AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
You should re-screen customers and suppliers whenever the sanctions or watch lists you rely on change, whenever something material about the counterparty changes, such as ownership, name, bank details or country, and on a regular cycle set by risk. A one-off check at onboarding goes stale because sanctions lists are updated often. An AI agent can run these checks continuously, but a person must review any possible match before money moves.
Why one check at onboarding is not enough
Screening compares a customer or supplier against sanctions lists, and sometimes against lists of politically exposed persons (PEPs) and adverse media. Most small businesses that screen do it once, when the relationship starts. The trouble is that the lists move. Governments add and remove names regularly, and a supplier that was clear in January can be designated in June.
In the UK, financial sanctions apply to everyone, not only banks, and the government's general guidance makes clear that you must not deal with the funds of a designated person. The US Treasury's OFAC takes a similar position for US persons. Neither expects you to be a bank, but both expect you not to pay someone on the list.
Customers change too. A trade customer may be bought by a new group, move its registered office abroad or take on a director with political connections. None of these will reach you unless something in your process is looking for them. That is the gap re-screening closes.
The triggers for a fresh check
| Trigger | Why it matters | Suggested response |
|---|---|---|
| A list you use is updated | New designations may cover existing counterparties | Re-screen the whole book against the change |
| Change of ownership or directors | New owners may be listed or exposed | Screen the new owners and controllers |
| Change of name or trading name | Names are how matches are found | Screen the new name and keep the old one on file |
| New bank details or country | A new jurisdiction can change the risk | Screen and verify the change independently |
| First payment above a threshold | Larger sums carry larger consequences | Fresh screen before release |
| Adverse news | May signal fraud, sanctions evasion or insolvency | Review and decide whether to continue |
| Periodic review date | Catches what triggers missed | Cycle set by risk, for example yearly for low risk |
The FATF Recommendations, which shape anti-money laundering rules worldwide, describe ongoing due diligence as part of knowing your customer. For regulated firms this is a legal duty. For other businesses it is sensible practice, scaled to risk.
Setting a risk-based cycle
Not every relationship needs the same attention. A simple three-band approach works for most small firms:
- Low risk: domestic, long-standing, small sums. Event-driven screening plus a yearly review.
- Medium risk: cross-border, larger sums, newer relationships. Event-driven plus six-monthly review.
- High risk: higher-risk countries, complex ownership, PEP links. Event-driven, frequent review, and a person signs off continuing the relationship.
Write the bands into your policy so that an agent, or a new member of staff, applies them the same way every time.
Keep the record of each screen
Each screen should leave a record: which lists were checked, on what date, what was found and who reviewed any possible match. If a regulator, bank or auditor later asks why you paid a counterparty, that record is your answer. Record-keeping rules for regulated firms commonly require such records to be kept for years, and FATF's standards set a five-year minimum for customer due diligence and transaction records. Even outside regulated sectors, keeping the evidence is cheap and its absence is costly.
Common mistakes
- Screening the company name but not its owners or directors.
- Screening customers but not suppliers, or the reverse.
- Clearing possible matches without recording why.
- Using one list when your business trades under several jurisdictions' sanctions regimes.
- Letting the periodic review date slip because no event prompted a check.
A worked example
Example only. A Lagos distributor buys from 40 suppliers and sells to 300 trade customers. When a sanctions list it relies on is updated overnight, its compliance agent re-screens all 340 names against the change. Two produce possible matches. One is a common name with a different date of birth and country, which the agent records as a likely false positive but still sends for a person to confirm. The other is a supplier whose new parent company shares a name with a designated entity. The agent holds the next payment of ₦3.2m and raises it. The owner and the firm's adviser review ownership documents before any decision. Nothing is paid until a person decides.
The review takes two days. The documents show the parent is a different entity registered in another country, with no link to the designated one. The owner records the reason, the adviser's note is attached, and the payment is released. The supplier's review date moves forward six months, because a change of ownership has put it in the medium-risk band. The delay cost the distributor a little goodwill; paying a designated entity would have cost far more.
For what to do after a possible match, see AI for KYC and AML monitoring. For checking a Nigerian company's registration first, see how to verify a Nigerian company.
Where Pryme fits
The Pryme Business Compliance agent screens customers and counterparties and works through the night across the currencies you trade in. A sanctions or PEP match holds the funds and goes to a person; the agent does not clear matches on its own. Its screening sits alongside the Finance agent, which releases payments only below the ceiling you set. Every hold is recorded with its source.
Questions people ask
Do small businesses have to screen against sanctions lists?
Sanctions apply to everyone, so you must not deal with designated persons. Formal screening duties are stricter for regulated firms. This is general information, not legal advice.
How often are sanctions lists updated?
Often and without a fixed timetable, which is why event-driven re-screening against list changes is more reliable than a yearly check alone.
What is a false positive?
A possible match that turns out to be a different person or company, usually with a similar name. A person should still confirm it and the reason should be recorded.
Can an AI agent clear a match by itself?
It should not. It can gather the facts and suggest a view, but a person decides whether to proceed.
Sources
- GOV.UK: Financial sanctions general guidance · accessed Oct 2026
- GOV.UK: The UK Sanctions List · accessed Oct 2026
- OFAC: Frequently asked questions · accessed Oct 2026
- FATF: The FATF Recommendations · accessed Oct 2026
- FATF: Guidance on politically exposed persons · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.