Agents Your Risk Team Will Actually Approve
Middle-office workflows built to pass review, run in production, and scale past the pilot.
We build agents for banks, lenders and fintechs. The model is the easy part. Identity, audit trails and human approval are what get one live and keep it there.
Documents read and extracted
Identity checks completed
Screening run, evidence attached
Every step written to the audit record
A named person decides. The agent does not.
The agent does the reading and the assembly. A person still makes the call.
Getting It Built Is Easy. Getting It Approved Is the Job.
Most financial services pilots do not fail on accuracy. They fail at security review, or in the model risk queue, or the first time someone asks what the agent did on a Tuesday in March. We build for that day from the start.
Its own identity, its own limits
Every agent gets a service identity and least-privilege access, system by system. It reads your core. It does not write to it. Your security team signs the access matrix before anything runs.
A person still decides
Agents assemble, draft and recommend. They do not approve credit, close alerts or file anything. A named human makes the call, and that approval is part of the record.
Reconstructable months later
Every action, input, prompt and model version captured append-only. When an examiner asks what happened on a given date, you answer with a record, not a recollection.
Evals before, drift watch after
An accuracy bar agreed with your team and tested before launch, then monitored for drift. Agents get worse quietly, and nothing on a normal dashboard tells you.
Cost ceilings per run
Token cost is metered and capped per workflow. An agent that gets more expensive as it gets busier does not survive its first budget cycle, so we price the unit before we build.
We do not grade our own work
Validation goes to someone who is not us. Be suspicious of any vendor offering to mark its own homework, and so should your second line.
These are the same controls we publish openly, applied to a regulated book. See the governance framework in full →
Sixteen years building production systems, well before anyone called it agentic.
A firm with a bench, not a two-person shop that disappears after launch.
No offshore delivery. The engineers who build it are the ones on your calls.
We build in your environment. Your data does not leave it.
Bring us one workflow. We prove it pays, build it properly, control it so security signs off, and keep it running after everyone else has moved on.
Nobody buys ten agents. You buy one, it works, and the second one is an easier conversation.
Agents for the Middle Office
Document-heavy, exception-heavy work where the rules are clear and the volume is punishing. Two are live today with a client and a verified number. Every agent has its own page with the workflow, the integration surface and what it takes to run it.
Detect finds what a person would only catch by reading everything. Decide drafts the judgment so someone edits instead of starting cold. Report assembles the output with every number traced to source.
Transaction Fraud Triage
False positives cut. Real threats escalated with evidence.
Fraud OperationsKYC / AML Review
Every alert worked up. Every disposition documented.
BSA / Financial CrimeRegulatory Change Triage
New rules mapped to your controls before the deadline.
ComplianceCredit Memo Drafting
Risk memos drafted from source docs. Analysts review, not retype.
Commercial CreditUnderwriting Edge-Case Escalation
Clean files advance. Edge cases arrive pre-summarized.
UnderwritingClient Onboarding
Six weeks to four days. Packet intake, checks, and system setup.
Onboarding OperationsReconciliation & Exceptions
Breaks found, matched, and explained by morning.
Finance OperationsPortfolio & Usage Analytics
Same-day visibility across every product line.
Finance & ProductReporting & Filings Assembly
Quarterly reporting drafted from live data, cited to source.
Regulatory ReportingKnowledge & Policy Search
Plain-English answers from your own policies, with citations.
Enterprise / FrontlineNothing in that stage yet.
Live, Not Theoretical
Two agents on the roster are running today. Here is what each one actually did, so you can judge the claim rather than take it.
- Client onboarding, six weeks to four days. A payments company, measured on median elapsed time. Packet intake, document checks and downstream system setup, with every approval step kept human.
- Policy and knowledge search, 50% faster answers. Suncoast Credit Union. Staff ask in plain English and get a cited answer from the credit union’s own policy material instead of hunting through it.
We will walk you through both on a call, including what did not work the first time. More named agents, real workflow traces and the full tech stack live on our development page.
Three Sensible Places to Start
Not the biggest theoretical payoff. The ones where the workflow is bounded, the data already exists, and you can prove the value inside a quarter.
Client Onboarding
The one we have already shipped. Bounded workflow, obvious before-and-after, and the approval steps stay with your people.
Credit Memo Drafting
Analysts spend days assembling what the agent assembles in minutes. They still write the recommendation, which is the part worth their time.
Reporting Assembly
Start with internal and management reporting. Every figure cited to source, nothing filed by the agent, and an easy first win with your auditors.
Bring us the one that hurts and we will tell you straight whether an agent is the right answer for it.
Fair Enough. The Longer Answers.
What makes an AI agent different from the AI we already have?
A chatbot answers and stops. A model scores and stops. An agent does the rest: it reads the documents, works out what the case needs, and takes the action, opening the record, drafting the memo, routing the exception.
That difference is the whole reason this page spends its first section on controls. Something that only answers needs to be accurate. Something that acts needs an identity, a permission boundary, an audit trail and a human gate.
How do these get through our model risk management process?
We assume the agent is in scope for model risk review under SR 11-7 until your MRM function decides otherwise, and we build the validation package alongside the agent rather than after it: intended use, conceptual soundness, data lineage, the eval set and its results, monitoring plan and known limitations.
Validation itself goes to someone independent of us. We would be suspicious of any vendor offering to mark its own homework, and so should your second line.
Plan on time for it. MRM queues commonly run eight to sixteen weeks after the build is finished. We scope to that rather than around it.
What about fair lending on the credit agents?
Handled as scope, not as an afterthought. Fair lending testing is in the plan from day one, and your compliance team sees the test design before we build.
It is also why the credit agents draft and escalate rather than advance files. Auto-advancing a consumer credit file is an adverse action surface, and no efficiency gain is worth that exposure.
Should we build these, or buy a platform?
Both, and we will tell you which is which on the first call. Buy the layers where the value is the data or the examined workflow: sanctions and PEP screening (ComplyAdvantage maintains the list itself; Sardine and Unit21 screen against data they do not own), consortium fraud scoring, and case management with SAR e-filing (Hummingbird, Unit21). You cannot build a consortium, and rebuilding a FinCEN filing path wins nothing.
Build the parts shaped like your institution: the seams between those platforms and your core, anything governed by your credit box and your policy, and reporting assembled across systems that were never designed to reconcile. No vendor will build those for one bank.
Will these work with our core banking system?
Yes, and the integration is usually the honest majority of the work. We have built against cores, loan origination systems, servicing platforms and the layers of middleware in between, including the ones with no real API where the answer is a file drop and a schedule.
Read-only first, always. The agent reads the core and writes to its own record. Writing back to a system of record is a separate conversation with your controls team, and it comes later.
Do we have to take all ten?
No, and you should not. Nobody has ever bought ten agents. You pick the workflow that hurts, we prove it pays before we build it, and the second one is a much easier conversation because the controls are already in place.
What does it cost to find out if one of these is worth doing?
A fixed-fee diagnostic: two weeks, a clear verdict on the workflow, the integration surface mapped, and a build estimate you can take to your budget holder. Delivered as the Lumynate ROI Audit, from $30K, with half the fee crediting against the build.
If the verdict is that an agent is the wrong answer, you get that in writing, and the finding is usually worth more than the fee.
Every agent above runs on Lumynate, our system for building and operating agents: the method, the reusable component library, the guardrails, and the team that keeps it running after go-live.
Bring Us the One That Hurts
Thirty minutes, one workflow, and an honest answer about whether an agent belongs anywhere near it.
Or start with the two-week diagnostic if you already have a pilot that stalled.