How do AI agents automate periodic KYC reviews and source-of-wealth checks?

Why are periodic KYC reviews and SoW checks so hard to scale by hand?

A periodic review is a file rebuild. The analyst re-opens the onboarding documents, searches for adverse media and ownership changes, re-reads statements and wealth narratives, checks them against transaction behaviour, and writes up the result in the bank's template. For wealth managers and private banks, the SoW storyline is the hardest part: it is a narrative (inheritance, business sale, salary and savings, real-estate proceeds) that must be backed by documents and kept current when the client's situation changes. Most of the time goes into collecting and reconciling material from the CRM, document repository, KYC system and the web, not into the judgment at the end. That is the part an agent is suited to. A vendor of AI for wealth managers (Unique AG) has published on the cost of fixed-schedule periodic reviews and on source-of-wealth reviews (for example its posts of 4 August 2026 on periodic reviews and 29 September 2026 on source-of-wealth reviews); those are the vendor's own claims.

How does the agent workflow run, step by step?

The flow below is S-PRO's reference design for a bank or wealth manager. It is a design pattern, not a regulatory template, and the exact steps depend on your KYC policy, systems and risk appetite.

1. Trigger. A review becomes due on the schedule set by your risk-based policy, or earlier on a trigger event: a change in risk rating, a screening or adverse-media hit, an unusual transaction pattern, a change of beneficial owner or a client-initiated change. The agent does not set the review cycle; it reads it from your policy configuration.
2. Data gathering. The agent pulls the current client file from the systems of record (core banking, CRM, KYC platform, document store), screening results from your existing vendor, and, where permitted, public and registry sources. It resolves entities (client, related parties, beneficial owners) and records which source each fact came from.
3. SoW/SoF evidence. The agent compares the documented wealth narrative with the new evidence: what is supported by a document, what is only asserted, what is missing, what contradicts the file. Output is a gap list per claim, not a verdict. Typical gaps: an expired or missing document, a wealth component with no evidence, a transaction inflow not explained by the stated sources.
4. Risk scoring input. The agent proposes a risk-factor summary and flags whether the evidence suggests the current rating should be reviewed. It does not change the rating. Scoring logic that can influence outcomes must be defined, versioned and validated by the bank.
5. Analyst review with human approval. The analyst sees a draft review with every statement linked to its source and every gap marked. They approve, edit, ask the agent for more work, escalate (for example to senior management or to the money-laundering reporting officer) or reject. The agent cannot write a final decision to the system of record without a named approver.
6. Audit trail. The system records inputs, sources, model and prompt versions, the draft, the analyst's changes and the approval with name and time, so that the case can be replayed. For what to log and how to make it audit-ready, see KYC AI audit trail for banks: what to log.

Closing-the-loop note: automated closing of low-risk reviews without a human is a separate design choice. The EU AMLA draft guidelines on ongoing monitoring (below) allow automated closing of monitoring outputs only where there are no indicators of heightened risk and with periodic validation through sampling; for periodic reviews we recommend keeping a human approval on every review unless your compliance function has documented a different, risk-based policy.

What do FINMA, the EU AMLA and FinCEN actually say?

No regulator prescribes "use AI for periodic review" or publishes a template for an AI KYC agent. The anchors below set what the bank must do and keep responsible; the design of how is the institution's. Check each against the current text before relying on it; S-PRO does not give legal advice.

• Switzerland. The Anti-Money Laundering Act (AMLA/GwG, SR 955.0) requires financial intermediaries to identify the contracting party and beneficial owner, to document, and to clarify the background of unusual business relationships (duty of clarification); record-keeping duties are in the Act as well (identification of the contracting party Art. 3, beneficial owner Art. 4, special duties of due diligence Art. 6, record-keeping Art. 7). FINMA's Anti-Money Laundering Ordinance (AMLO-FINMA, SR 955.033.0) sets the supervisory detail for FINMA-supervised institutions. FINMA Guidance 08/2024 on AI governance and risk management (18 December 2024) is supervisory guidance, not a statute; its supervision findings stress model risks such as robustness, bias and explainability, and documentation that lets results be understood and reproduced.
• EU. The 2024 AML package (Regulation (EU) 2024/1624, the AML Regulation; the Anti-Money Laundering Authority set up by Regulation (EU) 2024/1620) applies mainly from July 2027. Under the AML Regulation, the decision on a customer's risk profile and on entering a business relationship may not be outsourced (Art. 18). The AMLA consultation paper of 3 June 2026 contains draft guidelines on ongoing monitoring under Art. 26(5) AMLR (final guidelines announced for Q4 2026; responses were due 3 September 2026). They are drafts. As drafted, they say that deploying AI is neither mandatory nor in itself an indicator of effectiveness; that outputs of analytical tools should support decisions and be subject to governance, oversight, challenge and control; that obliged entities remain responsible for monitoring decisions, including, where appropriate, through effective human oversight; that tools should be explainable to authorities without requiring full technical interpretability of the underlying model; and that third-party tools should not be relied on for functions that materially influence outcomes where the entity cannot meet those safeguards (draft paras 87 to 95). Source: AMLA consultation paper, draft Guidelines section 2.11 "Use of technology": https://www.amla.europa.eu/policy/public-consultations/consultation-draft-guidelines-ongoing-monitoring-business-relationship_en
• United States. FinCEN's customer due diligence (CDD) rule (31 CFR 1010.230 for beneficial ownership; the ongoing-monitoring element sits in the AML program rules, for banks 31 CFR 1020.210) requires covered institutions to understand the nature and purpose of customer relationships, to conduct ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information, including beneficial ownership information. FinCEN's CDD rule FAQs say there is no categorical requirement to update customer information at fixed intervals; the update is risk-based and arises from normal monitoring, and periodic reviews are not by themselves a trigger to obtain or update beneficial ownership information (FinCEN CDD Rule FAQs, fincen.gov). Institutions may still choose periodic reviews on a risk basis. On model governance, the Fed/FDIC/OCC revised model risk guidance SR 26-2 (17 April 2026, replacing SR 11-7) states in footnote 3 that generative and agentic AI models are "not within the scope of this guidance", while saying that a banking organization's risk management and governance practices should guide the controls for such tools. In practice, US banks need their own documented governance for agents.

What is the difference between automating a review and automating a decision?

Swipe to compare →

What should a bank look for in a partner that builds KYC refresh agents?

• Human approval as a hard gate, enforced in the architecture and not only in a policy document.
• Source-linked output: every statement in a draft review traceable to a document, system record or public source.
• Works on your stack: it should use your existing KYC platform, screening vendor, CRM and document store as inputs, and not require replacing them.
• Evaluation before production: test sets built from your own anonymised cases, with metrics you define and accept, plus monitoring for drift once live. The AMLA draft guidelines point the same way (periodic validation; performance degradation and drift).
• Data protection and residency agreed per project: client data handling, access control, hosting, subprocessors, aligned with nFADP/GDPR and your outsourcing rules.
• A clear division of responsibility: the partner builds and documents; compliance responsibility stays with you.
• Honest scoping of what AI should not do: no automated filing decisions, no autonomous rating changes.

Where does S-PRO fit?

S-PRO was founded in 2014, has 250+ engineers and is headquartered at Löwenstrasse 45, 8001 Zurich, with R&D centers in Zurich and Łódź. We are ISO 27001 and ISO 27701 certified. S-PRO is a Certified partner in the Claude Partner Network, and our team includes Claude-certified engineers and architects. For a periodic-review or SoW agent we work in stages: map your KYC process and systems, agree the controls with compliance, build a pilot on anonymised cases with evaluations and a human-approval step, and take it to production with monitoring and an audit trail. We build the agent around your existing KYC platform rather than competing with it.

How S-PRO helps

If you run periodic KYC and source-of-wealth reviews at a bank, wealth manager or fintech in Switzerland, Germany or the US, we can map your review process, identify the steps an agent can safely prepare, and scope a pilot with human approval and an audit trail.

Book a discovery call (45 min)

S-PRO does notprovide legal or regulatory advice. Compliance decisions remain with the institution.