KYC and AML with AI agents: what can the agent do, and what can’t it?

What does AML regulation require of a SOFOM?

Article 95 Bis of Mexico’s law on auxiliary credit organizations requires SOFOMs (Mexico’s multi-purpose non-bank lenders), among other entities, to put measures in place to prevent transactions involving illicit funds and terrorist financing, and to file reports with the Ministry of Finance (SHCP) through the CNBV — the national banking and securities commission. Those reports must cover, at a minimum, relevant, unusual and internally concerning transactions. The law also calls for guidelines on customer identification and due diligence, and on the use of automated systems that support compliance.

The details are in the general rules for SOFOMs published in the DOF (Mexico’s official gazette) on March 17, 2011 and amended since — among others, on September 9, 2021. In their 2011 text they require, for example, a Communication and Control Committee (or, at small entities, that its duties be carried out by the Compliance Officer), a written customer identification and due diligence policy, and automated systems for reporting. Always check the current text with your compliance officer.

Where does an agent genuinely help?

• Building the file. It asks the customer for missing documents through the channel they already use, checks they’re legible and current, and files them with their date.
• Checking consistency. It compares what the customer declared against what their documents say and flags discrepancies for review.
• Screening lists. It checks the lists your institution uses (blocked persons, politically exposed persons, internal lists) through the services you already contract, and records every check.
• Keeping files current. It spots documents about to expire and requests updates before the file goes incomplete.
• Preparing alerts with context. When a transaction matches the criteria your compliance team set, it assembles a summary with the data, the customer’s history and the rule that fired, so the analyst can decide quickly with everything in view.

What should an agent never do?

• Decide whether a transaction is unusual or reportable.
• File reports with the authorities on its own initiative.
• Approve exceptions to the KYC policy.
• Change a customer’s risk rating without a person validating it.
• Tip off a customer that they are under review.

These lines aren’t just caution. They protect the compliance officer, who is the one answerable to the regulator, and they keep a badly worded model output from turning into a regulatory problem.

How does the agent’s work become auditable?

Every list check, every document received, every flagged discrepancy and every prepared alert goes into the log with date, time, source and result. When the analyst decides, the decision is recorded next to the evidence they had in front of them. So in a CNBV inspection or an audit, the institution can show not only what it decided, but on what information and how fast.

The rules that trigger an alert are written and approved by compliance; the agent applies them, it doesn’t invent them. When a rule changes, the change is dated and has an owner. More in agent governance.

What about the personal data in the file?

A KYC file concentrates sensitive personal data. The agent should see only what the task needs, the data must not be used to train models, and every access must be logged. On top of that, Mexico’s new private-sector data protection law recognizes a right to object to certain automated decisions made without human involvement, with exceptions when processing is needed to meet a legal obligation. We cover it in data protection and agents.

Where should you start?

With whatever eats your team’s time without requiring judgment: building and refreshing customer files. It’s measurable, low-risk and frees analysts for work that does need judgment. Context-rich alerts are usually step two, once compliance trusts the quality of the files. If you want to review your full program, see our AML compliance service.

Short answers

Can an agent file transaction reports with the authorities?

It can prepare the information and a draft with its evidence. The decision to report, and the filing itself, belong to the institution, through its compliance officer and the procedure set out in its compliance manual.

Who supervises AML compliance at a non-regulated SOFOM?

The CNBV. Article 56 of Mexico’s auxiliary credit organizations law states that CNBV supervision of non-regulated SOFOMs is carried out solely to verify compliance with article 95 Bis and the rules derived from it — the anti-money-laundering rules.

Does using an agent change the compliance officer’s responsibilities?

No. The agent is a tool inside the institution’s compliance program. Done right, it gives the officer more coverage and better evidence, but it removes none of their obligations.

Official sources

• «Ley General de Organizaciones y Actividades Auxiliares del Crédito», arts. 56 and 95 Bis (current text, Chamber of Deputies)
• SHCP general rules on AML/CFT for multi-purpose financial companies (SOFOMs) (DOF, Mar 17, 2011)
• Amendment to those rules (DOF, Sep 9, 2021)
• Unidad de Inteligencia Financiera (Mexico’s financial intelligence unit)

This page describes rules and practices; it is not legal advice. Your compliance officer and counsel have the final word.