agent system actually run a KYC case?
Exhibit 1: The KYC Agentic Workflow
The architecture breaks the KYC process into specialized agents coordinated by a central orchestrator. Rather than following a fixed sequence, the orchestrator determines which agents to dispatch based on the case and the outputs of previous steps.
It also invokes cross-cutting agents when needed and enforces human-decision gates before consequential actions, such as customer communication or case finalization. Seven agents perform the core KYC workflow, while customer outreach, decline handling, and QA operate across it. Together with the orchestrator, they form the 11-agent system.
This separation allows individual capabilities to be invoked only when needed while maintaining a consistent process and control structure across the case.
(Click above to watch the video)
Where does a human fit into this agentic KYC process?
Agentic does not mean removing human judgment from the process. The architecture deliberately embeds human-decision gates. While the orchestrator can move a case through the workflow and coordinate specialized agents, an analyst must approve consequential actions, such as customer communication or case finalization.
Human oversight is, therefore, an essential part of the system design, not an intervention added after the fact. The QA agent provides an additional layer of assurance by independently reviewing each workflow step before analyst sign-off.
Especially in regulated processes, the objective isn’t to simply maximize agent autonomy. It is to determine which activities can be delegated to agents, how those agents should interact, and where human judgment and accountability must remain embedded.
What sits underneath the agents?
The 11 agents are only one layer of the overall system. Underneath them sit 17 reusable skills, MCP connections to data and tools, a KYC rulebook, audit infrastructure, evaluation capabilities, and the user interface.
Exhibit 2: The KYC Agentic Architecture
This separation is important. Agents provide the orchestration logic, while the broader system supplies the capabilities, data, controls, and domain methodology required to perform the work.
What did building the KYC reference agent teach us about agentic AI?
One lesson is that both domain expertise and AI engineering are needed to design a solution.
KYC is not solved by domain knowledge alone, nor by giving a powerful model access to a large body of information. The system must first translate the actual KYC process into specialized responsibilities, connect those responsibilities to the appropriate skills and tools. Then it must coordinate them, evaluate their outputs, and preserve human decision points.
A second lesson is that agentic does not mean using an agent for every task. The most effective architecture combines the appropriate technology lever with the specific type of work: deterministic logic where rules and outcomes need to be explicit and repeatable; GenAI where information needs to be extracted, interpreted, researched, or synthesized; and agents where work needs to be orchestrated across multiple steps, tools, and sources. The value comes from making these components work as a coherent system rather than from maximizing agent autonomy.
The third lesson confirmed that for regulated processes such as KYC, technology needs to be designed around regulatory requirements, controls, and the institution’s broader risk-governance model. In the KYC reference agent, this means combining a domain rulebook with specialized skills, independent QA throughout the workflow, a full audit trail, and explicit human decision gates. The system can coordinate and perform much of the work, while humans retain final judgment and accountability for critical decisions.
Finally, the opportunity extends beyond automating individual tasks or even redesigning a single workflow. Instead of asking where an LLM can save several minutes in today’s KYC process, institutions can start with the business outcome they are trying to achieve and work backwards: Which activities should remain deterministic? Where can AI augment human work? Where does agentic orchestration create value? And where should human judgment and accountability remain?
How can you get started?
For institutions interested in tackling this challenge, BCG has drawn on its experience and lessons learned from its partnership with Anthropic to develop five practical principles:
- Start with the business process and value at stake— not with the technology. Reimagine the work end to end, identify where value can be created, and then choose the appropriate technology for each activity.
- Use the right mix of AI engineering levers. Deterministic logic, Machine Learning/AI, GenAI, and agents each have a role. The goal is not maximum (agent?) autonomy, but a coherent system in which each technology is applied when and where it creates the most value.
- Combine domain and technology expertise from the beginning. Deep KYC knowledge and AI engineering are complementary requirements. The business rules, controls, and regulatory context cannot be separated from the technology design.
- Design controls and human accountability into the architecture. Domain rules, quality controls, auditability and other regulatory requirements, as well as human decision points, should shape the system from the beginning rather than being added after the technology is built.
- When you are ready to build the technology, start by defining your evaluation framework. A well-designed evaluation framework will be central to building, testing, refining, and maintaining your solution over time, as it will ensure that the outputs are both high-quality and accurate
Agentic AI has the potential to go beyond performing today’s tasks faster or automating individual use cases. It offers an opportunity to reimagine how a business function operates: how work is structured, how decisions are made, which activities are performed by people versus technology, and how deterministic rules, GenAI, agents, and human judgment come together in a redesigned operating model.
(Disclaimer: This article was developed using AI-assisted tools)
