AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
An AI agent checks a payment against your policy by comparing its details, such as payee, amount, purpose, approver and supporting documents, with the written rules you have loaded, and citing the clause it relied on. If the payment meets every rule and sits below the ceiling you set, it can pass; if a rule is broken, missing or unclear, the agent holds it and a person decides. It cannot fix a vague policy, so the quality of the check depends on the quality of your rules.
What a policy check is
A policy check is a test run on a proposed action before it happens. For payments, it asks whether this money, to this person, for this reason, approved by this person, is allowed under the rules the business has written down. Banks and payment providers run their own checks, but those protect them. A policy check protects you, by applying your rules.
Internal control frameworks such as COSO's describe this as a control activity: a step built into a process that prevents or detects errors and fraud. In a small business it is often skipped because the person paying is also the person approving.
An AI agent makes the check cheap enough to run on every payment, not only the large ones. It does not get tired at the end of the month, and it does not wave through a familiar name because the request arrived on a busy afternoon. That consistency is most of its value.
The questions a good check asks
| Question | What the agent looks at | Typical rule |
|---|---|---|
| Who is being paid? | Payee name, bank details, history | New or changed bank details need a call-back to a known number |
| Have they been screened? | Sanctions and watch-list results | No payment to an unscreened counterparty |
| How much? | Amount against limits | Above the ceiling, a second person approves |
| Why? | Invoice, purchase order, contract | No payment without a matching document |
| Who approved it? | Approver identity and role | Nobody approves their own expense |
| Is it unusual? | Timing, currency, round sums, urgency | Urgent first payments to new payees are held |
Each answer should be traceable. If the agent passes a payment, the record should show which clauses it checked and what evidence it saw. If it holds one, the record should show which rule failed.
Why bank detail changes get special treatment
Payment diversion fraud, where a criminal poses as a supplier and asks for payment to a new account, is one of the commonest frauds against businesses. Action Fraud in the UK calls it mandate fraud, and the FBI's guidance on business email compromise describes the same pattern in the US. Both advise verifying changes using contact details you already hold, not those in the request. A policy check can enforce that every time, which is where people under time pressure tend to slip.
A sensible policy treats any change of payee bank details as a new payee until proven otherwise. The agent should hold the payment, record the request, and ask a named person to confirm the change through a channel the business already trusts. Only once that confirmation is recorded should the payment move.
Writing rules an agent can test
Rules work best when they are specific. "Large payments need approval" cannot be tested; "payments above $5,000 need the owner's approval" can. Name the amount, the currency, the approver by role, the evidence required and what happens when something is missing. Where a rule depends on judgement, such as whether a cost is reasonable, say that it goes to a person and do not pretend the agent can decide it.
A worked example
Example only. A Canadian design studio has a policy with three rules: supplier payments under C$5,000 with a matching invoice can go; anything above C$5,000 needs the owner; any new payee needs screening and a call-back. On Tuesday three payments are proposed.
- C$1,800 to a regular printer, invoice attached, same bank details as last month. All rules met. The agent passes it and records the clauses checked.
- C$7,400 to a freelance animator, invoice attached. Above the ceiling. The agent holds it and sends it to the owner with the invoice and payment history.
- C$950 to a new font foundry with an urgent note. Unscreened and no call-back recorded. The agent holds it, screens the payee and asks a person to make the call-back.
Two of three payments needed a person. That is normal in the first months; as policy improves and payees become known, more pass without help.
The owner also learned something from the third payment. The font foundry's request was legitimate, but the studio had no rule about software licences bought from overseas sellers. It added one, which meant the next similar purchase needed only screening, not a conversation.
What a policy check cannot do
- It cannot apply rules you never wrote. If your policy says nothing about overseas payees, the agent should say so and hold, not invent a rule.
- It cannot judge commercial value. Whether the animator is worth C$7,400 is your call.
- It cannot replace the bank's own checks. It sits alongside them.
- It cannot remove fraud risk. A forged invoice that matches every rule can still pass. Call-backs and segregation of duties remain essential.
For the finance side of approvals, see finance decisions a person should make. For the wider limits of AI in money matters, see AI agents for business finance.
Where Pryme fits
In Pryme Business the Finance agent releases payments only below the line you set, and the Compliance agent checks policy and screens counterparties. Each answer is drawn from the policy set you load, with the clause attached; where the policy is silent, the agent refuses, logs the gap and sends it to a person. Above the ceiling, a person decides. Every action is recorded with its source.
Questions people ask
Does a policy check slow payments down?
Payments that meet every rule pass quickly. Only exceptions wait for a person, which is where the delay is worth having.
What if my policy is only in my head?
Write the main rules down first: limits, who approves, how new payees are checked. An agent can only check what is written.
Can the agent approve payments above my ceiling?
It should not. Above the ceiling it should stop and send the payment to a named person.
Does a policy check stop invoice fraud?
It reduces the risk, especially by enforcing call-backs on bank detail changes, but it cannot catch every forgery.
Sources
- COSO: Internal control · accessed Oct 2026
- Action Fraud: Mandate fraud · accessed Oct 2026
- FBI: Business email compromise · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.