Agentic AI for Compliance: Use Cases, the Controls Supervisors Expect and How to Run Compliance Agents On-Premises

Agentic AI for compliance means AI agents that carry out multi-step compliance tasks: they gather the facts of a case, retrieve the rules that apply, test the facts against each rule with tools and draft a finding with citations, which a named person approves, returns or rejects. Strong first uses are regulatory change mapping, control testing, KYC file checks, alert triage and audit evidence collection. Supervisors created no AI-specific approval route between 2024 and 2026; existing accountability, record-keeping and data protection rules apply, so the evidence trail matters as much as accuracy.

This guide is for compliance, risk and platform leads deciding where agents belong in the second line of defence. The risks that agents themselves introduce, such as goal hijack and privilege abuse, are covered in the companion guide on managing the risks agents themselves create.

What changes compared with rules engines and RPA

Compliance functions already automate a great deal. Rules engines score transactions against thresholds, screening tools match names against sanctions lists and RPA bots copy data between systems. Someone wrote every step in advance, which makes these tools predictable and easy to audit and is also where they stop: an unusual document, a new regulation or a case that needs reading rather than matching goes back to a person.

Agents start from a goal instead of a script. Asked whether an onboarding file is complete for a high-risk customer, an agent plans the steps, calls tools to fetch documents and run checks, reads the text and reports what it found and why. That flexibility is also the risk: two runs can take different paths, and a model can misread a clause. So keep deterministic checks deterministic and use the agent for preparation and explanation.

In practice the agent should call the rules engine and the screening system as tools rather than replace them. The wider comparison of how agentic automation differs from RPA covers when to migrate an existing bot.

Agentic AI compliance use cases

The ten use cases below follow one pattern: the agent prepares, a qualified person decides, and the record shows both. The checkpoint column marks where accountability stays with a person; the evidence column lists what an auditor should be able to retrieve afterwards.

Three points need extra care.

AML and sanctions triage stays decision support. Investigation is where agents save analysts the most reading and where an unsupervised error costs the most. Keep the disposition with a trained analyst, keep list matching in the screening system and treat any suggestion to close a potential sanctions match as a draft. The EU’s new anti-money laundering rules apply from 10 July 2027, according to the EU authority AMLA, so alert handling will face fresh scrutiny. The architecture is set out in our governed design for KYC and AML investigations, and a ready-made pattern is the banking compliance monitoring agent.

Credit decisions belong to a different category. Under Annex III of the EU AI Act, AI used to evaluate the creditworthiness of individuals or set their credit score is high-risk, with an exception for systems that detect financial fraud. An agent that reviews credit files for compliance should not drift into making the credit decision.

Control testing suits agents well, because the test steps are written down and the evidence can be retrieved. The SOX control-testing agent and our note on AI in internal audit show the third-line version of the same idea. For complaints, see complaints-handling agents in regulated firms; for reporting, agents that prepare regulatory submissions. The wider catalogue sits under compliance agents and compliance and governance use cases, and risk and assurance agents cover neighbouring second-line work.

How a compliance-check agent is built

A compliance-check agent is a small pipeline with a model at its centre and controls around it. Six stages carry most of the design decisions.

1. Inputs

Define exactly what the agent receives: the case reference, the documents, the structured data and the identity of whoever asked. Reject requests without a case reference, and mask personal data the check does not need before it reaches the model.

2. Retrieval of the applicable rules

Do not rely on what a model remembers about a regulation. Keep a versioned library of the rules, policies and procedures in force, tag each passage with jurisdiction, product and effective date, and let the agent retrieve only from it. When a rule changes, later findings cite the new version.

3. Reasoning

Turn each requirement into a test the agent can run: is the document present, is it in date, do the names and addresses match, does the promotion carry the risk warning the rulebook requires. Deterministic tests, such as date arithmetic or list lookups, belong in tools. The model reads, compares and explains.

4. Decision with citations

Ask for a structured finding: each requirement, pass or fail, the cited rule passage, the evidence location (document, page and field) and any uncertainty. Give the agent an explicit way to abstain when evidence is missing or contradictory. A finding without a citation should fail validation before a person sees it.

5. Approval

Route the finding to a named reviewer with authority to decide, showing what the agent checked, what it could not check and what happens on approval. The guide to approval checkpoint patterns compares single approval, four-eyes review and sampling.

6. Record

Store the inputs, rule versions, model and prompt versions, tool calls, finding, reviewer, decision and time taken, bound so that no part can change unnoticed. The note on what an agent audit trail should record lists fields and retention, and decision receipts for regulated agents explains how to bind them into one verifiable record.

From checks to agentic AI compliance monitoring

Run the same pipeline on a trigger instead of on request and it becomes monitoring. A schedule re-tests controls whose evidence is about to expire; an event, such as a new regulator publication or a policy change, starts the change-mapping agent; a draft promotion entering the review queue starts the promotion check. Monitoring agents usually work at the observe or advise level of autonomy: they open findings with citations, and owners decide what to change.

Document processing and decision workflows

Most compliance decisions start with documents. Agents handle them as a sequence of stages rather than one large prompt, which keeps every stage testable.

Extraction quality caps everything downstream, and scanned documents are where it usually fails. Our guide to document AI running on your own servers covers OCR, layout models and table extraction inside your perimeter, and the decision receipts guide above covers the decision half.

What supervisors expect

No financial supervisor has published an approval regime for AI agents. The statements they have published, dated below, point to four expectations.

Accountable people. The FCA’s page on its approach to AI, first published on 8 September 2025 and updated on 2 October 2026, says: “We do not plan to introduce extra regulations for AI.” It relies on existing frameworks, naming the Consumer Duty and the Senior Managers and Certification Regime, whose emphasis on senior manager accountability it calls relevant to the safe use of AI. A named senior manager therefore owns the process a compliance agent works in, as with any other system.

Records that explain outcomes. FINRA’s Regulatory Notice 24-09 of 27 June 2024 describes its rules as technology-neutral and says the notice creates no new obligations. The 2026 Annual Regulatory Oversight Report, published on 9 December 2025, goes further: it lists agent risks such as acting without human validation, acting beyond the user’s intended authority and multi-step reasoning that is hard to trace, and suggests firms decide where human-in-the-loop oversight sits and how agent actions are tracked. For generative AI generally it mentions keeping prompt and output logs and recording which model version was used. Our summary of FINRA’s notices and oversight findings on AI covers the broker-dealer detail.

Model risk management applied with judgement. In the US, the interagency revised guidance on model risk management (SR 26-2, 17 April 2026) superseded SR 11-7 and states that generative and agentic AI models are not within its scope, adding that a bank’s own risk management and governance should guide the controls for anything it does not cover. In the EU, the EBA’s factsheet of 21 November 2025 on the AI Act found no significant contradictions between the Act and EU banking and payments law and no immediate need for new EBA guidelines, while noting that AI for the creditworthiness of individuals is high-risk. The EBA adds that its mapping is not guidance or a statement of supervisory expectations.

Data protection. In the Bank of England and FCA survey published on 26 October 2026, data protection and security ranked among the highest-rated current AI risks, and 42% of respondents saw UK data protection and privacy rules as a high compliance burden. Under the GDPR, decisions based solely on automated processing that have legal or similarly significant effects carry their own conditions, one more reason a person signs off outcomes such as declining a customer.

Two EU regimes reach the platform itself. The Digital Omnibus moved the EU AI Act’s Annex III high-risk duties to 2 December 2027; most compliance agents sit outside Annex III, but check each use, as described in how the EU AI Act treats agents. For banks and insurers, DORA’s ICT risk rules cover the agent platform and its third-party arrangements. Sector context for lenders sits on the banking and finance deployments page.

Why on-premises deployment fits compliance agents

Compliance agents read the most sensitive material a firm holds and produce records that are sensitive in their own right.

• Confidential case files. Suspicious activity reports and the investigations behind them are confidential, and tipping off a customer is an offence in most jurisdictions. An outside model service adds a party to the circle of knowledge, which many money laundering reporting officers will not accept.
• Legal privilege. Counsel usually want privileged advice kept in systems the firm controls, because sharing it with third parties can weaken a later claim to privilege.
• Supervisory correspondence. Draft responses to supervisors and remediation plans are often restricted to a few named people.
• The trail itself. Agent traces hold customer data, rule interpretations and reviewer decisions. Where they live, who reads them and how long they are kept should be the firm’s decision.
• Third-party risk. Every external model or hosting service is another ICT third party to assess, contract and monitor, and in EU financial services that work falls under DORA.

Running agents, models and logs on infrastructure the firm controls keeps all five inside an existing perimeter. The cost is real: GPU capacity, model updates and operations become yours. Many compliance teams still find that easier to defend than another data flow to a model provider.

Measuring results

Published evidence on the outcomes of compliance agents is thin, so measure your own. What has been published shows how cautiously firms deploy them. In the Bank of England and FCA survey of 26 October 2026, 80% of respondents had agents in production for decision support, where agents recommend and people decide and execute. In risk and compliance, 30% of respondents reported decision-support agents, 10% constrained execution, 3% conditional autonomy and 1% broad autonomy. More than 90% reported human approval and pre-deployment review as controls, while ongoing monitoring and periodic review were each reported by around half.

That gap is where measurement belongs. Set a baseline before go-live and track the same measures afterwards:

Report them with your other key risk indicators. A fast agent that reviewers often override is a finding worth having early.

Pitfalls

• Automating the judgement. If reviewers accept suggestions unread, the approval step is theatre. Show the evidence, not only the conclusion, and sample approved cases.
• A stale rule library. An agent citing last year’s rulebook produces confident, wrong findings. Give the library an owner and a review date.
• Citations that do not hold. Check that every cited passage exists and supports the finding.
• Instructions hidden in documents. Files under review can carry text aimed at the model. OWASP’s Top 10 for Agentic Applications, published on 9 December 2025, lists agent goal hijack as ASI01; treat document content as data that never changes the agent’s task or permissions.
• Over-broad tool access. A check agent needs read access to case data and write access to its own findings, not the power to edit customer records or close alerts.
• No exit for unclear cases. Without an abstain path, the agent forces a conclusion where a person should look.
• Silent model changes. Pin model and prompt versions and re-run the test set before any change reaches production.

How VDF AI fits

VDF AI runs compliance agents where the case data already lives: your own data centre, a private cloud or VPC, a sovereign cloud or a fully air-gapped network, with VDF AI Cloud as the managed option. Each agent is configured in VDF AI Agents through five steps (Basics, Model, Tools & Skills, Prompt, Review), can use its own LLM or SLM, including local models served through Ollama or a compatible endpoint, and receives tools from an MCP-powered registry with least-privilege access scoped to that agent. Knowledge sources such as databases, Confluence, Jira and Notion supply the material it checks.

In VDF AI Networks a compliance check becomes a Network on a visual canvas. A Verification node checks evidence and conditions before the next stage proceeds, and a Human Approval node holds the outcome until an accountable person approves, rejects or returns it. Scheduled, webhook and event triggers turn the same Network into monitoring, and execution history keeps the provenance of every run.

The governance layer registers each agent and Network with an owner, purpose, risk class and version, logs every execution from input and identity through retrieval hits and tool calls to the final output, and stores each review with the reviewer and the elapsed time. The Vault keeps a cryptographically durable record of each execution, decision receipts hash prompt, sources, model, tools and outcome together, and evidence packs for the EU AI Act or a sector audit are built from those records. Controls are mapped to the EU AI Act, DORA, NIS2, GDPR and ISO 42001: the platform supports those obligations, and meeting them stays with the firm.