Scanning a passport is not customer due diligence. Banks must connect identities, entities, ownership, addresses, transactions, sanctions, adverse information, risk, and supporting evidence. OCR converts pixels to text. A production system must establish provenance, relationships, and review.
The opportunity
The GAO's 2025 financial-services review found broad AI use across customer service, fraud, risk, and operations, alongside gaps in oversight capability. JPMorganChase reports that AI in transaction screening more than doubled reviewed volume while halving manual operator checks.
This is the pattern to pursue: more evidence reviewed, fewer low-value touches, and human focus on ambiguous cases.
The document and investigation pipeline
The document and investigation pipeline
Classify
Identify document type, country, language, issuer, version, and expected template. Detect incomplete, duplicate, or suspicious documents.
Extract
Capture names, dates, identifiers, addresses, ownership, financial values, signatures, and source bounding boxes. Score each field separately.
Validate
Use deterministic checks for format, checksum, date logic, allowed value, and registry comparison. A language model should not perform exact identity validation from prose.
Resolve entities
Determine whether names, companies, directors, beneficiaries, accounts, merchants, devices, and addresses refer to the same entity. Preserve uncertain matches for review.
Build the relationship graph
Connect ownership, control, transaction, device, counterparty, household, and case relationships. Graph features can reveal structures that a document-by-document review misses.
Retrieve policy and evidence
RAG returns the current procedure, jurisdictional requirement, customer record, and prior reviewed evidence under permissions.
Classify
Identify document type, country, language, issuer, version, and expected template. Detect incomplete, duplicate, or suspicious documents.
Extract
Capture names, dates, identifiers, addresses, ownership, financial values, signatures, and source bounding boxes. Score each field separately.
Validate
Use deterministic checks for format, checksum, date logic, allowed value, and registry comparison. A language model should not perform exact identity validation from prose.
Resolve entities
Determine whether names, companies, directors, beneficiaries, accounts, merchants, devices, and addresses refer to the same entity. Preserve uncertain matches for review.
Build the relationship graph
Connect ownership, control, transaction, device, counterparty, household, and case relationships. Graph features can reveal structures that a document-by-document review misses.
Retrieve policy and evidence
RAG returns the current procedure, jurisdictional requirement, customer record, and prior reviewed evidence under permissions.
Produce a review brief
An SLM summarizes facts, conflicts, missing evidence, and model signals. Every statement links to a source. The investigator records the conclusion and reason.
Workloads
- retail KYC and remediation
- corporate KYB and beneficial ownership
- source-of-funds review
- sanctions and PEP investigation
- transaction-monitoring case preparation
- fraud dispute and chargeback evidence
- mortgage and commercial-credit files
- tax, legal, and regulatory notices
- trade-finance documents
- account closure and complaint files
Each should have a separate schema and risk tier.
Evaluation
| Layer | Metric |
|---|---|
| classification | document-type precision and recall |
| extraction | field precision, recall, and exact match |
| source | bounding-box and page accuracy |
| entity resolution | pair precision and recall |
| graph | suspicious-case precision at review capacity |
| retrieval | current-policy recall and citation precision |
| summary | evidence groundedness and omission rate |
| workflow | review time, touches, and backlog |
| risk | false-positive cost and missed-case rate |
Report by document country, language, quality, customer type, and channel. A strong overall score can hide poor performance for smaller markets.
Human review and explanations
Route based on confidence and consequence. A high-confidence address extraction may pass automatically. A low-confidence beneficial-owner match should not. A fraud signal needs evidence, not a generated narrative of intent.
Record which fields changed, which relationship was rejected, and which source resolved the case. Corrections become training data only after governance.
Data protection
The pipeline touches identity and financial data. Enforce purpose limitation, least privilege, retention, encryption, regional controls, and provider-training restrictions. Mask data from components that do not need raw identity. Prevent cross-customer retrieval before model generation.
The business case
Measure minutes per completed review, cases per investigator, straight-through rate, rework, escalation, false positives, and downstream loss. Do not claim savings from automation unless staffing, overtime, backlog, or service levels change.
A 90-day pilot
Choose one document family and one case type. Label 1,000 to 5,000 representative documents and 100 to 300 closed cases. Validate extraction before adding narrative. Run shadow processing, compare investigator decisions, and review every high-risk disagreement.
A gate might require 99% precision on identity-document assignment, 95% recall for mandatory fields, no cross-customer data leakage, and 30% lower review time with stable or improved case quality.
The conclusion
KYC and investigation AI is not an OCR procurement. It is an evidence system combining documents, entities, relationships, policy, and accountable conclusions.
Specialized models are valuable because they make each stage measurable. The reviewer can see whether a failure came from extraction, matching, risk scoring, retrieval, or summary.
Research note
Research is current through September 5, 2026. Company performance is self-reported. Financial crime, identity, credit, privacy, and record-retention obligations require jurisdiction-specific governance.
Continue the research
- The private AI bank model stack
- Banking voice AI agents
- RAG vs fine-tuning vs bespoke AI models
- Why an enterprise evaluation set becomes an AI moat
- Insurance policy language AI and private RAG
Building a Production-Ready System
Conscious Engines builds KYC document intelligence as an evidence pipeline rather than an OCR feature. Specialized models classify and extract documents, resolve entities, connect relationships, retrieve current policy, and prepare a review brief that lets investigators trace every material claim.