The line we draw between what the model does inside a KYC file review and what stays with the analyst, plus the three numbers we measure.

25 April 2026·7 min·Veetso engineering team, reviewed by Dr Reza Rezaey

AI-assisted KYC review: where the model helps and where it must stop.

KYC review is one of the first regulated workflows where AI earns its keep, and one of the easiest places for it to do harm. A model that hurries through a customer file is faster than a human and worse than no review at all. This post explains the line Veetso draws between what the model does in KYC and what stays with the analyst.

The shape of a KYC file review

A KYC review on a new customer typically pulls together six things: identity documents, proof of address, source of funds, beneficial ownership for businesses, sanctions and PEP screening, and adverse media. The reviewer cross-references each, looks for inconsistencies, decides whether the residual risk is acceptable, and records the decision in the customer file.

Manual review of a clean file takes 30 to 45 minutes. A file with anything unusual can take a day. Multiply by the new accounts a bank opens in a month and the workload is significant. This is where banks reach for AI.

What the model does in our version

We give the model three jobs, each of which it does well, and we keep it out of the fourth.

01. Document parsing and cross-reference

The model reads the identity document, the proof of address, and any supporting paperwork. It pulls out the name, date of birth, addresses, document numbers, and dates. It flags any mismatch across documents (e.g. a name on the passport that does not match the name on the utility bill) for the reviewer to look at first.

02. Source-of-funds narrative summarisation

When the customer provides bank statements or business accounts to demonstrate source of funds, the model summarises the inflows and outflows into a structured narrative: largest counterparties, recurrence patterns, anomalies. The summary is the reviewer's reading guide. The underlying statements are still in the file.

03. Screening-result triage

After PEP and sanctions screening runs, the model reads each hit and produces a short justification for the reviewer's first read: "Name match against [PEP name]. Date of birth differs by 12 years. Country of residence differs. Low confidence." The reviewer still confirms; the model just compresses the noise.

Where the model must stop

The model does not make the approve / decline decision. It does not assign the residual risk rating. It does not sign off on the file. Those three actions stay with the named human reviewer, and the audit log records the reviewer's identity on every one of them.

This is the line that matters. The model is allowed to compress information so the reviewer can read more files in less time. It is not allowed to substitute its compression for the reviewer's judgement. The reviewer reads the model's output, reads the underlying source where it matters, and makes the call.

Why this line is the right one

Three reasons we hold this line, even where the model is statistically better than a junior reviewer on certain narrow tasks:

Accountability. When the regulator asks who approved this customer, the answer must be a person whose name is on the customer file. "The model approved them" is not an acceptable answer in any jurisdiction we operate in.
Tail-risk asymmetry. A model that is right 99% of the time and wrong on the 1% that matters most is worse than a reviewer who is right 95% of the time and consistently cautious on the unusual cases. KYC is a tail-risk problem.
Drift. The cases the model handles best change over time as fraud typologies shift. The cases the model handles worst are usually the ones nobody trained it on yet. Keeping a human in the loop catches drift early.

How attribution shows up in KYC

Every model output the reviewer sees is annotated with the source it came from. The document-parsing output points back at the specific document and page. The source-of-funds summary points back at the bank statement lines that contributed to each conclusion. The screening triage points back at the specific hit and the data it was scored against.

This is the same attribution model the rest of Veetso Brain uses. See the attribution post for the design rationale.

Measuring whether it works

We measure AI-assisted KYC against three numbers, all reported to the steering committee monthly:

Time-to-complete per clean file. This should go down. If it does not, the model is not helping.
Override rate. How often the reviewer disagrees with the model's triage. This should be high enough that we know the reviewer is reading (10% to 25% is healthy). If it is below 5%, the reviewer is rubber-stamping; if it is above 40%, the model is not useful.
Tier-2 escalation rate. How often a file the model flagged as clean turns out to need a senior reviewer. This should be low; rising trend is an early warning.

Numbers without context are noise, but these three together tell us whether the AI-assisted version is working better than the manual version that came before it.

FAQ

Questions readers ask

Can AI approve KYC customers at Veetso?

No. The model parses documents, summarises source-of-funds narratives, and triages screening hits, but the approve / decline decision is made by a named human reviewer, whose identity is recorded in the customer file. AI compresses the reviewer's first read; it does not substitute for their judgement.

How does AI-assisted KYC handle sanctions and PEP screening?

Screening still runs as it does manually. For each hit, the model produces a short triage note ("Name match. Date of birth differs by 12 years. Country differs. Low confidence.") which the reviewer reads first. The reviewer then opens the underlying screening record, confirms or escalates, and signs off. The model never closes a screening hit on its own.

What is a healthy override rate for AI-assisted KYC?

Between 10% and 25%. Below 5% suggests the reviewer is rubber-stamping; above 40% suggests the model is not useful. The override rate is one of three numbers we report monthly, alongside time-to-complete and tier-2 escalation rate.

Does the model see customer documents directly?

Yes, but only documents that have passed data classification and are eligible for AI processing under the use-case register. If the customer's data is not classified for AI use, the model does not see it. Permissions on the AI surface match permissions on the underlying systems; AI is not a backdoor.

What happens to the model's output if the reviewer disagrees?

The reviewer's decision overrides the model. Both the model's output and the reviewer's disagreement are recorded in the audit log; the overall override rate is monitored as a model-quality signal. A rising override rate is an early indicator that the model is drifting and needs recalibration.