In a space overflowing with acronyms, “know your customer,” or KYC, needs little introduction. For decades, it’s been a foundational principle in financial services, synonymous with protecting the integrity of banking systems as institutions sought to validate customer identity and mitigate fraud. Now, however, as artificial intelligence (AI) has been widely embraced by the banking risk and compliance sector, that foundation faces a new set of challenges.

Although AI is already transforming the KYC workflow by ingesting and analyzing massive amounts of data, spotting anomalies and red flags faster than ever before possible and finding relationships in datasets that were previously invisible to the naked eye, it is important to recognize that not all AI models were created equal. In fact, variations in results, accuracy and consistency between different AI models used in the KYC process have even led regulators like the Federal Trade Commission (FTC) and the European Commission (EC) to introduce new policies requiring companies that build AI models to provide proof of how their results were achieved.

Establishing a checklist for AI transparency

Alas, many banks and financial institutions still find themselves in a Wild West business environment when it comes to adopting and refining AI tools for KYC. With very little standardization from product to product and vendor to vendor and new capabilities evolving so rapidly, it can be difficult to make apples to apples comparisons. To help improve that process, my team and I have developed the following checklist every financial firm should follow when evaluating AI for use in the KYC workflow.

Model inventory: Transitioning to KYAI requires financial firms to integrate systems and processes that offer visibility into AI’s decision-making logic. Before that can happen, every AI model used within the organization must be cataloged. This inventory includes details like purpose, scope, input data, model design, and deployment status.

Explainability: Explainable AI ensures that business users, regulators, and customers understand how outputs are generated. Whether through statistical metrics or visual explanations, the objective is to demystify the decision-making process.

Risk assessment and classification: Risk assessment and classification provides the foundation for AI governance by systematically evaluating and categorizing AI systems based on their potential impact and regulatory requirements. This component enables institutions to allocate resources effectively and apply appropriate controls.

Audit logs: Audit trails serve as the backbone of KYAI compliance. Every decision must leave breadcrumbs that regulators and internal stakeholders can trace. These logs should highlight data points, model iterations, and the reasoning behind predictions. Ideally, audits should be conducted pre-deployment and on an ongoing basis once the model is up and running.

Validation and testing: Model validation and testing ensures ongoing model performance and reliability through comprehensive testing protocols, including back testing, stress testing, and challenger model frameworks.

Real-time bias monitoring: KYAI ensures tools are in place to monitor for bias or anomalies in production models. For example, systems can flag when a fraud detection algorithm disproportionately targets transactions from certain regions.

Model cards: Inspired by food nutrition labels, "model cards" summarize an AI model’s purpose, strengths, limitations, data sources, and potential biases. These concise documents provide an accessible overview for both regulators and team members.

Updated governance frameworks: As AI models are adopted and integrated, it will be essential to continually revamp AI-specific governance policies into your existing structures. Define roles and responsibilities to monitor adherence to explainability, audit, and risk standards.

Communicate with customers: Transparent decision-making builds greater customer trust. A client declined for a loan, for example, can be shown an objective explanation of why and how to improve their chances in the future.

Monitor and evolve: KYAI is not a static, set it and forget it process. Teams should regularly monitor results and test accuracy, evaluate governance frameworks after new deployments and adjust processes in line with evolving regulatory requirements.