AI for KYC: how banks use it for onboarding, identity and screening.

What is AI for KYC?

AI for KYC means models doing the reading, matching and drafting inside know-your-customer compliance: document capture and authenticity checks, face-to-document matching with liveness, name and sanctions screening with entity resolution, adverse-media search, source-of-wealth assembly, customer risk rating and event-driven (perpetual) review. The obligation and the final decision stay with the bank; 25 of the 140 banks profiled here record one of these steps on AI, 14 in production.

Know-your-customer compliance has four legal parts in every major jurisdiction: identify the customer, verify the identity against reliable sources, establish beneficial ownership and the purpose of the relationship, and rate the risk so that due diligence and review frequency match it. None of those parts changes when a bank adds AI. What changes is who does the reading. A document that a clerk inspected for fonts, holograms and expiry is now read by a vision model that compares it with a template library; a name that an analyst searched in three lists is scored by an entity-resolution model that knows “Mohammed” and “Muhammad” are one person and that a PEP hit with the wrong birth year is not; the source-of-wealth file that a private banker assembled over a week is drafted by an agent that pulls statements, extracts figures, flags the gaps and asks the banker the questions a reviewer would ask.

The record on this site shows three generations in use at once. Rules-plus-vision systems for documents and sanctions screening have been in production for a decade (Cathay describes NICE Actimize screening in its Wolfsberg questionnaire without any claim of machine learning). Supervised machine learning entered customer risk rating and alert triage around 2021; TD Bank's improved risk-rating model and ING's customer-due-diligence Risk Assessment Model are 2026 examples. Generative and agentic AI arrived in 2025 for the reading-and-drafting jobs: OCBC's Source of Wealth Assistant, Deutsche Bank's agentic source-of-wealth checks in Singapore and Hong Kong, Goldman Sachs's client-vetting agents built with Anthropic, BNP Paribas's on-premises Mistral models for the KYC steps where data is most sensitive. Across all of these, 53 of the 140 banks here record some AML or KYC activity on AI; the KYC-specific subset is 25.

Which banks use AI for KYC?

14 banks run AI in a KYC step in production on the record, led by JPMorgan Chase, Citi, BNY, TD Bank, ING, NatWest, DBS, OCBC, Société Générale and Deutsche Bank; 4 are rolling out, 2 are in pilot and 5 have announced plans. The largest programmes are in wealth and commercial onboarding, where files are long and the saving per file is measured in hours.

The table lists every bank whose profile records an AI activity at a KYC step, strongest status first and largest bank first within a status. “In production” means the bank or a named vendor says it is live; the date is the earliest sourced event on the bank's timeline for the activity, so 2024 dates are usually a first disclosure rather than a go-live. Where a bank describes an AML activity rather than a KYC one (alert triage, transaction monitoring, SAR narratives) it appears on the AI in AML page instead; a few banks appear on both.

Two patterns stand out. First, the biggest results come from wealth and commercial onboarding, not retail: a private-banking source-of-wealth file or a corporate client's beneficial-ownership chain takes hours of reading per file, which is where a language model saves the most. DBS, OCBC, Deutsche Bank, BNY and Citi all report there. Second, the retail examples that scale are the ones that remove the human from the easy cases rather than assist on every case: Société Générale's Instant-KYC leaves 60% of individual cases without human review, and NatWest's business-customer identification turns a days-long process into minutes because the model clears the document and the face and only exceptions go to a person. 16 rows are in production; the AI disclosure index ranks the US banks on their whole record.

What results do banks report from AI in KYC?

JPMorgan's KYC unit cost is down 40% since 2022; Citi cut onboarding document review by 80% in Services and from about an hour to 15 minutes in US client onboarding; Société Générale's Instant-KYC handles 60% of retail cases with no human review at over 95% accuracy on standard documents; DBS halved affluent onboarding turnaround in the first five months of 2026; OCBC's source-of-wealth agent cuts report preparation from up to 10 days to about an hour; ING's customer-due-diligence cases per FTE rose 21% in 2025 against 2023; Deutsche Bank targets 30% less manual KYC handling time by 2028.

These are the banks' own figures as reported, with the date and the source. They measure different things (unit cost, review time per file, share of cases with no human touch, cases per employee, headcount) and are not comparable with each other; the most robust are the ones repeated in filings, such as JPMorgan's unit-cost figure from its investor day and ING's cases-per-FTE series from its annual reporting. Targets are labelled as such.

How to read them: a cost-per-file or time-per-file figure is strongest when the bank states the denominator and the before-state (Citi's hour to 15 minutes, OCBC's 10 days to an hour). A share-of-cases figure (Société Générale's 60% with no human review) tells you the model's operating point rather than its accuracy; the 95% accuracy claim beside it is the bank's own test. The headcount figures are the ones to treat with care: ING ties a planned decrease of about 1,250 operations FTEs in 2026 to KYC and associated activities, but that is a programme number that includes process redesign and offshoring, not a model result.

What do the models actually do in KYC?

Seven jobs, in the order a file moves: read and authenticate documents, match the face and test liveness, screen names against sanctions and watchlists, search adverse media and public records, assemble source-of-wealth evidence, rate customer risk, and decide when a file needs review again. Each has a bank on the record doing it in production, listed in the table below.

The table follows a file through onboarding and review. Each row names the model class and a bank on the record that runs it; the bank page carries the source. The pattern in every row is the same: the model reads, matches, scores or drafts, and a person signs the decision that the regulation attaches to a person.

The hardest step to automate is the last one. Perpetual KYC sounds like a model choice but is mostly a data choice: a bank can only trigger a review on a change of director, address or ownership if it receives that change as an event from a registry or its own systems rather than discovering it at the next scheduled review. That is why the banks furthest along (ING, TD) describe a new KYC platform first and a new risk model second, and why Northern Trust's COO still describes millions of PDF documents arriving from wealth clients as the constraint.

What do regulators require of AI in KYC?

US regulators encourage it (the 2018 interagency innovation statement, FinCEN's Innovation Hours, the AML Act of 2020) and set two conditions: a machine-learning risk-rating or screening model is a model under SR 26-2, to be inventoried, validated and monitored, and a bought verification service is a third-party relationship under SR 23-4. The EBA's GL/2022/15 says how an EU bank may onboard remotely with documents and biometrics; FinCEN's 2024 deepfake alert and MAS's 2025 circular expect liveness and layered checks against AI-generated identities.

No rule prohibits AI in KYC, and the US agencies have encouraged it in writing since 2018. The obligations that bind are the ones that bind any KYC process (the customer identification programme and customer due diligence rules under the Bank Secrecy Act in the US, the EU's anti-money-laundering directives and the EBA's guidelines, the UK's Money Laundering Regulations and the JMLSG guidance that interprets them, and the FATF recommendations that all of these implement) plus two AI-specific layers: model risk management for the models and third-party risk management for the vendors. The tracked documents most relevant to a KYC programme are below; the full set of AML and KYC documents is on the by-use-case page.

Two documents matter most in practice. EBA/GL/2022/15 is the only text that says, step by step, what a remote onboarding solution must do: policies approved by the management body, pre-implementation and ongoing testing, identity documents and biometrics verified against reliable and independent sources, and the ability for a person to intervene. An EU bank buying an identity-verification vendor is buying compliance with that list. FinCEN's 2024 deepfake alert is the other: it reports rising SAR filings for AI-generated identity documents and recommends layered checks, which has made liveness detection and device intelligence a standard part of the stack. In the model-risk layer, SR 26-2 keeps machine-learning risk-rating and screening models in scope and leaves generative assistants to broader governance; model risk management covers what that means in practice.

Which vendors supply AI for KYC?

21 vendors in this site's directory describe identity verification, onboarding, KYC or screening products; the ones most often named by the banks here are nCino (4 banks), NICE Actimize (4 banks), Socure (4 banks), Alloy (3 banks). The largest banks build the workflow and buy models: HSBC with Google, Goldman Sachs with Anthropic, BNP Paribas with Mistral.

The table lists the vendors in this site's AI tools directory whose products cover identity verification, onboarding, KYC or screening, with the number of banks in the US set that name them on the record. A bank naming a vendor is a disclosure, not a market share; the AML compliance and fraud detection category guides explain what to check when buying.

The build-versus-buy line runs where it does elsewhere in banking: the largest banks build the workflow and rent models and data (HSBC with Google, Goldman Sachs with Anthropic, BNP Paribas with Mistral on premises), regional banks buy a platform (KeyBank on NICE Actimize X-Sight, Ally and Eastern on Alloy), and community banks reach for the enterprise assistant they already have: OceanFirst's investigators paste case data into Microsoft Copilot and cut a complex enhanced-due-diligence case from six hours or more to about five minutes. Fintechs are both customers and suppliers of the same stack; the ones on this site with a KYC or identity use case are below.

How does AI KYC connect to AML and fraud?

KYC decides who gets in and how risky they are; AML monitors what they do afterwards; fraud controls protect the account from takeover and scams. The same vendors and often the same models serve all three, which is why the US agencies treat them as one BSA/AML programme and why this site keeps separate pages for AI in AML and AI fraud detection.

A bank's financial-crime stack has three gates with one customer record behind them. KYC is the front gate and the periodic re-check; AML watches the account afterwards and files suspicious activity reports; fraud controls protect the account from takeover, scams and mules. The models overlap more than the org charts do: the entity-resolution engine that scores a sanctions hit at onboarding also scores the counterparty of a payment, the behavioural model that spots a mule account is a fraud control that feeds AML, and the deepfake detector that FinCEN describes belongs to both onboarding and the call centre. On this site the monitoring and investigation side is on AI in AML, the account-protection side on AI fraud detection, and the vendors common to all three on AML compliance tools.